Edit tour

Windows Analysis Report
OneDriveUpdater.exe

Overview

General Information

Sample name:	OneDriveUpdater.exe
Analysis ID:	1467919
MD5:	792e95b64b9cf45ac8bc10d4d0f077c2
SHA1:	e50af7ee7e0a323d8aa60b6d9b3d39ab33b004f5
SHA256:	60e64dd2c6d2ac6fe9b498fadac81bc34a725de5d893e7df8b2728d8dc5b192d
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	true
Confidence:	100%

Signatures

Contains functionality to check if a connection to the internet is available

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

OneDriveUpdater.exe (PID: 7252 cmdline: "C:\Users\user\Desktop\OneDriveUpdater.exe" MD5: 792E95B64B9CF45AC8BC10D4D0F077C2)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4110E98 CryptAcquireContextW,CryptCreateHash,CryptGetHashParam,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptDestroyHash,CryptReleaseContext,	0_2_00007FF7C4110E98
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4120034 _invalid_parameter_noinfo,CryptAcquireContextW,GetLastError,CryptImportKey,GetLastError,CryptCreateHash,GetLastError,CryptSetHashParam,GetLastError,CryptHashData,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,	0_2_00007FF7C4120034
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4113C64 _Aligned_get_default_resource,CryptBinaryToStringW,CryptBinaryToStringW,CryptStringToBinaryW,_Aligned_get_default_resource,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7C4113C64
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40B8874 BCryptDestroyKey,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7C40B8874
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C42D0F3C CryptCreateHash,GetLastError,CreateFileW,GetFileSize,CreateFileMappingW,MapViewOfFile,CryptHashData,GetLastError,CryptGetHashParam,CryptGetHashParam,UnmapViewOfFile,CryptDestroyHash,CloseHandle,CloseHandle,CloseHandle,	0_2_00007FF7C42D0F3C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C42D0C78 CryptReleaseContext,	0_2_00007FF7C42D0C78
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C42D0CD4 CryptStringToBinaryW,GetLastError,CryptStringToBinaryW,CryptStringToBinaryW,CryptStringToBinaryW,	0_2_00007FF7C42D0CD4
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C42D11CC CryptBinaryToStringW,CryptBinaryToStringW,GetLastError,	0_2_00007FF7C42D11CC
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C42D1338 CryptBinaryToStringW,CryptBinaryToStringW,GetLastError,	0_2_00007FF7C42D1338
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C42D14A4 CryptAcquireContextW,GetLastError,	0_2_00007FF7C42D14A4
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4092050 CryptDestroyHash,	0_2_00007FF7C4092050
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40920B4 CryptGetHashParam,GetLastError,CryptGetHashParam,_invalid_parameter_noinfo,CryptDestroyHash,	0_2_00007FF7C40920B4
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40921A4 CryptCreateHash,GetLastError,	0_2_00007FF7C40921A4
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40921F0 CryptAcquireContextW,	0_2_00007FF7C40921F0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4092220 CryptReleaseContext,	0_2_00007FF7C4092220
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C409224C CryptHashData,GetLastError,	0_2_00007FF7C409224C

Source: OneDriveUpdater.exe

Static PE information: certificate valid

Source: OneDriveUpdater.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\dbs\sh\odct\0417_205450_0\client\onedrive\Product\StandaloneUpdater\exe\obj\amd64\OneDriveStandaloneUpdater.pdbT source: OneDriveUpdater.exe
Source:	Binary string: D:\dbs\sh\odct\0417_205450_0\client\onedrive\Product\StandaloneUpdater\exe\obj\amd64\OneDriveStandaloneUpdater.pdb source: OneDriveUpdater.exe

Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4030EC4 FindFirstFileW,GetLastError,FindNextFileW,GetLastError,FindClose,	0_2_00007FF7C4030EC4
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C406521C FindFirstFileW,GetLastError,FindNextFileW,GetLastError,CompareFileTime,DeleteFileW,GetLastError,FindClose,	0_2_00007FF7C406521C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C403125C FindFirstFileW,GetLastError,FindNextFileW,GetLastError,FindClose,	0_2_00007FF7C403125C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C407ACC0 FindFirstFileW,FindNextFileW,FindClose,	0_2_00007FF7C407ACC0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40A91B4 GetTempPathW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,	0_2_00007FF7C40A91B4
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C410DFF8 FindFirstFileW,FindClose,DeleteFileW,GetLastError,	0_2_00007FF7C410DFF8
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4122020 FindFirstFileNameW,	0_2_00007FF7C4122020
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4122080 FindFirstFileW,	0_2_00007FF7C4122080
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4051A80 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7C4051A80
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C414E934 FindClose,FindFirstFileExW,GetLastError,FindFirstFileExW,GetLastError,	0_2_00007FF7C414E934
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C412F9D0 FindFirstFileW,	0_2_00007FF7C412F9D0

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Code function: 0_2_00007FF7C4122A30 InternetCheckConnectionW,

0_2_00007FF7C4122A30

Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients.config.office.net/collector/v1.0/inventoryodbc:December
Source: OneDriveUpdater.exe, 00000000.00000003.2037954027.000001BB9545A000.00000004.00000020.00020000.00000000.sdmp, OneDriveUpdater.exe, 00000000.00000003.2038396854.000001BB9553B000.00000004.00000020.00020000.00000000.sdmp, OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp, OneDriveUpdater.exe, 00000000.00000003.2038736188.000001BB95499000.00000004.00000020.00020000.00000000.sdmp, OneDriveUpdater.exe, 00000000.00000003.2038342311.000001BB9548A000.00000004.00000020.00020000.00000000.sdmp, OneDriveUpdater.exe, 00000000.00000003.2038946928.000001BB9553D000.00000004.00000020.00020000.00000000.sdmp, OneDriveUpdater.exe, 00000000.00000003.2038314047.000001BB95465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: OneDriveUpdater.exe	String found in binary or memory: https://dc.services.visualstudio.com/v2/track
Source: OneDriveUpdater.exe	String found in binary or memory: https://g.live.com
Source: OneDriveUpdater.exe	String found in binary or memory: https://g.live.com/1rewlive5skydrive/MsitFastV2
Source: OneDriveUpdater.exe	String found in binary or memory: https://g.live.com/1rewlive5skydrive/MsitSlowV2
Source: OneDriveUpdater.exe	String found in binary or memory: https://g.live.com/1rewlive5skydrive/ODSUEnterpriseV2
Source: OneDriveUpdater.exe	String found in binary or memory: https://g.live.com/1rewlive5skydrive/ODSUEnterpriseV2https://g.live.com/1rewlive5skydrive/ODSUMsitFa
Source: OneDriveUpdater.exe	String found in binary or memory: https://g.live.com/1rewlive5skydrive/ODSUInsiderV2
Source: OneDriveUpdater.exe	String found in binary or memory: https://g.live.com/1rewlive5skydrive/ODSUMsitFastV2
Source: OneDriveUpdater.exe	String found in binary or memory: https://g.live.com/1rewlive5skydrive/ODSUMsitSlowV2
Source: StandaloneUpdater-2024-07-04.2340.7252.1.aodl.0.dr, StandaloneUpdate_2024-07-04_234035_7252-7256.log.0.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/ODSUProductionV2
Source: OneDriveUpdater.exe	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OSRSS_32bit
Source: OneDriveUpdater.exe	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OSRSS_32bithttps://g.live.com/1rewlive5skydrive/OSRSS_64bit%loc
Source: OneDriveUpdater.exe	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OSRSS_64bit
Source: OneDriveUpdater.exe, 00000000.00000002.2899076468.000001BB954C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/One
Source: OneDriveUpdater.exe	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveEnterpriseV2
Source: OneDriveUpdater.exe	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveInsiderV2
Source: StandaloneUpdater-2024-07-04.2340.7252.1.aodl.0.dr, StandaloneUpdate_2024-07-04_234035_7252-7256.log.0.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2ember:Dec:December
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2ember:Dec:Decemberd$hh0
Source: OneDriveUpdater.exe, 00000000.00000002.2899076468.000001BB954C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/Onee
Source: OneDriveUpdater.exe	String found in binary or memory: https://g.live.com/1rewlive5skydrive/win7
Source: OneDriveUpdater.exe	String found in binary or memory: https://g.live.com/1rewlive5skydrive/win8
Source: OneDriveUpdater.exe	String found in binary or memory: https://g.live.com/1rewlive5skydrive/win81
Source: OneDriveUpdater.exe	String found in binary or memory: https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co
Source: OneDriveUpdater.exe	String found in binary or memory: https://g.live.com/odclientsettings/Enterprise
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB936C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Enterprise%l
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/EnterpriseG?Bi
Source: OneDriveUpdater.exe	String found in binary or memory: https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.
Source: OneDriveUpdater.exe, OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Insiders
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB936C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Insidersl
Source: OneDriveUpdater.exe	String found in binary or memory: https://g.live.com/odclientsettings/MsitFast
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/MsitFast:?
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB936C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/MsitFastl
Source: OneDriveUpdater.exe	String found in binary or memory: https://g.live.com/odclientsettings/MsitSlow
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/MsitSlow#?
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB936C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/MsitSlowl
Source: StandaloneUpdate_2024-07-04_234035_7252-7256.log.0.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prodonfig
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB936C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prods
Source: OneDriveUpdater.exe, 00000000.00000002.2899300327.000001BB95800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.
Source: OneDriveUpdater.exe, OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB936EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms
Source: OneDriveUpdater.exe, 00000000.00000002.2899300327.000001BB95800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Ig
Source: OneDriveUpdater.exe, 00000000.00000002.2899300327.000001BB95800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Install
Source: OneDriveUpdater.exe, 00000000.00000002.2899300327.000001BB95800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.1
Source: StandaloneUpdater-2024-07-04.2340.7252.1.aodl.0.dr, Update.xml.0.dr, Update.xml0.0.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.116.0609.0005/OneDriveSetup.exe
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB936EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.116.0609.0005/OneDriveSetup.exen
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB936EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.116.0609.0005/OneDriveSetup.exes.
Source: StandaloneUpdater-2024-07-04.2340.7252.1.aodl.0.dr, Update.xml.0.dr, Update.xml0.0.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.116.0609.0005/amd64/OneDriveSetup.exe
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.116.0609.0005/amd64/OneDriveSetup.exes
Source: StandaloneUpdater-2024-07-04.2340.7252.1.aodl.0.dr, Update.xml.0.dr, Update.xml0.0.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.116.0609.0005/arm64/OneDriveSetup.exe
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.116.0609.0005/arm64/OneDriveSetup.exeb-
Source: StandaloneUpdater-2024-07-04.2340.7252.1.aodl.0.dr, Update.xml0.0.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.126.0623.0001/OneDriveSetup.exe
Source: StandaloneUpdater-2024-07-04.2340.7252.1.aodl.0.dr, Update.xml0.0.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.126.0623.0001/amd64/OneDriveSetup.exe
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.126.0623.0001/amd64/OneDriveSetup.exerday
Source: StandaloneUpdater-2024-07-04.2340.7252.1.aodl.0.dr, Update.xml0.0.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.126.0623.0001/arm64/OneDriveSetup.exe
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.126.0623.0001/arm64/OneDriveSetup.exes
Source: StandaloneUpdater-2024-07-04.2340.7252.1.aodl.0.dr, Update.xml0.0.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.128.0625.0001/OneDriveSetup.exe
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB936EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.128.0625.0001/OneDriveSetup.exenes
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93762000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.128.0625.0001/amd64/O
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93762000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.128.0625.0001/amd64/ODi
Source: StandaloneUpdater-2024-07-04.2340.7252.1.aodl.0.dr, Update.xml0.0.dr, StandaloneUpdate_2024-07-04_234035_7252-7256.log.0.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.128.0625.0001/amd64/OneDriveSetup.exe
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.128.0625.0001/amd64/OneDriveSetup.exe?OneDriveUpdate=1d5c
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93708000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.128.0625.0001/amd64/OneDriveSetup.exees
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.128.0625.0001/amd64/OneDriveSetup.exerday~-
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.128.0625.0001/amd64/OneDriveSetup.exes
Source: StandaloneUpdater-2024-07-04.2340.7252.1.aodl.0.dr, Update.xml0.0.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.128.0625.0001/arm64/OneDriveSetup.exe
Source: OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.128.0625.0001/arm64/OneDriveSetup.exes
Source: OneDriveUpdater.exe, 00000000.00000002.2899300327.000001BB95800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/24.1O

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Code function: 0_2_00007FF7C4120034 _invalid_parameter_noinfo,CryptAcquireContextW,GetLastError,CryptImportKey,GetLastError,CryptCreateHash,GetLastError,CryptSetHashParam,GetLastError,CryptHashData,GetLastError,CryptHashData,GetLastError,CryptGetHashParam,GetLastError,CryptDestroyHash,CryptDestroyKey,CryptReleaseContext,

0_2_00007FF7C4120034

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Code function: 0_2_00007FF7C407B214: CreateFileW,DeviceIoControl,DeviceIoControl,FindCloseChangeNotification,

0_2_00007FF7C407B214

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Code function: 0_2_00007FF7C4121F10 DeleteService,

0_2_00007FF7C4121F10

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Code function: 0_2_00007FF7C4121CA0 CreateProcessAsUserW,

0_2_00007FF7C4121CA0

Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4014748	0_2_00007FF7C4014748
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41107BC	0_2_00007FF7C41107BC
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40642AC	0_2_00007FF7C40642AC
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C414C3FC	0_2_00007FF7C414C3FC
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4010490	0_2_00007FF7C4010490
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40E04A4	0_2_00007FF7C40E04A4
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C401D018	0_2_00007FF7C401D018
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C42CD084	0_2_00007FF7C42CD084
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40E091C	0_2_00007FF7C40E091C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4111748	0_2_00007FF7C4111748
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41317B8	0_2_00007FF7C41317B8
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40A97C0	0_2_00007FF7C40A97C0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C406521C	0_2_00007FF7C406521C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4165224	0_2_00007FF7C4165224
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4025280	0_2_00007FF7C4025280
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4061D0C	0_2_00007FF7C4061D0C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C412A8E0	0_2_00007FF7C412A8E0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41129C0	0_2_00007FF7C41129C0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4026C30	0_2_00007FF7C4026C30
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4103E90	0_2_00007FF7C4103E90
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C411BE6C	0_2_00007FF7C411BE6C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4120034	0_2_00007FF7C4120034
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C416C520	0_2_00007FF7C416C520
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4158570	0_2_00007FF7C4158570
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C42B4600	0_2_00007FF7C42B4600
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40F45F8	0_2_00007FF7C40F45F8
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4094620	0_2_00007FF7C4094620
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4048690	0_2_00007FF7C4048690
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40C4698	0_2_00007FF7C40C4698
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4114714	0_2_00007FF7C4114714
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41AC7A0	0_2_00007FF7C41AC7A0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C413C7E0	0_2_00007FF7C413C7E0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C42B8850	0_2_00007FF7C42B8850
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40B8874	0_2_00007FF7C40B8874
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C415C8E0	0_2_00007FF7C415C8E0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4190154	0_2_00007FF7C4190154
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C42B8130	0_2_00007FF7C42B8130
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4174120	0_2_00007FF7C4174120
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C404C1AC	0_2_00007FF7C404C1AC
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41241D0	0_2_00007FF7C41241D0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C42B81B0	0_2_00007FF7C42B81B0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40C41FC	0_2_00007FF7C40C41FC
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40C8310	0_2_00007FF7C40C8310
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4020390	0_2_00007FF7C4020390
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40BC414	0_2_00007FF7C40BC414
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40C0420	0_2_00007FF7C40C0420
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C411C430	0_2_00007FF7C411C430
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40F045C	0_2_00007FF7C40F045C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C407C4D0	0_2_00007FF7C407C4D0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40B0DD0	0_2_00007FF7C40B0DD0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4084DD8	0_2_00007FF7C4084DD8
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C404CE48	0_2_00007FF7C404CE48
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C411CE84	0_2_00007FF7C411CE84
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4168E80	0_2_00007FF7C4168E80
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40C0E5C	0_2_00007FF7C40C0E5C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C42D0F3C	0_2_00007FF7C42D0F3C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C413CF90	0_2_00007FF7C413CF90
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4084F78	0_2_00007FF7C4084F78
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4118F70	0_2_00007FF7C4118F70
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40A0FE0	0_2_00007FF7C40A0FE0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41809F0	0_2_00007FF7C41809F0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4090A24	0_2_00007FF7C4090A24
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4168A58	0_2_00007FF7C4168A58
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40B8AE0	0_2_00007FF7C40B8AE0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4154ADC	0_2_00007FF7C4154ADC
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4004B60	0_2_00007FF7C4004B60
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40C8B60	0_2_00007FF7C40C8B60
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4098BDC	0_2_00007FF7C4098BDC
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C416CC70	0_2_00007FF7C416CC70
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C412CCC8	0_2_00007FF7C412CCC8
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C42BCCE0	0_2_00007FF7C42BCCE0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4199554	0_2_00007FF7C4199554
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4031560	0_2_00007FF7C4031560
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40E1558	0_2_00007FF7C40E1558
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C415D560	0_2_00007FF7C415D560
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41410B0	0_2_00007FF7C41410B0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4055670	0_2_00007FF7C4055670
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C419D710	0_2_00007FF7C419D710
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C42C5790	0_2_00007FF7C42C5790
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41497A4	0_2_00007FF7C41497A4
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40D9810	0_2_00007FF7C40D9810
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C405982A	0_2_00007FF7C405982A
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40D9860	0_2_00007FF7C40D9860
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4129860	0_2_00007FF7C4129860
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C42C58B0	0_2_00007FF7C42C58B0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40A1904	0_2_00007FF7C40A1904
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C405911C	0_2_00007FF7C405911C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C419912C	0_2_00007FF7C419912C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C404D1CC	0_2_00007FF7C404D1CC
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41AD280	0_2_00007FF7C41AD280
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41612C0	0_2_00007FF7C41612C0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C42C12B8	0_2_00007FF7C42C12B8
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C411CE84	0_2_00007FF7C411CE84
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4179448	0_2_00007FF7C4179448
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41E1DFC	0_2_00007FF7C41E1DFC
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4139E04	0_2_00007FF7C4139E04
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4055DE0	0_2_00007FF7C4055DE0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4161F40	0_2_00007FF7C4161F40
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4141F1C	0_2_00007FF7C4141F1C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4021F44	0_2_00007FF7C4021F44
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4159FAC	0_2_00007FF7C4159FAC
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C419997C	0_2_00007FF7C419997C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41410B0	0_2_00007FF7C41410B0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4005A00	0_2_00007FF7C4005A00
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40BDA30	0_2_00007FF7C40BDA30
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4051A80	0_2_00007FF7C4051A80
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40BDAA0	0_2_00007FF7C40BDAA0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40B1AA0	0_2_00007FF7C40B1AA0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4031B60	0_2_00007FF7C4031B60
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4099CD4	0_2_00007FF7C4099CD4
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4111CF0	0_2_00007FF7C4111CF0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C415252C	0_2_00007FF7C415252C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C415E560	0_2_00007FF7C415E560
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40B2660	0_2_00007FF7C40B2660
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40DA65C	0_2_00007FF7C40DA65C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4096720	0_2_00007FF7C4096720
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C402A780	0_2_00007FF7C402A780
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4166830	0_2_00007FF7C4166830
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C414A830	0_2_00007FF7C414A830
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41A285C	0_2_00007FF7C41A285C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C418A144	0_2_00007FF7C418A144
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41EA11C	0_2_00007FF7C41EA11C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40B6140	0_2_00007FF7C40B6140
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41EA21C	0_2_00007FF7C41EA21C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41BA2DC	0_2_00007FF7C41BA2DC
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4016354	0_2_00007FF7C4016354
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C405E35C	0_2_00007FF7C405E35C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C411E410	0_2_00007FF7C411E410
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C415A3DC	0_2_00007FF7C415A3DC
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40C6480	0_2_00007FF7C40C6480
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C406ED48	0_2_00007FF7C406ED48
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C404ADB4	0_2_00007FF7C404ADB4
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4016E90	0_2_00007FF7C4016E90
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C405EF21	0_2_00007FF7C405EF21
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40AEF60	0_2_00007FF7C40AEF60
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C405EFAB	0_2_00007FF7C405EFAB
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C404AF9C	0_2_00007FF7C404AF9C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4156FD0	0_2_00007FF7C4156FD0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C406F050	0_2_00007FF7C406F050
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C416F06C	0_2_00007FF7C416F06C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C415B0C4	0_2_00007FF7C415B0C4
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C42C3108	0_2_00007FF7C42C3108
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40E3110	0_2_00007FF7C40E3110
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40B6958	0_2_00007FF7C40B6958
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C405A9E8	0_2_00007FF7C405A9E8
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40DA65C	0_2_00007FF7C40DA65C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C404A9E0	0_2_00007FF7C404A9E0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C405EA30	0_2_00007FF7C405EA30
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4156A80	0_2_00007FF7C4156A80
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4006A80	0_2_00007FF7C4006A80
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4072B3C	0_2_00007FF7C4072B3C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C404ABC8	0_2_00007FF7C404ABC8
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C403EC48	0_2_00007FF7C403EC48
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C405B538	0_2_00007FF7C405B538
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C410F56C	0_2_00007FF7C410F56C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C42C3600	0_2_00007FF7C42C3600
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4137610	0_2_00007FF7C4137610
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41135EC	0_2_00007FF7C41135EC
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40476CC	0_2_00007FF7C40476CC
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40DB6DC	0_2_00007FF7C40DB6DC
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4133734	0_2_00007FF7C4133734
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C406F7AC	0_2_00007FF7C406F7AC
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41A77FC	0_2_00007FF7C41A77FC
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C416B7F0	0_2_00007FF7C416B7F0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40AF824	0_2_00007FF7C40AF824
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4167850	0_2_00007FF7C4167850
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C42B78D0	0_2_00007FF7C42B78D0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C414B8C8	0_2_00007FF7C414B8C8
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C404B188	0_2_00007FF7C404B188
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40971C0	0_2_00007FF7C40971C0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40BB1C4	0_2_00007FF7C40BB1C4
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C401F1E8	0_2_00007FF7C401F1E8
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40FB254	0_2_00007FF7C40FB254
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C405B2BC	0_2_00007FF7C405B2BC
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C411B2F4	0_2_00007FF7C411B2F4
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C404B370	0_2_00007FF7C404B370
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4117400	0_2_00007FF7C4117400
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C42BB474	0_2_00007FF7C42BB474
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40A7D2D	0_2_00007FF7C40A7D2D
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C418FD2C	0_2_00007FF7C418FD2C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41E3DD0	0_2_00007FF7C41E3DD0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4117E78	0_2_00007FF7C4117E78
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4133EC0	0_2_00007FF7C4133EC0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40FBEF4	0_2_00007FF7C40FBEF4
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C414FF28	0_2_00007FF7C414FF28
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C415BF88	0_2_00007FF7C415BF88
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4057930	0_2_00007FF7C4057930
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C419F920	0_2_00007FF7C419F920
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41539C4	0_2_00007FF7C41539C4
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C408F9C8	0_2_00007FF7C408F9C8
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C42CF9A4	0_2_00007FF7C42CF9A4
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4197A68	0_2_00007FF7C4197A68

Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: String function: 00007FF7C4065BC0 appears 95 times
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: String function: 00007FF7C40649A8 appears 39 times
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: String function: 00007FF7C40387F8 appears 40 times
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: String function: 00007FF7C4064448 appears 63 times
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: String function: 00007FF7C4019D08 appears 64 times
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: String function: 00007FF7C40198B4 appears 690 times
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: String function: 00007FF7C4174970 appears 43 times
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: String function: 00007FF7C40381A4 appears 55 times
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: String function: 00007FF7C40A3E8C appears 39 times
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: String function: 00007FF7C402C7D8 appears 57 times
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: String function: 00007FF7C40D9714 appears 31 times
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: String function: 00007FF7C402E8B8 appears 205 times
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: String function: 00007FF7C4019D98 appears 33 times
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: String function: 00007FF7C4175F64 appears 181 times
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: String function: 00007FF7C4079000 appears 39 times
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: String function: 00007FF7C40765D4 appears 112 times
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: String function: 00007FF7C401B4E4 appears 950 times

Source: OneDriveUpdater.exe	Binary or memory string: OriginalFilename vs OneDriveUpdater.exe
Source: OneDriveUpdater.exe	Binary or memory string: \StringFileInfo\%04x%04x\OriginalFilename vs OneDriveUpdater.exe
Source: OneDriveUpdater.exe, 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOneDriveStandaloneUpdater.exeF vs OneDriveUpdater.exe
Source: OneDriveUpdater.exe, 00000000.00000002.2898735011.000001BB95403000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWinWord.exeB vs OneDriveUpdater.exe
Source: OneDriveUpdater.exe	Binary or memory string: OriginalFilenameOneDriveStandaloneUpdater.exeF vs OneDriveUpdater.exe

Source: classification engine

Classification label: clean6.winEXE@1/6@0/0

Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4121670 AdjustTokenPrivileges,	0_2_00007FF7C4121670
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4117230 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,CloseHandle,GetLastError,AdjustTokenPrivileges,GetLastError,CloseHandle,	0_2_00007FF7C4117230
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40C74A0 LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,GetLastError,	0_2_00007FF7C40C74A0

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Code function: 0_2_00007FF7C41221B0 GetDiskFreeSpaceExW,

0_2_00007FF7C41221B0

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Code function: CreateServiceW,

0_2_00007FF7C4121DA0

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Code function: 0_2_00007FF7C4139C30 CreateToolhelp32Snapshot,Process32FirstW,FindCloseChangeNotification,

0_2_00007FF7C4139C30

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Code function: 0_2_00007FF7C4105810 CoCreateInstance,

0_2_00007FF7C4105810

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Code function: 0_2_00007FF7C4121910 ChangeServiceConfig2W,

0_2_00007FF7C4121910

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\StandaloneUpdater-2024-07-04.2340.7252.1.aodl

Jump to behavior

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Mutant created: \Sessions\1\BaseNamedObjects\FileSyncClientUpdaterNamedMutex

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

File created: C:\Users\user\AppData\Local\Temp\wctC1D2.tmp

Jump to behavior

Source: OneDriveUpdater.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

File read: C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\DeviceHealthSummaryConfiguration.ini

Jump to behavior

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: OneDriveUpdater.exe, 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmp, OneDriveUpdater.exe, 00000000.00000000.1645667013.00007FF7C43BF000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: OneDriveUpdater.exe, 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmp, OneDriveUpdater.exe, 00000000.00000000.1645667013.00007FF7C43BF000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: OneDriveUpdater.exe, 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmp, OneDriveUpdater.exe, 00000000.00000000.1645667013.00007FF7C43BF000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: OneDriveUpdater.exe, 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmp, OneDriveUpdater.exe, 00000000.00000000.1645667013.00007FF7C43BF000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: wofutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Section loaded: msxml6.dll	Jump to behavior

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5CE34C0D-0DC9-4C1F-897C-DAA1B78CEE7C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

File written: C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\DeviceHealthSummaryConfiguration.ini

Jump to behavior

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Office\ClickToRun\Configuration

Jump to behavior

Source: OneDriveUpdater.exe

Static PE information: certificate valid

Source: initial sample

Static PE information: Valid certificate with Microsoft Issuer

Source: OneDriveUpdater.exe

Static PE information: More than 248 > 100 exports found

Source: OneDriveUpdater.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: OneDriveUpdater.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: OneDriveUpdater.exe

Static file information: File size 4200864 > 1048576

Source: OneDriveUpdater.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2e7a00

Source: OneDriveUpdater.exe

Static PE information: More than 200 imports for KERNEL32.dll

Source: OneDriveUpdater.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: OneDriveUpdater.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: OneDriveUpdater.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: OneDriveUpdater.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: OneDriveUpdater.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: OneDriveUpdater.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: OneDriveUpdater.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: OneDriveUpdater.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\dbs\sh\odct\0417_205450_0\client\onedrive\Product\StandaloneUpdater\exe\obj\amd64\OneDriveStandaloneUpdater.pdbT source: OneDriveUpdater.exe
Source:	Binary string: D:\dbs\sh\odct\0417_205450_0\client\onedrive\Product\StandaloneUpdater\exe\obj\amd64\OneDriveStandaloneUpdater.pdb source: OneDriveUpdater.exe

Source: OneDriveUpdater.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: OneDriveUpdater.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: OneDriveUpdater.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: OneDriveUpdater.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: OneDriveUpdater.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Code function: 0_2_00007FF7C41241D0 OpenProcess,GetLastError,LoadLibraryW,GetProcAddress,FreeLibrary,GetLastError,ReadProcessMemory,GetLastError,ReadProcessMemory,GetLastError,ReadProcessMemory,GetLastError,CloseHandle,

0_2_00007FF7C41241D0

Source: OneDriveUpdater.exe	Static PE information: section name: .didat
Source: OneDriveUpdater.exe	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Code function: 0_2_00007FF7C412E481 push rax; ret

0_2_00007FF7C412E483

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Code function: 0_2_00007FF7C414F332 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF7C414F332

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4030EC4 FindFirstFileW,GetLastError,FindNextFileW,GetLastError,FindClose,	0_2_00007FF7C4030EC4
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C406521C FindFirstFileW,GetLastError,FindNextFileW,GetLastError,CompareFileTime,DeleteFileW,GetLastError,FindClose,	0_2_00007FF7C406521C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C403125C FindFirstFileW,GetLastError,FindNextFileW,GetLastError,FindClose,	0_2_00007FF7C403125C
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C407ACC0 FindFirstFileW,FindNextFileW,FindClose,	0_2_00007FF7C407ACC0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40A91B4 GetTempPathW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,	0_2_00007FF7C40A91B4
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C410DFF8 FindFirstFileW,FindClose,DeleteFileW,GetLastError,	0_2_00007FF7C410DFF8
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4122020 FindFirstFileNameW,	0_2_00007FF7C4122020
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4122080 FindFirstFileW,	0_2_00007FF7C4122080
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4051A80 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7C4051A80
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C414E934 FindClose,FindFirstFileExW,GetLastError,FindFirstFileExW,GetLastError,	0_2_00007FF7C414E934
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C412F9D0 FindFirstFileW,	0_2_00007FF7C412F9D0

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Code function: 0_2_00007FF7C4038BBC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7C4038BBC

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

0_2_00007FF7C41241D0

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Code function: 0_2_00007FF7C419580C GetProcessHeap,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7C419580C

Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4038DA0 SetUnhandledExceptionFilter,	0_2_00007FF7C4038DA0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4038FC4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7C4038FC4
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4038BBC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7C4038BBC
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C40465BC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7C40465BC

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Code function: 0_2_00007FF7C41216B0 AllocateAndInitializeSid,

0_2_00007FF7C41216B0

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Code function: 0_2_00007FF7C4063FF0 cpuid

0_2_00007FF7C4063FF0

Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: GetLocaleInfoEx,	0_2_00007FF7C414F1B8
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: GetLocaleInfoW,	0_2_00007FF7C40585E0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF7C4058738
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: GetLocaleInfoW,	0_2_00007FF7C40587E8
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF7C4058914
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: EnumSystemLocalesW,	0_2_00007FF7C4058228
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: EnumSystemLocalesW,	0_2_00007FF7C40582F8
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF7C4058390
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: EnumSystemLocalesW,	0_2_00007FF7C40533C4
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF7C4057ED8
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: GetLocaleInfoW,	0_2_00007FF7C4053960

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Code function: 0_2_00007FF7C40648E8 GetSystemTime,EnterCriticalSection,LeaveCriticalSection,

0_2_00007FF7C40648E8

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Code function: 0_2_00007FF7C4120880 LookupAccountNameW,LookupAccountNameW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7C4120880

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Code function: 0_2_00007FF7C41930C8 GetTimeZoneInformation,

0_2_00007FF7C41930C8

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Code function: 0_2_00007FF7C411B8FC _Aligned_get_default_resource,_invalid_parameter_noinfo_noreturn,GetVersionExW,RegGetValueW,

0_2_00007FF7C411B8FC

Source: C:\Users\user\Desktop\OneDriveUpdater.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C410D754 CreateBindCtx,	0_2_00007FF7C410D754
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4082CD0 socket,htons,htonl,bind,setsockopt,listen,closesocket,	0_2_00007FF7C4082CD0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41235C0 RpcBindingFromStringBindingW,	0_2_00007FF7C41235C0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41235D0 RpcBindingSetAuthInfoExW,	0_2_00007FF7C41235D0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C41235B0 RpcBindingFree,	0_2_00007FF7C41235B0
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4123620 RpcBindingVectorFree,	0_2_00007FF7C4123620
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4123670 RpcServerInqBindings,	0_2_00007FF7C4123670
Source: C:\Users\user\Desktop\OneDriveUpdater.exe	Code function: 0_2_00007FF7C4123710 RpcStringBindingComposeW,	0_2_00007FF7C4123710

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	11 Service Execution	1 Valid Accounts	1 Valid Accounts	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Native API	12 Windows Service	11 Access Token Manipulation	1 Valid Accounts	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	12 Windows Service	11 Access Token Manipulation	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Network Connections Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	36 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
OneDriveUpdater.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://clients.config.office.net/user/v1.0/tenantassociationkey	0%	URL Reputation	safe
https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/ODSUMsitSlowV2	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/Enterprise	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/Prod	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/OneDriveEnterpriseV2	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/ODSUInsiderV2	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/EnterpriseG?Bi	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/MsitFastl	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/Prods	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/MsitSlow#?	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/win81	0%	Avira URL Cloud	safe
https://clients.config.office.net/collector/v1.0/inventoryodbc:December	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/Onee	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/ODSUMsitFastV2	0%	Avira URL Cloud	safe
https://dc.services.visualstudio.com/v2/track	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/One	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/Prodonfig	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/MsitFast:?	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/MsitFastV2	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/Insiders	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/ODSUEnterpriseV2https://g.live.com/1rewlive5skydrive/ODSUMsitFa	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/MsitSlow	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/OneDriveInsiderV2	0%	Avira URL Cloud	safe
https://oneclient.sfx.	0%	Avira URL Cloud	safe
https://g.live.com	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/Enterprise%l	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/OSRSS_32bit	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/Insidersl	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/OSRSS_64bit	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/MsitSlowl	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/ODSUEnterpriseV2	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/win8	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/win7	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/MsitSlowV2	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2ember:Dec:December	0%	Avira URL Cloud	safe
https://g.live.com/odclientsettings/MsitFast	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/ODSUProductionV2	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2ember:Dec:Decemberd$hh0	0%	Avira URL Cloud	safe
https://g.live.com/1rewlive5skydrive/OSRSS_32bithttps://g.live.com/1rewlive5skydrive/OSRSS_64bit%loc	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/1rewlive5skydrive/OneDriveEnterpriseV2	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod	StandaloneUpdate_2024-07-04_234035_7252-7256.log.0.dr	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2	StandaloneUpdater-2024-07-04.2340.7252.1.aodl.0.dr, StandaloneUpdate_2024-07-04_234035_7252-7256.log.0.dr	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/EnterpriseG?Bi	OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prods	OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB936C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/ODSUInsiderV2	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/ODSUMsitSlowV2	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Enterprise	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/MsitFastl	OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB936C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/MsitSlow#?	OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://clients.config.office.net/user/v1.0/tenantassociationkey	OneDriveUpdater.exe, 00000000.00000003.2037954027.000001BB9545A000.00000004.00000020.00020000.00000000.sdmp, OneDriveUpdater.exe, 00000000.00000003.2038396854.000001BB9553B000.00000004.00000020.00020000.00000000.sdmp, OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp, OneDriveUpdater.exe, 00000000.00000003.2038736188.000001BB95499000.00000004.00000020.00020000.00000000.sdmp, OneDriveUpdater.exe, 00000000.00000003.2038342311.000001BB9548A000.00000004.00000020.00020000.00000000.sdmp, OneDriveUpdater.exe, 00000000.00000003.2038946928.000001BB9553D000.00000004.00000020.00020000.00000000.sdmp, OneDriveUpdater.exe, 00000000.00000003.2038314047.000001BB95465000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://clients.config.office.net/collector/v1.0/inventoryodbc:December	OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prodonfig	OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/ODSUMsitFastV2	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/win81	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown
https://dc.services.visualstudio.com/v2/track	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/Onee	OneDriveUpdater.exe, 00000000.00000002.2899076468.000001BB954C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/MsitFast:?	OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/One	OneDriveUpdater.exe, 00000000.00000002.2899076468.000001BB954C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/MsitFastV2	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Insiders	OneDriveUpdater.exe, OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/ODSUEnterpriseV2https://g.live.com/1rewlive5skydrive/ODSUMsitFa	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/MsitSlow	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveInsiderV2	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown
https://oneclient.sfx.	OneDriveUpdater.exe, 00000000.00000002.2899300327.000001BB95800000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OSRSS_32bit	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown
https://g.live.com	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Enterprise%l	OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB936C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Insidersl	OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB936C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OSRSS_64bit	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2ember:Dec:December	OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/ODSUProductionV2	StandaloneUpdater-2024-07-04.2340.7252.1.aodl.0.dr, StandaloneUpdate_2024-07-04_234035_7252-7256.log.0.dr	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/MsitFast	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/MsitSlowl	OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB936C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/win7	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/ODSUEnterpriseV2	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/MsitSlowV2	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/win8	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2ember:Dec:Decemberd$hh0	OneDriveUpdater.exe, 00000000.00000002.2897803199.000001BB93717000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OSRSS_32bithttps://g.live.com/1rewlive5skydrive/OSRSS_64bit%loc	OneDriveUpdater.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467919
Start date and time:	2024-07-05 01:39:47 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	OneDriveUpdater.exe
Detection:	CLEAN
Classification:	clean6.winEXE@1/6@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 187 Number of non-executed functions: 47
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): oneclient.sfx.ms, g.live.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: OneDriveUpdater.exe

Process:	C:\Users\user\Desktop\OneDriveUpdater.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	64854
Entropy (8bit):	5.39444677062414
Encrypted:	false
SSDEEP:	384:poaSLGTSy3S0XuMU9mCzHS7vpvpJGV6Hu/i49Pji7iJI5TZCP56vS1xDR+dBUFvT:WryF7U9mCzHS7vu/xV2iP56vcDR+P0T
MD5:	E516A60BC980095E8D156B1A99AB5EEE
SHA1:	238E243FFC12D4E012FD020C9822703109B987F6
SHA-256:	543796A1B343B4EBC0285D89CB8EB70667AC7B513DA37495E38003704E9D88D7
SHA-512:	9B51E99BA20E9DA56D1ACC24A1CF9F9C9DBDEB742BEC034E0FF2BC179A60F4AFF249F40344F9DDD43229DCDEFA1041940F65AFB336D46C175FFEFF725C638D58
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{"ramps":[{"id":3,"offset":0,"share":100},{"id":4,"offset":0,"share":100},{"id":5,"offset":0,"share":100},{"id":6,"offset":0,"share":100},{"id":7,"offset":0,"share":1},{"id":8,"offset":0,"share":1},{"id":9,"offset":0,"share":1},{"id":10,"offset":0,"share":1},{"id":14,"offset":0,"share":1},{"id":17,"offset":0,"share":100},{"id":18,"offset":0,"share":100},{"id":21,"offset":0,"share":1},{"id":22,"offset":0,"share":1},{"id":24,"offset":0,"share":100},{"id":25,"offset":0,"share":100},{"id":26,"offset":0,"share":100},{"id":27,"offset":0,"share":100},{"id":29,"offset":0,"share":100},{"id":30,"offset":0,"share":100},{"id":31,"offset":31,"share":100},{"id":34,"offset":0,"share":100},{"id":35,"offset":0,"share":100},{"id":36,"offset":0,"share":100},{"id":37,"offset":0,"share":100},{"id":39,"offset":0,"share":100},{"id":41,"offset":0,"share":100},{"id":43,"offset":0,"share":100},{"id":44,"offset":0,"share":100},{"id":45,"offset":0,"share":50},{"id":46,"offset":0,"share":50},{"id":53,"offset":0,"s

C:\Users\user\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\Update.xml

Download File

Process:	C:\Users\user\Desktop\OneDriveUpdater.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	899
Entropy (8bit):	5.650905767540785
Encrypted:	false
SSDEEP:	24:JdbC/3ZGhufHCSnnSO8fSSnedSSEfmC6MSnASo:3sMOBR2xeamFPS
MD5:	E14BDA011C0CF74E3AA14DB6FA10D3F2
SHA1:	8B198AEC3F814CCEBD84A684E8F3EC9D06382AA8
SHA-256:	8068D76A11CB451E82352AE2FE92DF07216040461B8830408FE181B71AF7F1C5
SHA-512:	5780023CD4E4AF2AE8C8EF6B219DE7B1250162E91C50A9105DD0035C8ED96B10A1C45110E80973E44CF3C4AB4396D432F2FDF04799BF818224F5409ED8C35542
Malicious:	false
Reputation:	low
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<root>.. <update throttle="100" rescan="1440" currentversion="24.116.0609.0005" maxapplicable="24.999.9999.9999" minapplicable="16.000.0000.0000" maxrandomdelay="360" absolutedelay="4320" useractivedelay="7" maxidlechecks="6">.. <binary sha1hash="iPmonJFhLG1DJsVCu3O8C02zDPE=" sha256hash="9GtWdJ5mNTijC+RniTQVZJNNL/v/pHeTkIzMluCzSsw=" url="https://oneclient.sfx.ms/Win/Installers/24.116.0609.0005/OneDriveSetup.exe" />.. <amd64binary sha1hash="mM+W3mLbCO3HAu1cGD4a4PdRQGw=" sha256hash="pVnIUqbb+sPBwmFmV98Hf9z6dBhT2VIESe9Va6yktNU=" url="https://oneclient.sfx.ms/Win/Installers/24.116.0609.0005/amd64/OneDriveSetup.exe" />.. <arm64binary sha1hash="bXrWME5g0j+2Yu+QZVB18bmw1Cg=" sha256hash="6ekQqi4QRB/baeFaPbG3nvM6HepCSjA3Km3M1QvM9eU=" url="https://oneclient.sfx.ms/Win/Installers/24.116.0609.0005/arm64/OneDriveSetup.exe" />.. </update>..</root>

C:\Users\user\AppData\Local\Microsoft\OneDrive\Update\Update.xml

Download File

Process:	C:\Users\user\Desktop\OneDriveUpdater.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2619
Entropy (8bit):	5.650376775847054
Encrypted:	false
SSDEEP:	48:3jOBR2xeamFP7OzoPZY2cboc0GicDSM6ydS1uyc2g55g5T:zC7TqvCcGM0uRl5E
MD5:	5156D44272713C25BAB73568881D6231
SHA1:	A7BEAC91AC601654AC45818566F650D27C0DD86A
SHA-256:	D3D5D10E19439834BB702265A4A33F226FAE10584A3936B05B169FF876E299D8
SHA-512:	5B67B413C8881CA3FB6CA13E18231651D06F0DB1DCCD5F54BA90E75445CA0555880E5BE3D90C1757E12D93C9AF12BF6E79242DE8B8668FDB4AFE5BF2A67E555B
Malicious:	false
Reputation:	low
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<root>.. <update throttle="100" rescan="1440" currentversion="24.116.0609.0005" maxapplicable="24.116.0609.0004" minapplicable="16.000.0000.0000" maxrandomdelay="360" absolutedelay="4320" useractivedelay="7" maxidlechecks="6">.. <binary sha1hash="iPmonJFhLG1DJsVCu3O8C02zDPE=" sha256hash="9GtWdJ5mNTijC+RniTQVZJNNL/v/pHeTkIzMluCzSsw=" url="https://oneclient.sfx.ms/Win/Installers/24.116.0609.0005/OneDriveSetup.exe" />.. <amd64binary sha1hash="mM+W3mLbCO3HAu1cGD4a4PdRQGw=" sha256hash="pVnIUqbb+sPBwmFmV98Hf9z6dBhT2VIESe9Va6yktNU=" url="https://oneclient.sfx.ms/Win/Installers/24.116.0609.0005/amd64/OneDriveSetup.exe" />.. <arm64binary sha1hash="bXrWME5g0j+2Yu+QZVB18bmw1Cg=" sha256hash="6ekQqi4QRB/baeFaPbG3nvM6HepCSjA3Km3M1QvM9eU=" url="https://oneclient.sfx.ms/Win/Installers/24.116.0609.0005/arm64/OneDriveSetup.exe" />.. </update>.. <update throttle="10" rescan="1440" currentversion="24.126.0623.0001" maxapplicable="24.126.0623.0000" min

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\DeviceHealthSummaryConfiguration.ini

Download File

Process:	C:\Users\user\Desktop\OneDriveUpdater.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.779728184019344
Encrypted:	false
SSDEEP:	3:RsRo7JKIAY9PGvpZjTOjKfrQQUqNs:qVI99uvp5aYFUqNs
MD5:	F619535A518729085EA69D79C0746C2D
SHA1:	335545C6C0B044F296746936C84F5BF25AE3A9EF
SHA-256:	562D161B3F384285970422BC6F407FE4982FAF9C20AC7A030595AAB3D5BABE37
SHA-512:	C9790EF2B11BD3D620EDAABA3BBA4BEF0F201A6709DDD3E7FBA607D23F5DCE1135FDC26CC680951C9493C28C86B992E70260BA56178802BAA8E2EA732EE0E542
Malicious:	false
Reputation:	low
Preview:	Version=4..LastReportTime=1696413196..LastSavedScore=0..UnhealthyDuration=0..

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\StandaloneUpdater-2024-07-04.2340.7252.1.aodl

Download File

Process:	C:\Users\user\Desktop\OneDriveUpdater.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	5.056512452939649
Encrypted:	false
SSDEEP:	768:FwpdE6kFc1bkFc1Q6bxFqNcL3KBEX1nFNm:FQEd1kbx
MD5:	54FEE4BADA5FDB439E1C49156A43CC6A
SHA1:	9BC59140F3B10FA1ADD45C6BD574BA979B771D8D
SHA-256:	87532FD65C754A17A6D87854C5FD94B1F47208B21C9109B795ECACEB35020EA3
SHA-512:	AD579CD62B9B420DF9A2A0B4C219C540A443506FF0B3A77A1E14AFB081819BF731E162217A8CE2F9A70EADB294AE81CCEE433ADBEE5B3B6AB0F5E14FA24919DA
Malicious:	false
Reputation:	low
Preview:	EBFGONED....................22.077.0410.0007................................................10.0.19045...................................................................................................................................................................3......T...X.....;._..D..e.g..E\|.).....N...........BinaryLoggingSession.cpp....)...BinaryLoggingSession::StartLoggingSession..........3......T...X.....;._..D..e.g..E2.......t.......!...DeprecatedDeviceHealthTracker.cpp....C...DeviceHealth::DeprecatedHealthTracker::HandleHealthSummaryByVersion.............3......T...X.....;._..D..e.g..E.[.....P...........HealthScoreRecorder.cpp%...-...DeviceHealth::ScoreRecorder::LoadHealthScores.........3......T...X...0..F...B...cIj.3$.......b...........StandaloneUpdater.cppI...7...StandaloneUpdater::InitializeWithDefaultImplementations......'............3......T...X...0..F...B...cIj.3.o.................StandaloneUpdater.cppN...7...StandaloneUpdater::InitializeWithDefaultImplementations+...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\StandaloneUpdate_2024-07-04_234035_7252-7256.log

Download File

Process:	C:\Users\user\Desktop\OneDriveUpdater.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.910466497696784
Encrypted:	false
SSDEEP:	192:XA7Au+F8FgFJoFwfFIF3F/FmF7FeF+F8FcFJUFhEFeF:w7AuqEQJowtIVNCBKqEkJMh8K
MD5:	AF858438BF320D1B45EF6E6037FB1976
SHA1:	3D3A5315E7B8EBC78615D1A0AD2D7361643946BF
SHA-256:	2E3A473D2D4F64848DA1B672B02731F2D49EFE677579D03E591727146E7C143D
SHA-512:	BC8C62240BEB770DA3493BCF5E2452E778EE7093CB1463876BE2E211BD72A4EA771853BC4BF9CB2E35320F0398F12267FF37B636AB60C9CE7543AEAEC1EB3266
Malicious:	false
Reputation:	low
Preview:	0.7./.0.4./.2.0.2.4. .2.3.:.4.0.:.3.5...1.3.7. .O.f.f.i.c.e.C.o.n.f.i.g.H.e.l.p.e.r.:. .G.e.t.C.a.c.h.e.T.i.m.e.s.t.a.m.p. .h.r. .=. .0.x.8.0.0.7.0.0.0.2.,. .r.e.s.u.l.t.:. .0.,. .v.a.l.u.e.D.a.t.a.:. .0.....0.7./.0.4./.2.0.2.4. .2.3.:.4.0.:.3.5...1.3.7. .O.f.f.i.c.e.C.o.n.f.i.g.H.e.l.p.e.r.:. .G.e.t.E.n.v.i.r.o.n.m.e.n.t.T.y.p.e. .h.r. .=. .0.x.8.0.0.7.0.0.0.2.,. .r.e.s.u.l.t.:. .0.,. .v.a.l.u.e.D.a.t.a.:. .0.,. .....0.7./.0.4./.2.0.2.4. .2.3.:.4.0.:.3.5...1.3.7. .O.f.f.i.c.e.C.o.n.f.i.g.H.e.l.p.e.r.:. .U.s.e.O.f.f.i.c.e.C.o.n.f.i.g.U.p.d.a.t.e.V.a.l.u.e.s.:. .0.....0.7./.0.4./.2.0.2.4. .2.3.:.4.0.:.3.5...1.3.7. .S.e.t.t.i.n.g.s.D.o.w.n.l.o.a.d.e.r.:. .u.s.e. .o.f.f.i.c.e. .c.o.n.f.i.g. .u.p.d.a.t.e. .v.a.l.u.e.s. .f.a.l.s.e.....0.7./.0.4./.2.0.2.4. .2.3.:.4.0.:.3.5...1.3.7. .S.e.t.t.i.n.g.s.D.o.w.n.l.o.a.d.e.r.:. .S.e.t. .a. .f.l.a.g. .t.o. .t.r.y. .O.f.f.i.c.e.C.o.n.f.i.g. .i.f. .d.o.w.n.l.o.a.d. .f.a.i.l.s... .i.s.T.o.D.o.w.n.l.o.a.d.U.p.d.a.t.e.R.i.n.g.S.E.t.t.i.n.g.s.J.s.o.n.:. .

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.255702585045085
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	OneDriveUpdater.exe
File size:	4'200'864 bytes
MD5:	792e95b64b9cf45ac8bc10d4d0f077c2
SHA1:	e50af7ee7e0a323d8aa60b6d9b3d39ab33b004f5
SHA256:	60e64dd2c6d2ac6fe9b498fadac81bc34a725de5d893e7df8b2728d8dc5b192d
SHA512:	5064c1a64fa0bd5a31b205d8b34cb85cc3da7091dd2412421f6394d42b9a596430b67ea4d05129912ad942458198280a3a69409388d2413072c53d928de70e86
SSDEEP:	49152:3EenBpKLBz+dV0LWUEur5XVmy1rVaou58gZbkT3FjNVcXrkj6B+/T+k54Q1Wb:6VlH0MAQj8k5d18
TLSH:	3E165A4BA2B901E4D0BBD23D8A679617FAB1785587359BDF0690435A0F33BE09E3E710
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......6x.Sr.b.r.b.r.b..kg...b..pf.{.b..pg.I.b..lk.~.b. lf.a.b. la.z.b. lg...b..ka.\|.b..kf.m.b..kd.p.b..kc._.b.r.c...b..lg...b..lb.s.b

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x140038ba0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x24CF8552 [Thu Jul 27 21:57:38 1989 UTC]
TLS Callbacks:	0x40167610, 0x1, 0x40167690, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	998485b035498bd8f4259c68101e6cc3

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	02/09/2021 19:25:38 01/09/2022 19:25:38
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	CCB19DD724F52810AD930629C1825FA3
Thumbprint SHA-1:	9251BD18AC5C69FDC0CB16B51D5133A84FE6BC2F
Thumbprint SHA-256:	E93FB5ABE1EF7797849E0B6B487C954EBDDABCB53DD16E4EF952524D51C30F9D
Serial:	330000042535216F36087CEB06000000000425

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FDC80803C94h
dec eax
add esp, 28h
jmp 00007FDC8080344Fh
int3
int3
and dword ptr [003A4991h], 00000000h
ret
dec eax
mov dword ptr [esp+08h], ebx
push ebp
dec eax
lea ebp, dword ptr [esp-000004C0h]
dec eax
sub esp, 000005C0h
mov ebx, ecx
mov ecx, 00000017h
call dword ptr [002B096Ah]
test eax, eax
je 00007FDC808035D6h
mov ecx, ebx
int 29h
mov ecx, 00000003h
call 00007FDC80803599h
xor edx, edx
dec eax
lea ecx, dword ptr [ebp-10h]
inc ecx
mov eax, 000004D0h
call 00007FDC80804C04h
dec eax
lea ecx, dword ptr [ebp-10h]
call dword ptr [002B123Dh]
dec eax
mov ebx, dword ptr [ebp+000000E8h]
dec eax
lea edx, dword ptr [ebp+000004D8h]
dec eax
mov ecx, ebx
inc ebp
xor eax, eax
call dword ptr [002B122Bh]
dec eax
test eax, eax
je 00007FDC8080360Eh
dec eax
and dword ptr [esp+38h], 00000000h
dec eax
lea ecx, dword ptr [ebp+000004E0h]
dec eax
mov edx, dword ptr [ebp+000004D8h]
dec esp
mov ecx, eax
dec eax
mov dword ptr [esp+30h], ecx
dec esp
mov eax, ebx
dec eax
lea ecx, dword ptr [ebp+000004E8h]
dec eax
mov dword ptr [esp+28h], ecx
dec eax
lea ecx, dword ptr [ebp-10h]
dec eax
mov dword ptr [esp+20h], ecx
xor ecx, ecx
call dword ptr [002B11F2h]
dec eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3b43e0	0x72cc	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3bb6ac	0x1cc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x402000	0xb60	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x3e3000	0x1ce6c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3ff400	0x25a0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x403000	0x528c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x362040	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x362100	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x35af90	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2e9000	0xef8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3b4250	0x60	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2e791c	0x2e7a00	a23d1340ce6770bd3e96322ec9b8471e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2e9000	0xd5a44	0xd5c00	3aa3851f60487a2dcdffab0194e0ef4f	False	0.31893046418128657	data	4.962151045168778	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3bf000	0x23214	0x1e600	ba3d3cf5404aba214171beb85f132b1d	False	0.1951437114197531	data	4.8715384935366615	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x3e3000	0x1ce6c	0x1d000	e4f42dd872058c005b33a5ecac3104d7	False	0.5015069369612069	data	6.283611176742107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x400000	0x48	0x200	bab7359b53959913b7a4cb69225e1e2e	False	0.076171875	data	0.5703483918359332	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x401000	0xfc	0x200	88f14c29479baa4dadcc14245a4175ba	False	0.318359375	data	2.458301158770647	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x402000	0xb60	0xc00	1e19c28ffefb2ba22f1cb67e37d3548c	False	0.3821614583333333	data	4.648152733517116	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x403000	0x528c	0x5400	2fe0dbcb762c4ef1986df34a76320f1a	False	0.2546968005952381	data	5.441211306199959	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
EDPENLIGHTENEDAPPINFOID	0x402b50	0x2	data	English	United States	5.0
EDPPERMISSIVEAPPINFOID	0x402b58	0x2	data	English	United States	5.0
RT_VERSION	0x402210	0x408	data	English	United States	0.42151162790697677
RT_MANIFEST	0x402618	0x533	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4320060105184072

Imports

DLL	Import
KERNEL32.dll	RtlPcToFileHeader, InterlockedPushEntrySList, SetLastError, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, ExitProcess, GetModuleFileNameW, GetStdHandle, WriteFile, GetCurrentThread, FindFirstFileExW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, SetStdHandle, GetStringTypeW, GetTimeZoneInformation, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, GetFileSizeEx, SetFilePointerEx, ReadFile, RtlUnwindEx, WriteConsoleW, CompareFileTime, FindClose, FindNextFileW, FindFirstFileW, Process32NextW, OpenProcess, Process32FirstW, CreateToolhelp32Snapshot, CreateProcessW, GetProductInfo, VerifyVersionInfoW, VerSetConditionMask, LoadLibraryExW, MoveFileExW, IsWow64Process, ExpandEnvironmentStringsW, UnmapViewOfFile, MapViewOfFileEx, CreateFileMappingW, GetFileSize, CreateFileW, LocalFree, LocalAlloc, OpenMutexW, FileTimeToSystemTime, FileTimeToLocalFileTime, GetTickCount64, GetVolumePathNameW, Sleep, GetCommandLineW, GetModuleHandleExW, FreeLibrary, GetEnvironmentVariableW, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, TerminateProcess, GetCurrentProcess, IsProcessorFeaturePresent, GetStartupInfoW, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetProcAddress, GetModuleHandleW, CreateEventW, WaitForSingleObjectEx, ResetEvent, SetEvent, InitializeCriticalSectionAndSpinCount, CloseHandle, LeaveCriticalSection, EnterCriticalSection, OutputDebugStringW, IsDebuggerPresent, DeleteCriticalSection, InitializeCriticalSectionEx, GetProcessHeap, HeapSize, HeapFree, HeapReAlloc, HeapAlloc, HeapDestroy, GetLastError, SystemTimeToTzSpecificLocalTime, PeekNamedPipe, GetDriveTypeW, FreeLibraryAndExitThread, ExitThread, CreateThread, RtlUnwind, LoadLibraryExA, VirtualQuery, VirtualProtect, InitializeCriticalSection, HeapCreate, GetDiskFreeSpaceW, LockFile, GetFullPathNameA, HeapValidate, GetTempPathA, FormatMessageW, GetDiskFreeSpaceA, GetFileAttributesA, FlushViewOfFile, CreateFileA, LoadLibraryA, DeleteFileA, GetSystemInfo, HeapCompact, UnlockFile, MapViewOfFile, GetSystemPowerStatus, GetModuleFileNameA, OutputDebugStringA, CompareStringEx, LCMapStringEx, DecodePointer, InitOnceExecuteOnce, GetLocaleInfoEx, CreateHardLinkW, AreFileApisANSI, SetEndOfFile, GetCurrentDirectoryW, AcquireSRWLockShared, ReleaseSRWLockShared, SleepConditionVariableSRW, SleepConditionVariableCS, WakeAllConditionVariable, RaiseException, ReadConsoleW, DeleteFileW, GetSystemTime, CreateDirectoryW, GetFullPathNameW, GetTempFileNameW, RemoveDirectoryW, SetFileTime, GetTempPathW, CopyFileW, SystemTimeToFileTime, LockFileEx, UnlockFileEx, DeviceIoControl, LoadLibraryW, WerRegisterFile, WerUnregisterFile, GetTickCount, K32GetModuleFileNameExW, WaitForSingleObject, WaitForMultipleObjects, QueueUserWorkItem, CreateMutexW, GetVersionExW, MoveFileW, GetUserDefaultLocaleName, GetComputerNameW, FindFirstVolumeW, FindNextVolumeW, FindVolumeClose, GetDiskFreeSpaceExW, GetFileAttributesW, GetFileAttributesExW, GetFileInformationByHandle, GetFinalPathNameByHandleW, GetLongPathNameW, SetFileAttributesW, SetFileInformationByHandle, SetFilePointer, GetCompressedFileSizeW, FindFirstFileNameW, CreateIoCompletionPort, GetQueuedCompletionStatus, PostQueuedCompletionStatus, ReleaseMutex, GetProcessTimes, GetExitCodeProcess, GetSystemTimes, SetDllDirectoryW, ReplaceFileW, ReadDirectoryChangesW, RegisterApplicationRestart, GetFileInformationByHandleEx, OpenFileById, CreateSymbolicLinkW, CompareStringOrdinal, GetUserGeoID, GlobalFree, ReadProcessMemory, QueryPerformanceFrequency, FormatMessageA, InitializeSRWLock, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryEnterCriticalSection, SwitchToThread, GetExitCodeThread, GetNativeSystemInfo, InitializeConditionVariable, WakeConditionVariable
USER32.dll	PostThreadMessageW, SendMessageTimeoutW, ShowWindow, DestroyWindow, CreateWindowExW, RegisterClassW, DispatchMessageW, GetMessageW, SystemParametersInfoW, GetWindowThreadProcessId, GetClassNameW, EnumWindows, PostMessageW, PostQuitMessage, TranslateMessage
OLEAUT32.dll	VariantChangeType, VarBstrCmp, VariantClear, SysStringByteLen, LoadTypeLib, LoadRegTypeLib, SysFreeString, SysStringLen, SetErrorInfo, GetErrorInfo, GetRecordInfoFromTypeInfo, SysAllocStringLen, VariantInit, SysAllocString, SysAllocStringByteLen
ntdll.dll	RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind
SHLWAPI.dll	StrStrIW, SHRegGetBoolUSValueW, SHRegGetValueW, PathStripToRootW, PathStripPathW, PathIsDirectoryW, PathRemoveFileSpecW, PathFileExistsW, SHSetValueW, SHCreateStreamOnFileEx, PathIsRelativeW, PathFindFileNameW, SHDeleteKeyW, SHDeleteValueW, SHGetValueW, PathIsPrefixW, SHCreateStreamOnFileW
VERSION.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
USERENV.dll	GetDefaultUserProfileDirectoryW, CreateEnvironmentBlock, GetProfileType
ADVAPI32.dll	RegGetValueA, EventUnregister, CryptAcquireContextW, CryptReleaseContext, CryptGetHashParam, CryptCreateHash, EventWriteTransfer, GetUserNameW, RegOpenKeyExW, OpenProcessToken, GetTokenInformation, MapGenericMask, IsValidAcl, DuplicateToken, AccessCheck, OpenThreadToken, ConvertStringSecurityDescriptorToSecurityDescriptorW, GetNamedSecurityInfoW, StartServiceW, StartServiceCtrlDispatcherW, SetServiceStatus, RegisterServiceCtrlHandlerW, QueryServiceStatusEx, QueryServiceStatus, QueryServiceConfigW, DeleteService, CreateServiceW, ControlService, ChangeServiceConfig2W, CryptHashData, CryptDestroyHash, AdjustTokenPrivileges, AllocateAndInitializeSid, FreeSid, LookupPrivilegeValueW, SetEntriesInAclW, SetNamedSecurityInfoW, ImpersonateLoggedOnUser, RevertToSelf, CopySid, GetLengthSid, IsValidSid, RegDeleteValueW, RegEnumKeyExW, RegEnumValueW, RegQueryInfoKeyW, RegSetKeyValueW, RegGetValueW, LookupAccountNameW, CryptDestroyKey, CryptSetHashParam, CryptImportKey, CreateProcessAsUserW, CreateWellKnownSid, DuplicateTokenEx, GetAclInformation, SetFileSecurityW, RegCreateKeyTransactedW, RegDeleteKeyExW, RegEnumKeyW, RegLoadKeyW, RegUnLoadKeyW, RegDeleteTreeW, ChangeServiceConfigW, OpenSCManagerW, ConvertSidToStringSidW, RegSetValueExW, RegCreateKeyExW, RegCloseKey, RegQueryValueExW, CloseServiceHandle, OpenServiceW, EventRegister
SHELL32.dll	SHLoadNonloadedIconOverlayIdentifiers, SHChangeNotify, SHParseDisplayName, SHCreateItemFromParsingName, SHGetFolderPathAndSubDirW, SHSetKnownFolderPath, CommandLineToArgvW, SHGetSpecialFolderPathW, SHCreateDirectoryExW, SHGetFolderPathW, ShellExecuteExW, SHGetKnownFolderPath, SHFileOperationW
ole32.dll	CoSetProxyBlanket, CoInitialize, CreateBindCtx, StringFromCLSID, CoTaskMemAlloc, StringFromGUID2, CoCreateInstance, CoTaskMemFree, GetRunningObjectTable, CreateItemMoniker, CoCreateGuid, CoUninitialize, CoInitializeEx, CLSIDFromString, CoCreateFreeThreadedMarshaler
WINHTTP.dll	WinHttpGetProxyForUrl, WinHttpSetCredentials, WinHttpSetOption, WinHttpCloseHandle, WinHttpOpen, WinHttpGetIEProxyConfigForCurrentUser
RstrtMgr.DLL	RmGetList, RmRegisterResources, RmEndSession, RmStartSession
WINTRUST.dll	WTHelperGetProvSignerFromChain, WTHelperProvDataFromStateData, WinVerifyTrustEx
WTSAPI32.dll	WTSFreeMemory, WTSQuerySessionInformationW, WTSEnumerateSessionsW, WTSQueryUserToken
bcrypt.dll	BCryptEncrypt, BCryptGenerateSymmetricKey, BCryptCloseAlgorithmProvider, BCryptDestroyKey, BCryptOpenAlgorithmProvider, BCryptGenRandom, BCryptSetProperty
CRYPT32.dll	CertVerifyCertificateChainPolicy, CertFreeCertificateChain, CryptBinaryToStringW, CryptStringToBinaryW
RPCRT4.dll	UuidToStringW, RpcBindingFree, RpcBindingFromStringBindingW, RpcBindingVectorFree, RpcBindingSetAuthInfoExW, RpcEpRegisterW, RpcEpUnregister, RpcServerInqCallAttributesW, RpcStringFreeW, RpcStringBindingComposeW, RpcServerInqBindings, RpcServerRegisterIfEx, RpcServerUnregisterIf, RpcServerUseProtseqW, RpcExceptionFilter
Secur32.dll	GetUserNameExW
urlmon.dll	URLOpenStreamW
WININET.dll	InternetCheckConnectionW, InternetCrackUrlA, InternetOpenW, InternetConnectA, InternetReadFile, InternetQueryOptionW, InternetSetStatusCallbackW, HttpOpenRequestA, InternetCloseHandle, HttpSendRequestW, HttpQueryInfoA, HttpAddRequestHeadersA
WS2_32.dll	bind, closesocket, htonl, accept, listen, send, setsockopt, socket, WSAStartup, WSAGetLastError, htons
IPHLPAPI.DLL	GetAdaptersInfo

Exports

Name	Ordinal	Address
?$TSS0@?1??stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ@4HA	1	0x1403e1660
??0DebugEventDispatcher@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	2	0x14016a1c0
??0DebugEventDispatcher@Events@Applications@Microsoft@@QEAA@XZ	3	0x14016a1c0
??0DebugEventListener@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	4	0x14016a1d0
??0DebugEventListener@Events@Applications@Microsoft@@QEAA@XZ	5	0x14016a1d0
??0DebugEventSource@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z	6	0x14016a1e0
??0DebugEventSource@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	7	0x14016a2a0
??0DebugEventSource@Events@Applications@Microsoft@@QEAA@XZ	8	0x1400a69f0
??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	9	0x140171af0
??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	10	0x140171b40
??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@5@@Z	11	0x140171b70
??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@E@Z	12	0x140171bc0
??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@5@@Z	13	0x140171cc0
??0EventProperties@Events@Applications@Microsoft@@QEAA@XZ	14	0x140171d20
??0EventProperty@Events@Applications@Microsoft@@QEAA@$$QEAU0123@@Z	15	0x140176d70
??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@NV?$allocator@N@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z	16	0x140176dc0
??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z	17	0x140176e30
??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@W4PiiKind@123@W4DataCategory@123@@Z	18	0x140176ea0
??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@_JV?$allocator@_J@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z	19	0x140176f10
??0EventProperty@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z	20	0x140176d70
??0EventProperty@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@123@W4DataCategory@123@@Z	21	0x140176f80
??0EventProperty@Events@Applications@Microsoft@@QEAA@CW4PiiKind@123@W4DataCategory@123@@Z	22	0x140177000
??0EventProperty@Events@Applications@Microsoft@@QEAA@EW4PiiKind@123@W4DataCategory@123@@Z	23	0x140177030
??0EventProperty@Events@Applications@Microsoft@@QEAA@FW4PiiKind@123@W4DataCategory@123@@Z	24	0x140177060
??0EventProperty@Events@Applications@Microsoft@@QEAA@GW4PiiKind@123@W4DataCategory@123@@Z	25	0x140177090
??0EventProperty@Events@Applications@Microsoft@@QEAA@HW4PiiKind@123@W4DataCategory@123@@Z	26	0x1401770c0
??0EventProperty@Events@Applications@Microsoft@@QEAA@IW4PiiKind@123@W4DataCategory@123@@Z	27	0x1401770f0
??0EventProperty@Events@Applications@Microsoft@@QEAA@JW4PiiKind@123@W4DataCategory@123@@Z	28	0x1401770c0
??0EventProperty@Events@Applications@Microsoft@@QEAA@NW4PiiKind@123@W4DataCategory@123@@Z	29	0x140177120
??0EventProperty@Events@Applications@Microsoft@@QEAA@PEBDW4PiiKind@123@W4DataCategory@123@@Z	30	0x140177150
??0EventProperty@Events@Applications@Microsoft@@QEAA@UGUID_t@123@W4PiiKind@123@W4DataCategory@123@@Z	31	0x1401771e0
??0EventProperty@Events@Applications@Microsoft@@QEAA@Utime_ticks_t@123@W4PiiKind@123@W4DataCategory@123@@Z	32	0x140177220
??0EventProperty@Events@Applications@Microsoft@@QEAA@XZ	33	0x140177250
??0EventProperty@Events@Applications@Microsoft@@QEAA@_JW4PiiKind@123@W4DataCategory@123@@Z	34	0x1401772c0
??0EventProperty@Events@Applications@Microsoft@@QEAA@_KW4PiiKind@123@W4DataCategory@123@@Z	35	0x1401772c0
??0EventProperty@Events@Applications@Microsoft@@QEAA@_NW4PiiKind@123@W4DataCategory@123@@Z	36	0x1401772f0
??0GUID_t@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z	37	0x140177310
??0GUID_t@Events@Applications@Microsoft@@QEAA@HHHAEBV?$initializer_list@E@std@@@Z	38	0x140177350
??0GUID_t@Events@Applications@Microsoft@@QEAA@PEBD@Z	39	0x140177390
??0GUID_t@Events@Applications@Microsoft@@QEAA@QEBE_N@Z	40	0x140177470
??0GUID_t@Events@Applications@Microsoft@@QEAA@U_GUID@@@Z	41	0x140177550
??0GUID_t@Events@Applications@Microsoft@@QEAA@XZ	42	0x1401775c0
??0IAuthTokensController@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	43	0x14016a310
??0IAuthTokensController@Events@Applications@Microsoft@@QEAA@XZ	44	0x14016a310
??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z	45	0x14016a320
??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	46	0x14016a3c0
??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@AEBV?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@@std@@@std@@@Z	47	0x1401748c0
??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@XZ	48	0x1400a6a80
??0ILogController@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z	49	0x14016a410
??0ILogController@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	50	0x14016a410
??0ILogController@Events@Applications@Microsoft@@QEAA@XZ	51	0x14016a410
??0ILogManager@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	52	0x14016a420
??0ILogManager@Events@Applications@Microsoft@@QEAA@XZ	53	0x14016a420
??0ILogger@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	54	0x14016a450
??0ILogger@Events@Applications@Microsoft@@QEAA@XZ	55	0x14016a450
??0IModule@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	56	0x14016a460
??0IModule@Events@Applications@Microsoft@@QEAA@XZ	57	0x14016a460
??0ISemanticContext@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z	58	0x14016a470
??0ISemanticContext@Events@Applications@Microsoft@@QEAA@XZ	59	0x14016a470
??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@$$QEAU0123@@Z	60	0x14016a480
??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@AEBU0123@@Z	61	0x14016a580
??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@XZ	62	0x14016a640
??0time_ticks_t@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z	63	0x14016b060
??0time_ticks_t@Events@Applications@Microsoft@@QEAA@PEB_J@Z	64	0x1401775d0
??0time_ticks_t@Events@Applications@Microsoft@@QEAA@XZ	65	0x1401775f0
??0time_ticks_t@Events@Applications@Microsoft@@QEAA@_K@Z	66	0x140177600
??1DebugEventDispatcher@Events@Applications@Microsoft@@UEAA@XZ	67	0x1400299a0
??1DebugEventListener@Events@Applications@Microsoft@@UEAA@XZ	68	0x1400299a0
??1DebugEventSource@Events@Applications@Microsoft@@UEAA@XZ	69	0x1400a7770
??1EventProperties@Events@Applications@Microsoft@@UEAA@XZ	70	0x140171fe0
??1EventProperty@Events@Applications@Microsoft@@UEAA@XZ	71	0x140177640
??1IAuthTokensController@Events@Applications@Microsoft@@UEAA@XZ	72	0x14016a9e0
??1ILogConfiguration@Events@Applications@Microsoft@@QEAA@XZ	73	0x1400b7ba0
??1ILogManager@Events@Applications@Microsoft@@UEAA@XZ	74	0x14016a9f0
??1ILogger@Events@Applications@Microsoft@@UEAA@XZ	75	0x14016aa20
??1IModule@Events@Applications@Microsoft@@UEAA@XZ	76	0x1400299a0
??1ISemanticContext@Events@Applications@Microsoft@@UEAA@XZ	77	0x14016aa30
??1LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@XZ	78	0x14016aa40
??4DebugEventDispatcher@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	79	0x140019ae0
??4DebugEventListener@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	80	0x140019ae0
??4DebugEventSource@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z	81	0x14016acf0
??4DebugEventSource@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	82	0x14016ada0
??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	83	0x140172110
??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@@Z	84	0x140172130
??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@V?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@std@@@Z	85	0x140172170
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z	86	0x140177650
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	87	0x140177690
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@NV?$allocator@N@std@@@std@@@Z	88	0x140177710
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@std@@@Z	89	0x140177770
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z	90	0x1401777d0
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@_JV?$allocator@_J@std@@@std@@@Z	91	0x140177830
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@C@Z	92	0x140177890
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@E@Z	93	0x1401778a0
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@F@Z	94	0x1401778b0
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@G@Z	95	0x1401778c0
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@H@Z	96	0x1401778d0
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@I@Z	97	0x1401778e0
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@J@Z	98	0x1401778d0
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@N@Z	99	0x1401778f0
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@PEBD@Z	100	0x140177920
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@UGUID_t@123@@Z	101	0x140177980
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@Utime_ticks_t@123@@Z	102	0x1401779c0
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_J@Z	103	0x140177a00
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_K@Z	104	0x140177a30
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_N@Z	105	0x140177a40
??4GUID_t@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z	106	0x14016ae30
??4IAuthTokensController@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	107	0x140019ae0
??4ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z	108	0x14016ae40
??4ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	109	0x14016aed0
??4ILogController@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z	110	0x140019ae0
??4ILogController@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	111	0x140019ae0
??4ILogManager@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	112	0x140019ae0
??4ILogger@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	113	0x140019ae0
??4IModule@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	114	0x140019ae0
??4ISemanticContext@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	115	0x140019ae0
??4LogConfiguration@Telemetry@Applications@Microsoft@@QEAAAEAU0123@$$QEAU0123@@Z	116	0x14016af40
??4LogConfiguration@Telemetry@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z	117	0x14016afd0
??4LogManagerProvider@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z	118	0x140019ae0
??4LogManagerProvider@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z	119	0x140019ae0
??4time_ticks_t@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z	120	0x14016b060
??8EventProperty@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z	121	0x140177a70
??8GUID_t@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z	122	0x140177f90
??AILogConfiguration@Events@Applications@Microsoft@@QEAAAEAVVariant@123@PEBD@Z	123	0x140174970
??DILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@@std@@@2@@std@@XZ	124	0x140019ae0
??MGUID_t@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z	125	0x140177fe0
??YEventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@@Z	126	0x140172350
??_7DebugEventDispatcher@Events@Applications@Microsoft@@6B@	127	0x1402fea30
??_7DebugEventListener@Events@Applications@Microsoft@@6B@	128	0x140300898
??_7DebugEventSource@Events@Applications@Microsoft@@6B@	129	0x1402fea48
??_7EventProperties@Events@Applications@Microsoft@@6B@	130	0x14032eb28
??_7EventProperty@Events@Applications@Microsoft@@6B@	131	0x14032f220
??_7IAuthTokensController@Events@Applications@Microsoft@@6B@	132	0x14032e280
??_7ILogController@Events@Applications@Microsoft@@6B@	133	0x14032e2c8
??_7ILogManager@Events@Applications@Microsoft@@6BDebugEventDispatcher@123@@	134	0x14032e4a8
??_7ILogManager@Events@Applications@Microsoft@@6BIContextProvider@123@@	135	0x14032e490
??_7ILogManager@Events@Applications@Microsoft@@6BILogController@123@@	136	0x14032e330
??_7ILogger@Events@Applications@Microsoft@@6B@	137	0x14032e128
??_7IModule@Events@Applications@Microsoft@@6B@	138	0x14032ddd8
??_7ISemanticContext@Events@Applications@Microsoft@@6B@	139	0x14032de08
?AddEventListener@DebugEventSource@Events@Applications@Microsoft@@UEAAXW4DebugEventType@234@AEAVDebugEventListener@234@@Z	140	0x1401707d0
?AddModule@ILogConfiguration@Events@Applications@Microsoft@@QEAAXPEBDAEBV?$shared_ptr@VIModule@Events@Applications@Microsoft@@@std@@@Z	141	0x140174a20
?AttachEventSource@DebugEventSource@Events@Applications@Microsoft@@UEAA_NAEAV1234@@Z	142	0x140170880
?ClearExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXXZ	143	0x1400299a0
?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@AEAVILogConfiguration@234@AEAW4status_t@234@@Z	144	0x14016b6b0
?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@PEBDAEAW4status_t@234@_K@Z	145	0x14016b6c0
?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@PEBD_NAEAVILogConfiguration@234@AEAW4status_t@234@_K@Z	146	0x14016b6d0
?DestroyLogManager@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@PEBD@Z	147	0x14016b7e0
?DetachEventSource@DebugEventSource@Events@Applications@Microsoft@@UEAA_NAEAV1234@@Z	148	0x140170920
?DispatchEvent@DebugEventSource@Events@Applications@Microsoft@@UEAA_NVDebugEvent@234@@Z	149	0x1401709a0
?DispatchEventBroadcast@ILogManager@Events@Applications@Microsoft@@SA_NVDebugEvent@234@@Z	150	0x14018c9f0
?FromJSON@Events@Applications@Microsoft@@YA?AVILogConfiguration@123@PEBD@Z	151	0x140183cb0
?FromLogConfiguration@Events@Applications@Microsoft@@YA?AVILogConfiguration@123@AEAULogConfiguration@Telemetry@23@@Z	152	0x140183e70
?Get@LogManagerProvider@Events@Applications@Microsoft@@CAPEAVILogManager@234@AEAVILogConfiguration@234@AEAW4status_t@234@@Z	153	0x1401750c0
?Get@LogManagerProvider@Events@Applications@Microsoft@@CAPEAVILogManager@234@PEBDAEAW4status_t@234@@Z	154	0x140175100
?GetDefaultConfiguration@Events@Applications@Microsoft@@YAAEBVILogConfiguration@123@XZ	155	0x140184260
?GetLatency@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventLatency@234@XZ	156	0x140172530
?GetLogObfuscationKeyManger@@YAJPEAPEAVILogObfuscationKeyManager@@@Z	157	0x1400bb050
?GetLogObfuscatorAes@@YAJPEAPEAVILogObfuscatorAes@@@Z	158	0x1400b8a30
?GetModule@ILogConfiguration@Events@Applications@Microsoft@@QEAA?AV?$shared_ptr@VIModule@Events@Applications@Microsoft@@@std@@PEBD@Z	159	0x140174af0
?GetModules@ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$shared_ptr@VIModule@Events@Applications@Microsoft@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$shared_ptr@VIModule@Events@Applications@Microsoft@@@2@@std@@@2@@std@@XZ	160	0x140174d40
?GetName@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ	161	0x1400855e0
?GetPersistence@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventPersistence@234@XZ	162	0x140172540
?GetPiiProperties@EventProperties@Events@Applications@Microsoft@@QEBA?BV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@Events@Applications@Microsoft@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@Events@Application	163	0x140172550
?GetPolicyBitFlags@EventProperties@Events@Applications@Microsoft@@QEBA_KXZ	164	0x1401727c0
?GetPopSample@EventProperties@Events@Applications@Microsoft@@QEBANXZ	165	0x1401727d0
?GetPriority@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventPriority@234@XZ	166	0x140172530
?GetProperties@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@W4DataCategory@234@@Z	167	0x1401727e0
?GetTimestamp@EventProperties@Events@Applications@Microsoft@@QEBA_JXZ	168	0x140172800
?GetType@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ	169	0x140172810
?HasConfig@ILogConfiguration@Events@Applications@Microsoft@@QEAA_NPEBD@Z	170	0x140174d50
?Hash@GUID_t@Events@Applications@Microsoft@@QEBA_KXZ	171	0x1401781c0
?Initialize@IModule@Events@Applications@Microsoft@@UEAAXPEAVILogManager@234@@Z	172	0x1400299a0
?Release@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@AEAVILogConfiguration@234@@Z	173	0x1401751c0
?Release@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@PEBD@Z	174	0x1401751f0
?RemoveEventListener@DebugEventSource@Events@Applications@Microsoft@@UEAAXW4DebugEventType@234@AEAVDebugEventListener@234@@Z	175	0x140170b60
?SetAppEnv@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	176	0x14016b7f0
?SetAppExperimentETag@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	177	0x14016b8e0
?SetAppExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	178	0x14016b9e0
?SetAppExperimentImpressionId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	179	0x14016bad0
?SetAppId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	180	0x14016bbc0
?SetAppLanguage@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	181	0x14016bcb0
?SetAppName@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	182	0x14016bda0
?SetAppVersion@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	183	0x14016be90
?SetCommercialId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	184	0x14016bf80
?SetCommonField@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBUEventProperty@234@@Z	185	0x1400299a0
?SetCustomField@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBUEventProperty@234@@Z	186	0x1400299a0
?SetDeviceClass@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	187	0x14016c070
?SetDeviceId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	188	0x14016c160
?SetDeviceMake@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	189	0x14016c250
?SetDeviceModel@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	190	0x14016c340
?SetDeviceOrgId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	191	0x14016c430
?SetEventExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z	192	0x1400299a0
?SetLatency@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventLatency@234@@Z	193	0x140172820
?SetLevel@EventProperties@Events@Applications@Microsoft@@QEAAXE@Z	194	0x14016c520
?SetName@EventProperties@Events@Applications@Microsoft@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	195	0x140172830
?SetNetworkCost@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4NetworkCost@234@@Z	196	0x14016c5e0
?SetNetworkProvider@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	197	0x14016c710
?SetNetworkType@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4NetworkType@234@@Z	198	0x14016c800
?SetOsBuild@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	199	0x14016c930
?SetOsName@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	200	0x14016ca20
?SetOsVersion@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	201	0x14016cb10
?SetPersistence@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventPersistence@234@@Z	202	0x140172970
?SetPolicyBitFlags@EventProperties@Events@Applications@Microsoft@@QEAAX_K@Z	203	0x140172980
?SetPopsample@EventProperties@Events@Applications@Microsoft@@QEAAXN@Z	204	0x140172990
?SetPriority@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventPriority@234@@Z	205	0x1401729a0
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4PiiKind@234@W4DataCategory@234@@Z	206	0x1401729e0
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@NV?$allocator@N@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z	207	0x140172a30
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z	208	0x140172a80
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@6@W4PiiKind@234@W4DataCategory@234@@Z	209	0x140172ad0
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@_JV?$allocator@_J@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z	210	0x140172b20
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CW4PiiKind@234@W4DataCategory@234@@Z	211	0x14016cc00
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@EW4PiiKind@234@W4DataCategory@234@@Z	212	0x14016cc10
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@FW4PiiKind@234@W4DataCategory@234@@Z	213	0x14016cc20
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@GW4PiiKind@234@W4DataCategory@234@@Z	214	0x14016cc30
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HW4PiiKind@234@W4DataCategory@234@@Z	215	0x14016cc40
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IW4PiiKind@234@W4DataCategory@234@@Z	216	0x14016cc50
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@NW4PiiKind@234@W4DataCategory@234@@Z	217	0x140172b70
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDW4PiiKind@234@W4DataCategory@234@@Z	218	0x140172bc0
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@234@@Z	219	0x140172c10
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UGUID_t@234@W4PiiKind@234@W4DataCategory@234@@Z	220	0x140172d10
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Utime_ticks_t@234@W4PiiKind@234@W4DataCategory@234@@Z	221	0x140172d60
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_JW4PiiKind@234@W4DataCategory@234@@Z	222	0x140172dc0
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_KW4PiiKind@234@W4DataCategory@234@@Z	223	0x14016cc60
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_NW4PiiKind@234@W4DataCategory@234@@Z	224	0x140172e10
?SetTicket@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4TicketType@234@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	225	0x1400299a0
?SetTimestamp@EventProperties@Events@Applications@Microsoft@@QEAAX_J@Z	226	0x140172e60
?SetType@EventProperties@Events@Applications@Microsoft@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	227	0x140172e70
?SetUserANID@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	228	0x14016cc70
?SetUserAdvertisingId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	229	0x14016cd60
?SetUserId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@234@@Z	230	0x14016ce50
?SetUserLanguage@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	231	0x14016cf30
?SetUserMsaId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	232	0x14016d020
?SetUserTimeZone@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z	233	0x14016d110
?Teardown@IModule@Events@Applications@Microsoft@@UEAAXXZ	234	0x1400299a0
?TryGetLevel@EventProperties@Events@Applications@Microsoft@@QEBA?AV?$tuple@_NE@std@@XZ	235	0x140173010
?clear@EventProperty@Events@Applications@Microsoft@@QEAAXXZ	236	0x140178380
?convertUintVectorToGUID@GUID_t@Events@Applications@Microsoft@@SA?AU_GUID@@AEBV?$vector@EV?$allocator@E@std@@@std@@@Z	237	0x140178430
?copydata@EventProperty@Events@Applications@Microsoft@@AEAAXPEBU1234@@Z	238	0x140178490
?empty@EventProperty@Events@Applications@Microsoft@@QEAA_NXZ	239	0x140178620
?erase@EventProperties@Events@Applications@Microsoft@@QEAA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4DataCategory@234@@Z	240	0x1401733f0
?lock@?1??stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ@4V67@A	241	0x1403e1610
?pack@EventProperties@Events@Applications@Microsoft@@QEAAPEAUevt_prop@@XZ	242	0x140173410
?stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ	243	0x14016fbc0
?to_bytes@GUID_t@Events@Applications@Microsoft@@QEBAXAEAY0BA@E@Z	244	0x140178650
?to_string@EventProperty@Events@Applications@Microsoft@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ	245	0x1401786a0
?to_string@GUID_t@Events@Applications@Microsoft@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ	246	0x140178f50
?type_name@EventProperty@Events@Applications@Microsoft@@SAPEBDI@Z	247	0x140178f70
?unpack@EventProperties@Events@Applications@Microsoft@@QEAA_NPEAUevt_prop@@_K@Z	248	0x1401736e0
evt_api_call_default	249	0x140167850

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	19:40:35
Start date:	04/07/2024
Path:	C:\Users\user\Desktop\OneDriveUpdater.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\OneDriveUpdater.exe"
Imagebase:	0x7ff7c4000000
File size:	4'200'864 bytes
MD5 hash:	792E95B64B9CF45AC8BC10D4D0F077C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	55

Executed Functions

Function 00007FF7C40A97C0 Relevance: 156.9, APIs: 23, Strings: 65, Instructions: 2922COMMON

Download Yara Rule

APIs

_Mtx_unlock.LIBCPMT ref: 00007FF7C40A97E6

Strings

~{, xrefs: 00007FF7C40ABE99
m:0, xrefs: 00007FF7C40AAF38, 00007FF7C40AAF62
Setup, xrefs: 00007FF7C40A9CCA
Workload, xrefs: 00007FF7C40ABFDC
#, xrefs: 00007FF7C40AA34C
App_Name, xrefs: 00007FF7C40A9D47
Bu, xrefs: 00007FF7C40AC4D5
ItemCount, xrefs: 00007FF7C40AC346
IsWCOSMachine, xrefs: 00007FF7C40AC61B
OneDriveDeviceId, xrefs: 00007FF7C40AA08C
00000000-0000-0000-0000-000000000000, xrefs: 00007FF7C40A9FF1, 00007FF7C40AA01F, 00007FF7C40AA192, 00007FF7C40AA1C0, 00007FF7C40AA741
\p, xrefs: 00007FF7C40AC9BB
UpdateRing, xrefs: 00007FF7C40AB7AA
ANID, xrefs: 00007FF7C40AB0B7
vr, xrefs: 00007FF7C40AC7A1
WipRing, xrefs: 00007FF7C40ABE7D
OSDeviceName, xrefs: 00007FF7C40AAAB1
FALType, xrefs: 00007FF7C40AC83D
AppVersion, xrefs: 00007FF7C40AB1B4
Prod, xrefs: 00007FF7C40AB730, 00007FF7C40AB75A
mw, xrefs: 00007FF7C40AC2AA
#, xrefs: 00007FF7C40AA336
UpdateRingRampGroup, xrefs: 00007FF7C40AA4B5
CID, xrefs: 00007FF7C40AAFB2
OfficeVersionString, xrefs: 00007FF7C40AA5B9
n:0, xrefs: 00007FF7C40AB03D, 00007FF7C40AB067
BuildArchitecture, xrefs: 00007FF7C40AB6A5
RampConfiguration, xrefs: 00007FF7C40ABF33
VDIProvider, xrefs: 00007FF7C40AC3FF
TenantOID, xrefs: 00007FF7C40AA7BA
MachineGuid, xrefs: 00007FF7C40AB3AE
OSArchitecture, xrefs: 00007FF7C40AB5A8
TenantDisplayName, xrefs: 00007FF7C40AA6B6
KnownOcsiVersions, xrefs: 00007FF7C40AADB0
Unknown, xrefs: 00007FF7C40AB939, 00007FF7C40AB963, 00007FF7C40ABD3D, 00007FF7C40ABD67, 00007FF7C40AC3A3, 00007FF7C40AC3B7, 00007FF7C40AC89A, 00007FF7C40AC8AE
UserGuid, xrefs: 00007FF7C40AB4AB
Market, xrefs: 00007FF7C40AB2B1
DeviceInfo.OsVersion, xrefs: 00007FF7C40AC99E
DeviceInfo.OsBuild, xrefs: 00007FF7C40AC28D
SPOServerVersion, xrefs: 00007FF7C40AA8B7
IsTestMachine, xrefs: 00007FF7C40ABCB2
FileSystemType, xrefs: 00007FF7C40AC13D
primaryToken, xrefs: 00007FF7C40A99BF, 00007FF7C40A9A50
PhysicalDeviceId, xrefs: 00007FF7C40AA22D
Environment, xrefs: 00007FF7C40AC085
AppId, xrefs: 00007FF7C40AABAE
MSFTInternal, xrefs: 00007FF7C40AACB3
FeatureSet, xrefs: 00007FF7C40AC1E6
Scenario, xrefs: 00007FF7C40AC8F6
OSUserName, xrefs: 00007FF7C40AA9B4
None, xrefs: 00007FF7C40AC7E1, 00007FF7C40AC7F5
Retail, xrefs: 00007FF7C40ABE25, 00007FF7C40ABE39
IsWOFCompressed, xrefs: 00007FF7C40AC562
OneDriveUserId, xrefs: 00007FF7C40AAEAD
InGoSov, xrefs: 00007FF7C40AB8AE
UpdateGroupId, xrefs: 00007FF7C40ABDB3
OSSku, xrefs: 00007FF7C40ABBB5
CrossTenantScopeCount, xrefs: 00007FF7C40AC4B8
's, xrefs: 00007FF7C40AC6F0
false, xrefs: 00007FF7C40AB835, 00007FF7C40AC5BF, 00007FF7C40AC5D3
vy, xrefs: 00007FF7C40AC0A1
TeamSitesCount, xrefs: 00007FF7C40AC784
AccountType, xrefs: 00007FF7C40AB9B3
AddedScopesCount, xrefs: 00007FF7C40AC6D3
PlaceholdersEnabled, xrefs: 00007FF7C40ABAB0

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Mtx_unlock
String ID: #$#$00000000-0000-0000-0000-000000000000$ANID$AccountType$AddedScopesCount$AppId$AppVersion$App_Name$BuildArchitecture$CID$CrossTenantScopeCount$DeviceInfo.OsBuild$DeviceInfo.OsVersion$Environment$FALType$FeatureSet$FileSystemType$InGoSov$IsTestMachine$IsWCOSMachine$IsWOFCompressed$ItemCount$KnownOcsiVersions$MSFTInternal$MachineGuid$Market$None$OSArchitecture$OSDeviceName$OSSku$OSUserName$OfficeVersionString$OneDriveDeviceId$OneDriveUserId$PhysicalDeviceId$PlaceholdersEnabled$Prod$RampConfiguration$Retail$SPOServerVersion$Scenario$Setup$TeamSitesCount$TenantDisplayName$TenantOID$Unknown$UpdateGroupId$UpdateRing$UpdateRingRampGroup$UserGuid$VDIProvider$WipRing$Workload$false$m:0$n:0$primaryToken$'s$Bu$\p$mw$vr$vy$~{
API String ID: 1418687624-1402947493
Opcode ID: 50e74982eab5c58a5a1362675d5d92d4f5fe9fe05a0648c5fc0d1666501775f6
Instruction ID: fc89275a2086fd9e53f1f1cee6d0ab2cae63745e98106a07aa6112c71c49bb6a
Opcode Fuzzy Hash: 50e74982eab5c58a5a1362675d5d92d4f5fe9fe05a0648c5fc0d1666501775f6
Instruction Fuzzy Hash: 9A53C523A59AC296EB10EF65E8801EDA370FB8135CFC15132EA8D57AA9DF7CD644C710

Function 00007FF7C412A8E0 Relevance: 143.7, APIs: 41, Strings: 40, Instructions: 1907registryCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C412A98F
RegOpenKeyExW.KERNELBASE ref: 00007FF7C412AA1B
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412AAA6

Part of subcall function 00007FF7C401B694: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C401B6EF

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412AC7D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C412AEC5
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412AFAB
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412B02A
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412B103
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412B185
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412B207
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412B289
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412B313
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412B3B2
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412B453
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412B4F4
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412B60B
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412B6AE
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412B751
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412B7F6
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412B896
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412B93B
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412B9DE
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412BA81
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412BB24
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412BBAF
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412BC47
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412BCDA
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412BD5C
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412BDDE
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412BE67
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412C028
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412C0B2
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412C13C
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412C1B4
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412C22C
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412C3B6
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412C44D
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412C61A
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412C78B
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412C8DE
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412C95D

Strings

{018D5C66-4533-4307-9B53-224DE2ED1FE6}, xrefs: 00007FF7C412C741
UserFolder, xrefs: 00007FF7C412AFE5
CrashDetectionKey, xrefs: 00007FF7C412B8CF
Personal, xrefs: 00007FF7C412B0B6, 00007FF7C412C6DA
HasMadeFirstUpload, xrefs: 00007FF7C412B78A
RootAddedToFavorites, xrefs: 00007FF7C412B642
OneAuthClientIdUpperCase, xrefs: 00007FF7C412BE9E
AuthenticationURLs, xrefs: 00007FF7C412BFBC
EnableADALForSilentBusinessConfig, xrefs: 00007FF7C412BA15
MainAccount, xrefs: 00007FF7C412AAD2
OneAuthUnrecoverableFailureTimeStamp, xrefs: 00007FF7C412BE1C
DisplayName, xrefs: 00007FF7C412B244
ExpressSignInCompletedState, xrefs: 00007FF7C412BBE6
EdpManaged, xrefs: 00007FF7C412B52A
SharePointOnPrem, xrefs: 00007FF7C412B3E8
AccountHints, xrefs: 00007FF7C412C7BB
GraphApi, xrefs: 00007FF7C412C1E9
UserEmail, xrefs: 00007FF7C412B2C6
UpdatedTenantValue, xrefs: 00007FF7C412C3E4
DiscoveryResourceId, xrefs: 00007FF7C412C0F0
IsUpgradeAvailable, xrefs: 00007FF7C412B82A
Software\Microsoft\OneDrive, xrefs: 00007FF7C412AAFF
ForceLogUpload, xrefs: 00007FF7C412B972
FirstRunSignInOrigin, xrefs: 00007FF7C412BB5B
ConfiguredTenantId, xrefs: 00007FF7C412B1C2
cid, xrefs: 00007FF7C412B064
TenantAddedToFavorites, xrefs: 00007FF7C412B6E5
OneAuthAccountId, xrefs: 00007FF7C412BD9A
OneDriveDeviceId, xrefs: 00007FF7C412C918
DiscoveryApi, xrefs: 00007FF7C412C171
FirstRun, xrefs: 00007FF7C412B489
LastKnownCloudFilesEnabled, xrefs: 00007FF7C412BAB8
LastShutdownReason, xrefs: 00007FF7C412C993
WamWebAccountId, xrefs: 00007FF7C412BD18
Business, xrefs: 00007FF7C412B347
NextEmailHRDUpdate, xrefs: 00007FF7C412C261
Tenants, xrefs: 00007FF7C412AC35, 00007FF7C412C349
LatestSignInStack, xrefs: 00007FF7C412BC7B
Authority, xrefs: 00007FF7C412C066
NamespaceRootId, xrefs: 00007FF7C412B140

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource$_invalid_parameter_noinfo_noreturn$Open
String ID: AccountHints$AuthenticationURLs$Authority$Business$ConfiguredTenantId$CrashDetectionKey$DiscoveryApi$DiscoveryResourceId$DisplayName$EdpManaged$EnableADALForSilentBusinessConfig$ExpressSignInCompletedState$FirstRun$FirstRunSignInOrigin$ForceLogUpload$GraphApi$HasMadeFirstUpload$IsUpgradeAvailable$LastKnownCloudFilesEnabled$LastShutdownReason$LatestSignInStack$MainAccount$NamespaceRootId$NextEmailHRDUpdate$OneAuthAccountId$OneAuthClientIdUpperCase$OneAuthUnrecoverableFailureTimeStamp$OneDriveDeviceId$Personal$RootAddedToFavorites$SharePointOnPrem$Software\Microsoft\OneDrive$TenantAddedToFavorites$Tenants$UpdatedTenantValue$UserEmail$UserFolder$WamWebAccountId$cid${018D5C66-4533-4307-9B53-224DE2ED1FE6}
API String ID: 1019738232-855204990
Opcode ID: 099f38d17ae06991729c672905a3f6f1acc7d9e5174430b45af91a9420397539
Instruction ID: 96956f18d2ca89ddd9392143a0453f0998bdb8c974b9c6d56c390e5e889b5bd1
Opcode Fuzzy Hash: 099f38d17ae06991729c672905a3f6f1acc7d9e5174430b45af91a9420397539
Instruction Fuzzy Hash: 5D138162A04BC285D730EF26D8802EDB760FB95BACF945136DA4D57BA9DF38D285C310

Function 00007FF7C4010490 Relevance: 78.5, APIs: 22, Strings: 22, Instructions: 1535COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 00007FF7C4010566
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4010660
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C401072C
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C401074D
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C40107CD
GetLastError.KERNEL32 ref: 00007FF7C4010835
GetLastError.KERNEL32 ref: 00007FF7C4010842
GetCommandLineW.KERNEL32 ref: 00007FF7C40109B4
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4010B03
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4010B24
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4010BA3
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4011102
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C401115A
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4011187
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C40111B6
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4011385
GetProfileType.USERENV ref: 00007FF7C401196B
PathFileExistsW.SHLWAPI ref: 00007FF7C40119D4

Part of subcall function 00007FF7C401B694: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C401B6EF

PathFileExistsW.SHLWAPI ref: 00007FF7C4011A82
PathFileExistsW.SHLWAPI ref: 00007FF7C4011AA5
PathFileExistsW.KERNELBASE ref: 00007FF7C4011CDF
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4012017

Strings

remotePort, xrefs: 00007FF7C4010912
\StandaloneUpdater\logs, xrefs: 00007FF7C4010806
initLogResult, xrefs: 00007FF7C40108D5
UnexpectedFailure, xrefs: 00007FF7C4011FB7
remoteDebug, xrefs: 00007FF7C40108F4
FileSyncClient.dll, xrefs: 00007FF7C4011A0A
OneDrive.exe, xrefs: 00007FF7C4011CB4
StandaloneUpdater, xrefs: 00007FF7C40108B6, 00007FF7C40108BD, 00007FF7C4011FD7
D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdater.cpp, xrefs: 00007FF7C40105BF, 00007FF7C4010989, 00007FF7C4010A7E, 00007FF7C4010ADD, 00007FF7C4010B71, 00007FF7C4011550, 00007FF7C40115BD, 00007FF7C4011FEA
/repair, xrefs: 00007FF7C4011294, 00007FF7C401132D, 00007FF7C40118C9, 00007FF7C4011AE9, 00007FF7C4011BA4
wait, xrefs: 00007FF7C4010930
mode, xrefs: 00007FF7C40114A4
version, xrefs: 00007FF7C40114DF
Result, xrefs: 00007FF7C401056E
19.0.0.0, xrefs: 00007FF7C40113FD
FileSyncClientUpdaterNamedMutex, xrefs: 00007FF7C4010BC5
commandLineArgs, xrefs: 00007FF7C4010A1B
Global\PerMachineUpdaterNamedMutex, xrefs: 00007FF7C4010BBE
LoggingPlatform.dll, xrefs: 00007FF7C4011A48
OneDriveExeMissing, xrefs: 00007FF7C4011FCB
StandaloneUpdate, xrefs: 00007FF7C401061C
StandaloneUpdater::InitializeWithDefaultImplementations, xrefs: 00007FF7C40105B2, 00007FF7C401097C, 00007FF7C4010A71, 00007FF7C4010AD0, 00007FF7C4010B64, 00007FF7C4011543, 00007FF7C40115B0, 00007FF7C4011FDE

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource$ExistsFilePath$ErrorLast$CommandInitializeLineProfileType_invalid_parameter_noinfo_noreturn
String ID: /repair$19.0.0.0$D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdater.cpp$FileSyncClient.dll$FileSyncClientUpdaterNamedMutex$Global\PerMachineUpdaterNamedMutex$LoggingPlatform.dll$OneDrive.exe$OneDriveExeMissing$Result$StandaloneUpdate$StandaloneUpdater$StandaloneUpdater::InitializeWithDefaultImplementations$UnexpectedFailure$\StandaloneUpdater\logs$commandLineArgs$initLogResult$mode$remoteDebug$remotePort$version$wait
API String ID: 565533978-3225931203
Opcode ID: 31b260ee9ea95669a28c193130e44ca36715b23f32bc064c4f61e72e37b005c2
Instruction ID: b0c05afad9087777f5d570065f7c246ef6b697f327ed297e7140ec506dfb7e96
Opcode Fuzzy Hash: 31b260ee9ea95669a28c193130e44ca36715b23f32bc064c4f61e72e37b005c2
Instruction Fuzzy Hash: 5A034D32A05BC58ADB60EF22D8802EDB7B4FB84B68F854136DA8D47B65DF38D594C710

Function 00007FF7C41317B8 Relevance: 73.3, APIs: 1, Strings: 40, Instructions: 1520
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4131AAB

Part of subcall function 00007FF7C401B694: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C401B6EF

Strings

DisableFREAnimation, xrefs: 00007FF7C4133009
TelemetryUploadUri, xrefs: 00007FF7C4132F84
LocalMassDeleteFileDeleteThreshold, xrefs: 00007FF7C41328A5
MinDiskSpaceLimitInMB, xrefs: 00007FF7C4132932
DehydrateSyncedTeamSites, xrefs: 00007FF7C41322B5
SharePointOnPremFrontDoorUrl, xrefs: 00007FF7C4132576
EnableOneNoteSupportPreview, xrefs: 00007FF7C4132C7A
UploadBandwidthLimit, xrefs: 00007FF7C41323C6
PermitDisablePermissionInheritance, xrefs: 00007FF7C4132ADC
ForcedLocalMassDeleteDetection, xrefs: 00007FF7C4132A4D
SharePointOnPremPrioritization, xrefs: 00007FF7C41324E7
EnableAutomaticUploadBandwidthManagement, xrefs: 00007FF7C4132B67
GPOEnabled, xrefs: 00007FF7C4131E42, 00007FF7C4131ED4
PreventNetworkTrafficPreUserSignIn, xrefs: 00007FF7C4131F4D, 00007FF7C4131FD8
SOFTWARE\Microsoft\OneDrive\Tenants\, xrefs: 00007FF7C4131843
SyncAdminReports, xrefs: 00007FF7C4132DF6
Remote Access, xrefs: 00007FF7C4131EE5
BlockTenantList, xrefs: 00007FF7C4132370
Software\Microsoft\OneDrive, xrefs: 00007FF7C4131958, 00007FF7C4131B9A, 00007FF7C4131DDF, 00007FF7C4131EEC, 00007FF7C4132006, 00007FF7C4132127, 00007FF7C413274E
EnableODIgnoreListFromGPO, xrefs: 00007FF7C4132CFF, 00007FF7C4132D10
Software\Policies\Microsoft\OneDrive, xrefs: 00007FF7C41318C1, 00007FF7C4131D4E, 00007FF7C4131E6E, 00007FF7C4131F77, 00007FF7C413209A, 00007FF7C4132176, 00007FF7C4132252, 00007FF7C41322DF, 00007FF7C4132332, 00007FF7C4132511, 00007FF7C41325A1, 00007FF7C413262E, 00007FF7C41326BF, 00007FF7C41327CB, 00007FF7C4132842, 00007FF7C41328D0, 00007FF7C413295D, 00007FF7C41329EC, 00007FF7C4132A77
DisableTutorial, xrefs: 00007FF7C4132695, 00007FF7C4132720
AllowTenantList, xrefs: 00007FF7C413232B
SharePointOnPremTenantName, xrefs: 00007FF7C4132603
GPOSetUpdateRing, xrefs: 00007FF7C41319B6
EnableSyncAdminReports, xrefs: 00007FF7C4132E7B
DisablePersonalSync, xrefs: 00007FF7C4131897, 00007FF7C413192D
AutomaticUploadBandwidthPercentage, xrefs: 00007FF7C4131D23, 00007FF7C4131DB4
TenantAutoMount, xrefs: 00007FF7C41327C4, 00007FF7C413283B
EnableEnterpriseUpdate, xrefs: 00007FF7C4131A3F, 00007FF7C4131AE7, 00007FF7C4131B6F
WarningMinDiskSpaceLimitInMB, xrefs: 00007FF7C41329BF
DefaultRootDir, xrefs: 00007FF7C4131BDF, 00007FF7C4131C39
DisableCustomRoot, xrefs: 00007FF7C4131C73, 00007FF7C4131CCC
DownloadBandwidthLimit, xrefs: 00007FF7C4132453
DisableFirstDeleteDialog, xrefs: 00007FF7C4132F00
SilentAccountConfig, xrefs: 00007FF7C413206C, 00007FF7C41320FC
DiskSpaceCheckThresholdMB, xrefs: 00007FF7C413216F, 00007FF7C41321CD
AADJMachineDomainGuid, xrefs: 00007FF7C4132BEF
SyncAdminReportsPreview, xrefs: 00007FF7C4132D71
FilesOnDemandEnabled, xrefs: 00007FF7C4132228

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource_invalid_parameter_noinfo_noreturn
String ID: AADJMachineDomainGuid$AllowTenantList$AutomaticUploadBandwidthPercentage$BlockTenantList$DefaultRootDir$DehydrateSyncedTeamSites$DisableCustomRoot$DisableFREAnimation$DisableFirstDeleteDialog$DisablePersonalSync$DisableTutorial$DiskSpaceCheckThresholdMB$DownloadBandwidthLimit$EnableAutomaticUploadBandwidthManagement$EnableEnterpriseUpdate$EnableODIgnoreListFromGPO$EnableOneNoteSupportPreview$EnableSyncAdminReports$FilesOnDemandEnabled$ForcedLocalMassDeleteDetection$GPOEnabled$GPOSetUpdateRing$LocalMassDeleteFileDeleteThreshold$MinDiskSpaceLimitInMB$PermitDisablePermissionInheritance$PreventNetworkTrafficPreUserSignIn$Remote Access$SOFTWARE\Microsoft\OneDrive\Tenants\$SharePointOnPremFrontDoorUrl$SharePointOnPremPrioritization$SharePointOnPremTenantName$SilentAccountConfig$Software\Microsoft\OneDrive$Software\Policies\Microsoft\OneDrive$SyncAdminReports$SyncAdminReportsPreview$TelemetryUploadUri$TenantAutoMount$UploadBandwidthLimit$WarningMinDiskSpaceLimitInMB
API String ID: 4266926526-3888118743
Opcode ID: 2feefac2649b41c539eeba882315d42c9b692e9e115e7e8a54eef6d2247de213
Instruction ID: 8144da952f917a9b3183b5a8a1c486415f2d8b16c08ae060779a3c636dff851a
Opcode Fuzzy Hash: 2feefac2649b41c539eeba882315d42c9b692e9e115e7e8a54eef6d2247de213
Instruction Fuzzy Hash: 20F28262F14A829AE720EF71D4800EDA771FF9575CB911139DE4C33A6AEF389215C398

Function 00007FF7C4026C30 Relevance: 51.6, APIs: 6, Strings: 23, Instructions: 868
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7C4027D28: CoCreateGuid.OLE32 ref: 00007FF7C4027D6C

Part of subcall function 00007FF7C4050184: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7C4050198

Part of subcall function 00007FF7C4028DE8: _Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4028EB5
Part of subcall function 00007FF7C4028DE8: _Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4028EDF

Part of subcall function 00007FF7C401B694: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C401B6EF

Part of subcall function 00007FF7C4111B9C: _Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4111BA0

Part of subcall function 00007FF7C411AF40: RegCreateKeyExW.KERNELBASE ref: 00007FF7C411AF9F
Part of subcall function 00007FF7C411AF40: RegSetValueExW.KERNELBASE ref: 00007FF7C411AFDE
Part of subcall function 00007FF7C411AF40: RegCloseKey.ADVAPI32 ref: 00007FF7C411AFEB

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C402731A
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4027664
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C40276DE
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C402784F

Part of subcall function 00007FF7C4001000: EventWriteTransfer.ADVAPI32 ref: 00007FF7C4001097

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4027C2C
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4027C98

Strings

Software\Microsoft\OneDrive, xrefs: 00007FF7C4026EC4, 00007FF7C4026F50, 00007FF7C40276CD
/onedriverepair, xrefs: 00007FF7C402782D
Software\Microsoft\OneDrive\UpdateFailedReason, xrefs: 00007FF7C4027C87
OdsuDownloadOneDriveSetupEndTime, xrefs: 00007FF7C4026F26
/restart, xrefs: 00007FF7C402780E
UnexpectedFailure, xrefs: 00007FF7C4027265, 00007FF7C4027BDE
StandaloneUpdaterController::ApplyUpdate, xrefs: 00007FF7C4027442, 00007FF7C4027545, 00007FF7C40275FE
UpdateFailedReason, xrefs: 00007FF7C4027C5A
StandaloneUpdater, xrefs: 00007FF7C4027281, 00007FF7C4027BFA
StandaloneUpdaterController::LaunchOneDriveSetup, xrefs: 00007FF7C40278E2, 00007FF7C4027C01
OdsuDownloadOneDriveSetupStartTime, xrefs: 00007FF7C4026E95
/allusers, xrefs: 00007FF7C4027874
D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdaterController.cpp, xrefs: 00007FF7C4026CB6, 00007FF7C4027294, 00007FF7C402744E, 00007FF7C4027551, 00007FF7C402760B, 00007FF7C40278EE, 00007FF7C4027C0D
StandaloneUpdaterDownloadSetupBinary, xrefs: 00007FF7C4027275
/vermismatchrepair, xrefs: 00007FF7C402783F
StandaloneUpdaterController::DownloadUpdate, xrefs: 00007FF7C4026CAA, 00007FF7C4026E5B, 00007FF7C4027288
\StandaloneUpdater, xrefs: 00007FF7C4026C97, 00007FF7C402742E
result, xrefs: 00007FF7C40275BD
/update, xrefs: 00007FF7C40277EE
OneDriveSetup.exe, xrefs: 00007FF7C4026DB0, 00007FF7C40274BE
/updateSource:ODSU, xrefs: 00007FF7C4027887
SetupBinary, xrefs: 00007FF7C4026D1A, 00007FF7C40273A9
StandaloneUpdaterLaunchUpdateBinary, xrefs: 00007FF7C4027BEE

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource$CreateTime$CloseEventFileGuidSystemTransferValueWrite_invalid_parameter_noinfo_noreturn
String ID: /allusers$ /onedriverepair$ /restart$ /updateSource:ODSU$ /vermismatchrepair$/update$D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdaterController.cpp$OdsuDownloadOneDriveSetupEndTime$OdsuDownloadOneDriveSetupStartTime$OneDriveSetup.exe$SetupBinary$Software\Microsoft\OneDrive$Software\Microsoft\OneDrive\UpdateFailedReason$StandaloneUpdater$StandaloneUpdaterController::ApplyUpdate$StandaloneUpdaterController::DownloadUpdate$StandaloneUpdaterController::LaunchOneDriveSetup$StandaloneUpdaterDownloadSetupBinary$StandaloneUpdaterLaunchUpdateBinary$UnexpectedFailure$UpdateFailedReason$\StandaloneUpdater$result
API String ID: 3808290914-189878748
Opcode ID: 7f5e759b0c3b280685e2a6941011cb3509a9004ba38af63e72df46b675cc7f4a
Instruction ID: 0fc5aebf7f79513162ae3dbdf238052fec2b10322fb254a42170875acb103acf
Opcode Fuzzy Hash: 7f5e759b0c3b280685e2a6941011cb3509a9004ba38af63e72df46b675cc7f4a
Instruction Fuzzy Hash: BBA25172A08BC199E720DF65E8802EEBBB4F795358F910129DA8D13A69DF3CD195CB10

Function 00007FF7C4103E90 Relevance: 46.3, APIs: 9, Strings: 17, Instructions: 808
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32 ref: 00007FF7C4103F08

Strings

UpdateXMLParser::ParseUpdateXML, xrefs: 00007FF7C4104125, 00007FF7C41041A1, 00007FF7C41046AC, 00007FF7C4104749, 00007FF7C410487A, 00007FF7C41048CE, 00007FF7C4104907, 00007FF7C4104997, 00007FF7C41049E7, 00007FF7C4104A29, 00007FF7C4104A65, 00007FF7C4104A9B
maxapplicable, xrefs: 00007FF7C41042B3, 00007FF7C41042DE
arm64binary, xrefs: 00007FF7C4104611
sha1hash, xrefs: 00007FF7C4103FFA, 00007FF7C4104023
UpdateXMLParser::ParseUpdateNodeXML, xrefs: 00007FF7C4103F20
throttle, xrefs: 00007FF7C4104389, 00007FF7C41043B7
minapplicable, xrefs: 00007FF7C4104253, 00007FF7C410427E
url, xrefs: 00007FF7C4103F56, 00007FF7C4103F7F, 00007FF7C41046D7, 00007FF7C410470B
rescan, xrefs: 00007FF7C410443A, 00007FF7C4104468
amd64binary, xrefs: 00007FF7C4104589
sha256hash, xrefs: 00007FF7C4103FAE, 00007FF7C4103FD7
update, xrefs: 00007FF7C4104156
update, xrefs: 00007FF7C4104192
currentversion, xrefs: 00007FF7C4104313, 00007FF7C410433E
binary, xrefs: 00007FF7C4104500
msixbinary, xrefs: 00007FF7C4104660, 00007FF7C410469D
d:\dbs\sh\odct\0223_153807_0\cmd\16\client\onedrive\Setup\standalone\UpdateXMLParser\UpdateXMLParser.cpp, xrefs: 00007FF7C4103F2F, 00007FF7C4104131, 00007FF7C41041B0, 00007FF7C41041ED, 00007FF7C410428D, 00007FF7C41042ED, 00007FF7C410434D, 00007FF7C41043C6, 00007FF7C4104477, 00007FF7C41046BB, 00007FF7C410471A, 00007FF7C4104886, 00007FF7C41048DA, 00007FF7C4104913, 00007FF7C41049F3, 00007FF7C4104A35, 00007FF7C4104A71, 00007FF7C4104AA7

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: FreeString
String ID: UpdateXMLParser::ParseUpdateNodeXML$UpdateXMLParser::ParseUpdateXML$amd64binary$arm64binary$binary$currentversion$d:\dbs\sh\odct\0223_153807_0\cmd\16\client\onedrive\Setup\standalone\UpdateXMLParser\UpdateXMLParser.cpp$maxapplicable$minapplicable$msixbinary$rescan$sha1hash$sha256hash$throttle$update$update$url
API String ID: 3341692771-466497408
Opcode ID: 8f8eb3d21b2e64c98929babaf0f0912ff557b99543e647e88257239bb34e27e3
Instruction ID: f2339b3903abd8b9e5703e4d55b8ba40cd3ed1eec1d174282ab1e68a47b06d65
Opcode Fuzzy Hash: 8f8eb3d21b2e64c98929babaf0f0912ff557b99543e647e88257239bb34e27e3
Instruction Fuzzy Hash: 10725F72A08B4686EB10EF57E8C41AAA3B0FB89BA8F940136DE8D53764DF3DD544C750

Function 00007FF7C401D018 Relevance: 43.9, Strings: 34, Instructions: 1366
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

UpdateGroupId, xrefs: 00007FF7C401DCAA, 00007FF7C401E1E8
VDIProvider, xrefs: 00007FF7C401DF82
StandaloneUpdaterInstrumentation::SetCommonDatapoints, xrefs: 00007FF7C401E0A2
MSFTInternal, xrefs: 00007FF7C401D5FC, 00007FF7C401E495
StandaloneUpdater, xrefs: 00007FF7C401DC79
Market, xrefs: 00007FF7C401D518, 00007FF7C401E61B
OneDriveStandaloneUpdaterUpdate, xrefs: 00007FF7C401DD52
OSDeviceName, xrefs: 00007FF7C401D6AF, 00007FF7C401E435
WipRing, xrefs: 00007FF7C401DED4
true, xrefs: 00007FF7C401D804, 00007FF7C401DFF9
AppId, xrefs: 00007FF7C401D118
UpdateRing, xrefs: 00007FF7C401DBBD, 00007FF7C401E2B0
IsWOFCompressed, xrefs: 00007FF7C401E020
D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdaterInstrumentation.cpp, xrefs: 00007FF7C401E0AE
Environment, xrefs: 00007FF7C401D3B2, 00007FF7C401E310
Scenario, xrefs: 00007FF7C401DD8A
AppVersion, xrefs: 00007FF7C401D190, 00007FF7C401E789
Prod, xrefs: 00007FF7C401D384
UserGuid, xrefs: 00007FF7C401DA34, 00007FF7C401E4F5
IsTestMachine, xrefs: 00007FF7C401D875, 00007FF7C401E370
false, xrefs: 00007FF7C401D80B
OneDriveStandaloneUpdaterVerMismatchRepair, xrefs: 00007FF7C401DD44
BuildArchitecture, xrefs: 00007FF7C401D2E4, 00007FF7C401E67E
00000000-0000-0000-0000-000000000000, xrefs: 00007FF7C401D950
OneDriveDeviceId, xrefs: 00007FF7C401D97E, 00007FF7C401E5B8
OfficeVersionString, xrefs: 00007FF7C401DAE1, 00007FF7C401E738
ANID, xrefs: 00007FF7C401D0A6
OneDriveStandaloneUpdaterRepair, xrefs: 00007FF7C401DD35
OSSku, xrefs: 00007FF7C401DE23
MachineGuid, xrefs: 00007FF7C401D465, 00007FF7C401E555
FeatureSet, xrefs: 00007FF7C401E186
OSUserName, xrefs: 00007FF7C401D762, 00007FF7C401E3D0
OSArchitecture, xrefs: 00007FF7C401D22D, 00007FF7C401E6E1
AccountType, xrefs: 00007FF7C401DC47, 00007FF7C401E250

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: 00000000-0000-0000-0000-000000000000$ANID$AccountType$AppId$AppVersion$BuildArchitecture$D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdaterInstrumentation.cpp$Environment$FeatureSet$IsTestMachine$IsWOFCompressed$MSFTInternal$MachineGuid$Market$OSArchitecture$OSDeviceName$OSSku$OSUserName$OfficeVersionString$OneDriveDeviceId$OneDriveStandaloneUpdaterRepair$OneDriveStandaloneUpdaterUpdate$OneDriveStandaloneUpdaterVerMismatchRepair$Prod$Scenario$StandaloneUpdater$StandaloneUpdaterInstrumentation::SetCommonDatapoints$UpdateGroupId$UpdateRing$UserGuid$VDIProvider$WipRing$false$true
API String ID: 3668304517-366307451
Opcode ID: e3ac743c4aa71b00d21b0feb6d101fbf750d1f0bdf5e57a712e8f8bec0257ba7
Instruction ID: f307c7415b2c5656d05361a11ffbfabb228a7525de91faf6c77e96aa20032d78
Opcode Fuzzy Hash: e3ac743c4aa71b00d21b0feb6d101fbf750d1f0bdf5e57a712e8f8bec0257ba7
Instruction Fuzzy Hash: 52F27C22A54AC299EB20EF65DCD02EC6770FF9075CF815136CA4D5BAA9EF38D684C350

Function 00007FF7C4014748 Relevance: 36.0, APIs: 7, Strings: 13, Instructions: 960
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C40149ED
GetLastError.KERNEL32 ref: 00007FF7C4014B3F
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4014F57
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4014FAC
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4015379
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4015A74
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4015A93

Strings

Personal, xrefs: 00007FF7C401594A
NetworkAvailable, xrefs: 00007FF7C401492F
UnexpectedFailure, xrefs: 00007FF7C4015089
StandaloneUpdater, xrefs: 00007FF7C401533F, 00007FF7C40156F2
D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdater.cpp, xrefs: 00007FF7C40148AC, 00007FF7C4014979, 00007FF7C4014A82, 00007FF7C4014BAA, 00007FF7C4014C24, 00007FF7C4014CC9, 00007FF7C4014E07, 00007FF7C401501B, 00007FF7C4015352, 00007FF7C4015705
Success, xrefs: 00007FF7C4015082
StandaloneUpdater::RunUpdaterMode, xrefs: 00007FF7C401489F, 00007FF7C401496C, 00007FF7C4014A75, 00007FF7C4014B9D, 00007FF7C4014C17, 00007FF7C4014CBC, 00007FF7C4014DFA, 00007FF7C401500E, 00007FF7C4015346, 00007FF7C40156F9
LastReportAvailabilityTime, xrefs: 00007FF7C40158FB
ODSUPerMachineUpdateScheduledTaskResult, xrefs: 00007FF7C4015333
result, xrefs: 00007FF7C401479E, 00007FF7C4014B53, 00007FF7C4014BCD
OneDriveStandaloneUpdaterOverallResult, xrefs: 00007FF7C40156E6
LastSignInTime, xrefs: 00007FF7C40158C6
Business1, xrefs: 00007FF7C4015924

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource$ErrorLast
String ID: Business1$D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdater.cpp$LastReportAvailabilityTime$LastSignInTime$NetworkAvailable$ODSUPerMachineUpdateScheduledTaskResult$OneDriveStandaloneUpdaterOverallResult$Personal$StandaloneUpdater$StandaloneUpdater::RunUpdaterMode$Success$UnexpectedFailure$result
API String ID: 1546395303-11994698
Opcode ID: 330b15a735de4af00f8de270ca9b6b87ff3eb46813d58172cc3a3940b45ca7a4
Instruction ID: 78c8ee55db49fb5b796ba22b96ae962109b3eb21e9d8009d311e6f3835154684
Opcode Fuzzy Hash: 330b15a735de4af00f8de270ca9b6b87ff3eb46813d58172cc3a3940b45ca7a4
Instruction Fuzzy Hash: D4C23872608BC289D761AF26E8C03EDB7A4F794798F80413ADA8D47B69DF38D194C710

Function 00007FF7C41129C0 Relevance: 32.0, APIs: 5, Strings: 13, Instructions: 529
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4112C24

Part of subcall function 00007FF7C401B694: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C401B6EF

GetCurrentProcessId.KERNEL32 ref: 00007FF7C4112CC9
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4112DE7

Strings

to the list of unknown setup active processes, xrefs: 00007FF7C4112FA5
Personal, xrefs: 00007FF7C4112A67
,-501, xrefs: 00007FF7C4112B0D
D, xrefs: 00007FF7C4112B62
CommonUtil::GetResourceStringsForSyncRoot got display name resource:, xrefs: 00007FF7C4112B6B
to the list of known setup active processes, xrefs: 00007FF7C4112EAB
,-568, xrefs: 00007FF7C4112B14
Adding process , xrefs: 00007FF7C4112E63, 00007FF7C4112F5D
Excluding current process ID , xrefs: 00007FF7C4112D0D
OneDriveSetup.exe, xrefs: 00007FF7C4112C82
from process list., xrefs: 00007FF7C4112D4E
OneDrive - Personal, xrefs: 00007FF7C4112AAB
Registry key LastKnownODSInfo was not found, adding all processes as unknown, xrefs: 00007FF7C4113082

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource$CurrentProcess_invalid_parameter_noinfo_noreturn
String ID: from process list.$ to the list of known setup active processes$ to the list of unknown setup active processes$,-501$,-568$Adding process $CommonUtil::GetResourceStringsForSyncRoot got display name resource:$D$Excluding current process ID $OneDrive - Personal$OneDriveSetup.exe$Personal$Registry key LastKnownODSInfo was not found, adding all processes as unknown
API String ID: 3187539803-2963708809
Opcode ID: 42d9f2b8d44243dffae770ec3bb5aa7d9bef41e87b5b99861d982297cccebab8
Instruction ID: dd7edd9f3475c34c762ffb8f01bc52220496cfd2da1b0829012d9d5ba5343ef6
Opcode Fuzzy Hash: 42d9f2b8d44243dffae770ec3bb5aa7d9bef41e87b5b99861d982297cccebab8
Instruction Fuzzy Hash: 4732B822A18B8586EB10EF26E4805ADB770FB95BACF855132DE8D137A5DF7CE584C310

Function 00007FF7C40E1558 Relevance: 32.0, APIs: 2, Strings: 16, Instructions: 480
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF7C40E16D8
WaitForSingleObject.KERNEL32 ref: 00007FF7C40E1795

Strings

Download failed, xrefs: 00007FF7C40E1694
false, xrefs: 00007FF7C40E1B1C
using Cached url: %ls, xrefs: 00007FF7C40E1A9F
UpdateRingSettingURLFromOC, xrefs: 00007FF7C40E1A1A
UpdateXMLUrlFromOC, xrefs: 00007FF7C40E1975
use office config update values %ls, xrefs: 00007FF7C40E1B2A
UpdateOfficeConfig, xrefs: 00007FF7C40E1754
true, xrefs: 00007FF7C40E1B15
SettingsDownloader, xrefs: 00007FF7C40E1AA6, 00007FF7C40E1ACB, 00007FF7C40E1B31, 00007FF7C40E1BB0, 00007FF7C40E1BF7
SendOfficeConfigToGetUrl succeeded but emtpy url, xrefs: 00007FF7C40E1BA2
don't use cached url, xrefs: 00007FF7C40E1AC4
SendOfficeConfigToGetUrl succeeded: %ls, xrefs: 00007FF7C40E1BF0
ODSUUpdateXMLUrlFromOC, xrefs: 00007FF7C40E19C7
ODSUEnterprise64, xrefs: 00007FF7C40E1561
PreSignInSettingsConfigJSON, xrefs: 00007FF7C40E18AE
SendOfficeConfigToGetUrl Failed, xrefs: 00007FF7C40E1B83

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ObjectSingleWait
String ID: Download failed$ODSUEnterprise64$ODSUUpdateXMLUrlFromOC$PreSignInSettingsConfigJSON$SendOfficeConfigToGetUrl Failed$SendOfficeConfigToGetUrl succeeded but emtpy url$SendOfficeConfigToGetUrl succeeded: %ls$SettingsDownloader$UpdateOfficeConfig$UpdateRingSettingURLFromOC$UpdateXMLUrlFromOC$don't use cached url$false$true$use office config update values %ls$using Cached url: %ls
API String ID: 24740636-1585111051
Opcode ID: a36152af70b704461a310ccbdfc678c566b085629e52db7c4f1da21ac80e3db8
Instruction ID: 0ff389310832a03a17a952d9cd8b34b544c488e46d325f318e58d1ff4afc1423
Opcode Fuzzy Hash: a36152af70b704461a310ccbdfc678c566b085629e52db7c4f1da21ac80e3db8
Instruction Fuzzy Hash: 5522A122F48B4685EB10EFA2D4802ACA3B1FF887ACF850076DE8D5B655DF38D596C354

Function 00007FF7C406521C Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 349
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00007FF7C40653F0
GetLastError.KERNEL32 ref: 00007FF7C4065403
FindNextFileW.KERNELBASE ref: 00007FF7C4065561
GetLastError.KERNEL32 ref: 00007FF7C406556B
CompareFileTime.KERNEL32 ref: 00007FF7C40655F6
DeleteFileW.KERNEL32 ref: 00007FF7C40656C2
GetLastError.KERNEL32 ref: 00007FF7C4065701
FindClose.KERNELBASE ref: 00007FF7C4065734

Strings

d:\dbs\sh\odct\0223_153807_0\cmd\l\client\onedrive\Setup\Standalone\fsmanager\fsmanagerimpl.cpp, xrefs: 00007FF7C4065232
Logger, xrefs: 00007FF7C40656A3
Removing old logfile : %ls, xrefs: 00007FF7C406569C
gfffffff, xrefs: 00007FF7C40655AC
gfffffff, xrefs: 00007FF7C40655E1
Install, xrefs: 00007FF7C4065282
*.log, xrefs: 00007FF7C4065363
(, xrefs: 00007FF7C4065511
StandaloneUpdater::InitializeWithDefaultImplementations, xrefs: 00007FF7C406522E

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: File$ErrorFindLast$CloseCompareDeleteFirstNextTime
String ID: ($*.log$Install$Logger$Removing old logfile : %ls$StandaloneUpdater::InitializeWithDefaultImplementations$d:\dbs\sh\odct\0223_153807_0\cmd\l\client\onedrive\Setup\Standalone\fsmanager\fsmanagerimpl.cpp$gfffffff$gfffffff
API String ID: 2234949267-4004574387
Opcode ID: 9cf696059ccc2d7e38f42494696a524cc6f1e85b82729d4fd9d799978f7d66fc
Instruction ID: 469f91f815729579f1eef2d8b0a06cfaae373a6c12100237cb6a530a9fb67225
Opcode Fuzzy Hash: 9cf696059ccc2d7e38f42494696a524cc6f1e85b82729d4fd9d799978f7d66fc
Instruction Fuzzy Hash: 86F1B322B58B4292EB10EF66E8801EDA771FB9476CF924275DE4E53695DF3CE580C310

Function 00007FF7C4165224 Relevance: 27.5, APIs: 18, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7C40F36C8: _Getcoll.LIBCPMT ref: 00007FF7C40F374F
Part of subcall function 00007FF7C40F36C8: std::_Locinfo::~_Locinfo.LIBCPMT ref: 00007FF7C40F3770

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C416528D
_Getcoll.LIBCPMT ref: 00007FF7C41652EA
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C4165323
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C416538F
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C41653F7
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C4165467
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C41654E2
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C416555D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C41655F8
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C4165689
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C41656E6
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C4165743
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C41657A0
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C4165810
_Getvals.LIBCPMT ref: 00007FF7C4165881
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C41658B3
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C416595C
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C41659B9

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: std::_$LockitLockit::_$Getcoll$GetvalsLocinfoLocinfo::~_
String ID:
API String ID: 300757393-0
Opcode ID: 50030403e45c4cc7faff76943a8e7e4041d4fe9af1002f74920d183d88f2c468
Instruction ID: 1169137850f24797de3fb5ee5df7359f018489af5586a445724c4cac8dd64415
Opcode Fuzzy Hash: 50030403e45c4cc7faff76943a8e7e4041d4fe9af1002f74920d183d88f2c468
Instruction Fuzzy Hash: FB325125A0A61696EB40BF53F8D01B9A7A0FF84BBCFC45439D98E57395EE3CE4418324

Function 00007FF7C4120034 Relevance: 27.2, APIs: 18, Instructions: 233
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C41200F8
CryptAcquireContextW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7C4120143
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7C4120151
CryptImportKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7C4120194
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7C412019E
CryptCreateHash.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7C41201D6
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7C41201E0
CryptSetHashParam.ADVAPI32 ref: 00007FF7C4120227
GetLastError.KERNEL32 ref: 00007FF7C4120231
CryptHashData.ADVAPI32 ref: 00007FF7C412025B
GetLastError.KERNEL32 ref: 00007FF7C4120265
CryptHashData.ADVAPI32 ref: 00007FF7C41202B7
GetLastError.KERNEL32 ref: 00007FF7C41202C1
CryptGetHashParam.ADVAPI32 ref: 00007FF7C41202F3
GetLastError.KERNEL32 ref: 00007FF7C41202FD
CryptDestroyHash.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7C412032D
CryptDestroyKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7C412033D
CryptReleaseContext.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF7C412034F

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Crypt$ErrorLast$Hash$ContextDataDestroyParam$AcquireCreateImportRelease_invalid_parameter_noinfo
String ID:
API String ID: 3131456372-0
Opcode ID: ef202b370eea610af21c7ac68efd15ef3e2e1150a87e5a3e5e15789bc651126b
Instruction ID: 4486ed594b4daf98c5a66e9484a89b5706ccfbc1149a5bff3c2632e452dec201
Opcode Fuzzy Hash: ef202b370eea610af21c7ac68efd15ef3e2e1150a87e5a3e5e15789bc651126b
Instruction Fuzzy Hash: 53919721B08B428BF760AF67A4C47BAE6B0BF84B68F814236DF8D87554DE7DD4449720

Function 00007FF7C411BE6C Relevance: 26.6, APIs: 9, Strings: 6, Instructions: 348
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C411BEB8
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C411BF03
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C411BF2B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C411C056
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C411C062
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C411C16A
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C411C243

Part of subcall function 00007FF7C401B694: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C401B6EF

Strings

yes, xrefs: 00007FF7C411BF64
OneDriveNGSC, xrefs: 00007FF7C411C1E8
Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager, xrefs: 00007FF7C411C195, 00007FF7C411C26E
In CommonUtil::UnregisterAllSyncRootsFromShellForAllUsers, xrefs: 00007FF7C411C0B1
OneDrive, xrefs: 00007FF7C411C10B
UnblockHangingSetupProcesses found active setup processes: , xrefs: 00007FF7C411BF7C

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource$_invalid_parameter_noinfo_noreturn
String ID: In CommonUtil::UnregisterAllSyncRootsFromShellForAllUsers$OneDrive$OneDriveNGSC$Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager$UnblockHangingSetupProcesses found active setup processes: $yes
API String ID: 879565387-1193557950
Opcode ID: 66437d893645637c603f1b528fb2f188509e85e69d809a14aafc60540e6aacbc
Instruction ID: c2f741b517bff289b049ed4b8224e7ff15e387fd3510fc06e88c83685123a72b
Opcode Fuzzy Hash: 66437d893645637c603f1b528fb2f188509e85e69d809a14aafc60540e6aacbc
Instruction Fuzzy Hash: ABF19322B04B8696EB10AF66E4802AD7371FB95BACF815235DE4C17BA5EF3CD144C344

Function 00007FF7C4025280 Relevance: 25.0, APIs: 1, Strings: 13, Instructions: 493
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4025B33

Part of subcall function 00007FF7C4001000: EventWriteTransfer.ADVAPI32 ref: 00007FF7C4001097

Strings

Update.xml, xrefs: 00007FF7C40254F2, 00007FF7C4025A7A
Software\Microsoft\OneDrive, xrefs: 00007FF7C40255D4, 00007FF7C4025661
\Update, xrefs: 00007FF7C4025333
UnexpectedFailure, xrefs: 00007FF7C4025979
StandaloneUpdater, xrefs: 00007FF7C4025995
UpdateXml, xrefs: 00007FF7C4025434
StandaloneUpdaterController::GetUpdateDescriptions, xrefs: 00007FF7C4025305, 00007FF7C4025398, 00007FF7C40253E5, 00007FF7C402556C, 00007FF7C402599C, 00007FF7C4025B06
D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdaterController.cpp, xrefs: 00007FF7C4025311, 00007FF7C40253A4, 00007FF7C40253F2, 00007FF7C40259A8, 00007FF7C4025B12
\StandaloneUpdater, xrefs: 00007FF7C402532C
OdsuCheckForUpdateStartTime, xrefs: 00007FF7C40255A9
OdsuCheckForUpdateEndTime, xrefs: 00007FF7C4025638
UpdateDescriptionXml, xrefs: 00007FF7C402543B
StandaloneUpdaterDownloadUpdateXml, xrefs: 00007FF7C4025989

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resourceEventTransferWrite
String ID: D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdaterController.cpp$OdsuCheckForUpdateEndTime$OdsuCheckForUpdateStartTime$Software\Microsoft\OneDrive$StandaloneUpdater$StandaloneUpdaterController::GetUpdateDescriptions$StandaloneUpdaterDownloadUpdateXml$UnexpectedFailure$Update.xml$UpdateDescriptionXml$UpdateXml$\StandaloneUpdater$\Update
API String ID: 2234424010-2098091503
Opcode ID: c6a050b8decd95000d04bf5f23ba39465e63f02ee8a1ed4538ac92ec86e35916
Instruction ID: 16cf0e194f2fc1099c8335e3951d4c29c2e093b284438d3b71aac6e72c6c0cb9
Opcode Fuzzy Hash: c6a050b8decd95000d04bf5f23ba39465e63f02ee8a1ed4538ac92ec86e35916
Instruction Fuzzy Hash: 96426272A08BC295E720DF61E8806EDB7B4FB8836CF950129DA8D53A69DF3CD194C710

Function 00007FF7C414C3FC Relevance: 18.3, APIs: 12, Instructions: 331COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C414C449
_Getctype.LIBCPMT ref: 00007FF7C414C4A6
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C414C4E2
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C414C552
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C414C5CC
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C414C646
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C414C6C8
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C414C725
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C414C782
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C414C7EF
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C414C856
_Yarn.LIBCPMT ref: 00007FF7C414C8E9

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: LockitLockit::_std::_$GetctypeYarn
String ID:
API String ID: 3438675547-0
Opcode ID: bf5dd61b7a34776e0edf1a8bae1d9409acaa6ee63d02105d78df123b1f634398
Instruction ID: 41bc8463b5b0021220a350693810d36b3a7c7821258f7789a22e4d18eaa5906d
Opcode Fuzzy Hash: bf5dd61b7a34776e0edf1a8bae1d9409acaa6ee63d02105d78df123b1f634398
Instruction Fuzzy Hash: 53E18222E0A61286F655BF63E9D01B9E6B0AF80BF8F845139D98D57795FE3CF4418320

Function 00007FF7C4110E98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 118encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C4110D90: GetLastError.KERNEL32 ref: 00007FF7C4110E06
Part of subcall function 00007FF7C4110D90: StringFromGUID2.OLE32 ref: 00007FF7C4110E40

CryptAcquireContextW.ADVAPI32 ref: 00007FF7C4110F15
CryptCreateHash.ADVAPI32 ref: 00007FF7C4110F3C
CryptGetHashParam.ADVAPI32 ref: 00007FF7C4110F68
CryptHashData.ADVAPI32 ref: 00007FF7C4110F92
CryptGetHashParam.ADVAPI32 ref: 00007FF7C4110FCB
CryptDestroyHash.ADVAPI32 ref: 00007FF7C4110FDB
CryptReleaseContext.ADVAPI32 ref: 00007FF7C4110FE7
CryptDestroyHash.ADVAPI32 ref: 00007FF7C4111003
CryptReleaseContext.ADVAPI32 ref: 00007FF7C411100F

Strings

@, xrefs: 00007FF7C4110F00

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Crypt$Hash$Context$DestroyParamRelease$AcquireCreateDataErrorFromLastString
String ID: @
API String ID: 3410579537-2766056989
Opcode ID: 0e7fac4e6e7da7407f6ae19668e6357d80241ca7640e6147babe29be2ac0a2a8
Instruction ID: 4993239a982a30bdbd2be8fb62793271dd8b8cbaa4bc82bd883582c46e65f569
Opcode Fuzzy Hash: 0e7fac4e6e7da7407f6ae19668e6357d80241ca7640e6147babe29be2ac0a2a8
Instruction Fuzzy Hash: 00516E32F14A518AF710DF72E8816AD77B4FB88B58B94403AEE4DA7A28DF38C545D710

Function 00007FF7C40E091C Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 278filesynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF7C40E0A79
SHCreateStreamOnFileW.SHLWAPI ref: 00007FF7C40E0B5E
PathFileExistsW.SHLWAPI ref: 00007FF7C40E0BF9
SHCreateStreamOnFileW.SHLWAPI ref: 00007FF7C40E0C2C

Strings

Download failed, xrefs: 00007FF7C40E0A38
PreSignInSettingsConfigJSON, xrefs: 00007FF7C40E0922
Downloading settings from %ls, useBitsAndRetry: true, xrefs: 00007FF7C40E09DE
Failed to copy the downloaded settings file locally., xrefs: 00007FF7C40E0BAA
Failed to download settings, will try to use local file., xrefs: 00007FF7C40E0C03

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: File$CreateStream$ExistsObjectPathSingleWait
String ID: Download failed$Downloading settings from %ls, useBitsAndRetry: true$Failed to copy the downloaded settings file locally.$Failed to download settings, will try to use local file.$PreSignInSettingsConfigJSON
API String ID: 2936357844-2725867305
Opcode ID: 16febd306c33de69bfee59ef413f4920b181549ae2dcbe9e63c49dbbfdbabc47
Instruction ID: 0e9edbff4f8d29654cb1abee24738ba2354b75e959e9f1c40d545d42e8c22cb4
Opcode Fuzzy Hash: 16febd306c33de69bfee59ef413f4920b181549ae2dcbe9e63c49dbbfdbabc47
Instruction Fuzzy Hash: A1C1AE22B08A1A86EB04EF67D49436DA3B1BB84BACF864076CE4D57754DF3CE094C364

Function 00007FF7C4030EC4 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 227fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE ref: 00007FF7C4030F41
GetLastError.KERNEL32 ref: 00007FF7C4030F50
FindNextFileW.KERNELBASE ref: 00007FF7C40311C6
GetLastError.KERNEL32 ref: 00007FF7C40311D5
FindClose.KERNELBASE ref: 00007FF7C4031226

Strings

StandaloneUpdaterInstallationRepair::ShallowCheckDirectoryForFile, xrefs: 00007FF7C4030F6B, 00007FF7C4031178, 00007FF7C40311F1
FileName, xrefs: 00007FF7C403110F
D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdaterInstallationRepair.cpp, xrefs: 00007FF7C4031185
*****, xrefs: 00007FF7C403107F

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Find$ErrorFileLast$CloseFirstNext
String ID: *****$D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdaterInstallationRepair.cpp$FileName$StandaloneUpdaterInstallationRepair::ShallowCheckDirectoryForFile
API String ID: 1978927887-1546141847
Opcode ID: b1b16916b4d52d24f98747d4b22c409dcc0f633320e020e635cd53450767a8fa
Instruction ID: ef639dfc1bb9e61d832e6423d5f2b91a7e030883a6254719ce0e61d37b5fd28d
Opcode Fuzzy Hash: b1b16916b4d52d24f98747d4b22c409dcc0f633320e020e635cd53450767a8fa
Instruction Fuzzy Hash: 21A1E172A08B4185E710EF66D8801EDA7B0FB943ACF824232DA5D57AE9DF7CE584C310

Function 00007FF7C41107BC Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 387registryCOMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C411082D

Part of subcall function 00007FF7C401B694: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C401B6EF

RegOpenKeyExW.ADVAPI32 ref: 00007FF7C4110C87
RegQueryValueExW.ADVAPI32 ref: 00007FF7C4110CE1
RegCloseKey.ADVAPI32 ref: 00007FF7C4110D33

Strings

Software\Microsoft\OneDrive, xrefs: 00007FF7C4110884
Value from LastKnownODSInfo was set to: , xrefs: 00007FF7C411091C
(, xrefs: 00007FF7C4110913
LastKnownODSInfo, xrefs: 00007FF7C4110859

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resourceCloseOpenQueryValue_invalid_parameter_noinfo_noreturn
String ID: ($LastKnownODSInfo$Software\Microsoft\OneDrive$Value from LastKnownODSInfo was set to:
API String ID: 3486858027-422602036
Opcode ID: b087e23d63c07346181d0e4d8024874fc9492587e0140d83f81d947ace088f9f
Instruction ID: 9d907c4c708171e2ebbbb70f4768474ef4dc26c899e2e2ce4d4e9d2fea443ba5
Opcode Fuzzy Hash: b087e23d63c07346181d0e4d8024874fc9492587e0140d83f81d947ace088f9f
Instruction Fuzzy Hash: B8F1F522F14A469AEB10EF66E4802EDB7B1FB44BACF804132DE8D27A94DF38D545C354

Function 00007FF7C403125C Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 178fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE ref: 00007FF7C40312D5
GetLastError.KERNEL32 ref: 00007FF7C40312E4
FindNextFileW.KERNELBASE ref: 00007FF7C4031440
GetLastError.KERNEL32 ref: 00007FF7C403144F
FindClose.KERNEL32 ref: 00007FF7C4031524

Strings

Result, xrefs: 00007FF7C40314A2
StandaloneUpdaterInstallationRepair::RecursiveCheckDirectoryForFile, xrefs: 00007FF7C40312FB, 00007FF7C403141B, 00007FF7C403146B, 00007FF7C40314E9
D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdaterInstallationRepair.cpp, xrefs: 00007FF7C40314F6

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Find$ErrorFileLast$CloseFirstNext
String ID: D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdaterInstallationRepair.cpp$Result$StandaloneUpdaterInstallationRepair::RecursiveCheckDirectoryForFile
API String ID: 1978927887-3488611399
Opcode ID: 64524530b1d0f504e5f68da9c27695aa5d3c061c6dea0b5e3fe5807a4808f7a0
Instruction ID: b716f5668784ee14eff60a1f4e7d84b5a04130eccb60d2d26f56a8fde869185e
Opcode Fuzzy Hash: 64524530b1d0f504e5f68da9c27695aa5d3c061c6dea0b5e3fe5807a4808f7a0
Instruction Fuzzy Hash: A071A362A08A8295E710EF66E9C02E9A760FB843ACFC10275DD5D576E6DF3CD588C710

Function 00007FF7C4061D0C Relevance: 10.8, APIs: 7, Instructions: 286COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C406213E

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ce8386b37b8794311d367d85686b18d038fa3dc8e868a277bcfeef69f9b7f61f
Instruction ID: feb0381b1a50f1e6e51a0091c8884da1512395343f7ac4d9ce253d74af59e26a
Opcode Fuzzy Hash: ce8386b37b8794311d367d85686b18d038fa3dc8e868a277bcfeef69f9b7f61f
Instruction Fuzzy Hash: 8FC1C662B5CA8665E7517F5280843FDA690EB817A8FC60179EE4E0B392DF7CE4D48720

Function 00007FF7C4113C64 Relevance: 10.6, APIs: 7, Instructions: 143encryptionCOMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4113CB8
CryptBinaryToStringW.CRYPT32 ref: 00007FF7C4113D0B
CryptBinaryToStringW.CRYPT32 ref: 00007FF7C4113D63
CryptStringToBinaryW.CRYPT32 ref: 00007FF7C4113DAD
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4113DB7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4113E87
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4113E8D

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: BinaryCryptString$Aligned_get_default_resource_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3442064244-0
Opcode ID: 4dfde2c2cf7fe4d272eb5990125d5a08c5f494464e00bc4d0c081b30904a2988
Instruction ID: 60f87f2b08eb5f90b853a51f7d7954e523d0358b71c171a3a0f3b7db82bf0af5
Opcode Fuzzy Hash: 4dfde2c2cf7fe4d272eb5990125d5a08c5f494464e00bc4d0c081b30904a2988
Instruction Fuzzy Hash: 0A517572B08B8581EB009F66E4802ADB7B4FB85BA8F500236DE8C57B99DF7DD540C710

Function 00007FF7C4111748 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4111877
GetUserNameExW.SECUR32 ref: 00007FF7C41118C5
GetUserNameExW.SECUR32 ref: 00007FF7C41118F8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4111971

Strings

*****, xrefs: 00007FF7C411184A

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: NameUser_invalid_parameter_noinfo_noreturn
String ID: *****
API String ID: 1934235484-64375082
Opcode ID: d979243b4bf3284b5490b0288f711d2880b3276218cd9be04c29c20c49ff9587
Instruction ID: d2c0f79567b36eadef89d1a292017c6448f87385cb62c7ace5a9d6f5bc0a2ba4
Opcode Fuzzy Hash: d979243b4bf3284b5490b0288f711d2880b3276218cd9be04c29c20c49ff9587
Instruction Fuzzy Hash: B361A272F14A4586EB00EF76D4811ADA371BB48BB8F949632DE6C17B99DF38E081C750

Function 00007FF7C40E04A4 Relevance: 7.8, Strings: 6, Instructions: 295COMMON

Download Yara Rule

Strings

Set a flag to try OfficeConfig if download fails. isToDownloadUpdateRingSEttingsJson: %d, sentOfficeConfig: %d, urlFromOfficeConfi, xrefs: 00007FF7C40E05B5
SettingsDownloader, xrefs: 00007FF7C40E05BC, 00007FF7C40E0685, 00007FF7C40E06FE, 00007FF7C40E07D6, 00007FF7C40E087C
Downloading %ls from %ls hr = %x, xrefs: 00007FF7C40E067E, 00007FF7C40E0875
PreSignInSettingsConfigJSON, xrefs: 00007FF7C40E04AD, 00007FF7C40E0565
Create webClient: hr = %x, xrefs: 00007FF7C40E07CF
statusCode: %ls, xrefs: 00007FF7C40E06F7

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID:
String ID: Create webClient: hr = %x$Downloading %ls from %ls hr = %x$PreSignInSettingsConfigJSON$Set a flag to try OfficeConfig if download fails. isToDownloadUpdateRingSEttingsJson: %d, sentOfficeConfig: %d, urlFromOfficeConfi$SettingsDownloader$statusCode: %ls
API String ID: 0-1526529126
Opcode ID: 997baf19218ef6a2ccc3e54ba31b91af1fc003c0fd3bb9f53601e0f5555e5b41
Instruction ID: ab334f6b01b44ea0156068c46d554ba9b18c3b8a04228f5b650ad4e9759e4215
Opcode Fuzzy Hash: 997baf19218ef6a2ccc3e54ba31b91af1fc003c0fd3bb9f53601e0f5555e5b41
Instruction Fuzzy Hash: 87D16D32B04B5685EB10EFA6E8801ADB3B1FB887A8F914136DE8D57768DF38D585C710

Function 00007FF7C4139C30 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7C4139C9D
Process32FirstW.KERNEL32 ref: 00007FF7C4139DB1
FindCloseChangeNotification.KERNELBASE ref: 00007FF7C4139DD0

Strings

(, xrefs: 00007FF7C4139D74

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ChangeCloseCreateFindFirstNotificationProcess32SnapshotToolhelp32
String ID: (
API String ID: 692674288-3887548279
Opcode ID: db5ee6d10f99b75f896f039be5615359d1c97a6990404ecf7742fe26cf9ad3d1
Instruction ID: dc8b93e605b2d4d9c81b5005bf80d3f2911b985e939eb612c6389fa7e2221d6b
Opcode Fuzzy Hash: db5ee6d10f99b75f896f039be5615359d1c97a6990404ecf7742fe26cf9ad3d1
Instruction Fuzzy Hash: 4C519272A18B45C6E720DF26E4802ADB774F788FA8F549226DA9C537A4DF3CE585C700

Function 00007FF7C40648E8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32 ref: 00007FF7C4064920
EnterCriticalSection.KERNEL32 ref: 00007FF7C40649CD
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00007FF7C4064414), ref: 00007FF7C40649F4

Strings

%02ld/%02ld/%04ld %02ld:%02ld:%02ld.%03ld %ls: , xrefs: 00007FF7C4064961

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CriticalSection$EnterLeaveSystemTime
String ID: %02ld/%02ld/%04ld %02ld:%02ld:%02ld.%03ld %ls:
API String ID: 158492304-2619188813
Opcode ID: 86b580618fd72c6665a5c922f3fc81e17f3b6b9c39213da25ec836fe68d4d953
Instruction ID: 753c4ef21afd2ee52e9431d17e7288227b6e2bbde396edc2903726ab285f68cc
Opcode Fuzzy Hash: 86b580618fd72c6665a5c922f3fc81e17f3b6b9c39213da25ec836fe68d4d953
Instruction Fuzzy Hash: 9431A172A1879486E710AF12B48026AE761FB857A5F404135FF8D02B68DF3CE495CB14

Function 00007FF7C4120880 Relevance: 6.1, APIs: 4, Instructions: 125COMMON

Download Yara Rule

APIs

LookupAccountNameW.ADVAPI32 ref: 00007FF7C41208E7
LookupAccountNameW.ADVAPI32 ref: 00007FF7C4120967
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4120A23
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4120A29

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: AccountLookupName_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 839729955-0
Opcode ID: 2c0f7ef2aa94f4ab6c519b8dd6fead764896eb18fa01bda50e0776e5e02ff394
Instruction ID: 8674045a9031f8440a45f516cc2726f34a04b0865c74e8d0630b03fafc9a2d7b
Opcode Fuzzy Hash: 2c0f7ef2aa94f4ab6c519b8dd6fead764896eb18fa01bda50e0776e5e02ff394
Instruction Fuzzy Hash: 1541B173B15A419AEB10AFB6E4802EDA3B1EB44BACF405736DF5D17A98EE38D140C350

Function 00007FF7C40642AC Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7C40642FF
SetLastError.KERNEL32 ref: 00007FF7C4064417

Strings

(%hs:%d) ERROR: "%hs" failed with 0x%08x in %hs. %hs, xrefs: 00007FF7C40643FE
Chk, xrefs: 00007FF7C4064405

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ErrorLast
String ID: (%hs:%d) ERROR: "%hs" failed with 0x%08x in %hs. %hs$Chk
API String ID: 1452528299-2899443072
Opcode ID: db5372f5f6827d442af5b2b6f322f19c7f2c5e7c1202695eebfb0266df89f503
Instruction ID: 36393f9bee0c61e9a92ee43cf35643318d6ad95f666d21aa96a96a9bf0465b1a
Opcode Fuzzy Hash: db5372f5f6827d442af5b2b6f322f19c7f2c5e7c1202695eebfb0266df89f503
Instruction Fuzzy Hash: 3E418036718A8099E720EF22E8817DAB7A5F788368F800135EE4D47B58DE3DD545CB10

Function 00007FF7C407B214 Relevance: 6.1, APIs: 4, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF7C407B25E
DeviceIoControl.KERNELBASE ref: 00007FF7C407B2A0
DeviceIoControl.KERNEL32 ref: 00007FF7C407B2E3
FindCloseChangeNotification.KERNELBASE ref: 00007FF7C407B2F2

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ControlDevice$ChangeCloseCreateFileFindNotification
String ID:
API String ID: 3998978727-0
Opcode ID: 396d628800b17f8ff3407604a8fe3b5494d36eab048ed13eaf4b054166f969a8
Instruction ID: d3902ae5b12b81d5b58e6aa375f1dd4469cf272ce8675ca386666053c4bc3a73
Opcode Fuzzy Hash: 396d628800b17f8ff3407604a8fe3b5494d36eab048ed13eaf4b054166f969a8
Instruction Fuzzy Hash: BF219132618B4086E7209F11F48465AB7B4F789BA8FA11235EB9D03B58DF3DD545CB44

Function 00007FF7C407ACC0 Relevance: 4.6, APIs: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE ref: 00007FF7C407AD13
FindNextFileW.KERNELBASE ref: 00007FF7C407AE1B
FindClose.KERNELBASE ref: 00007FF7C407AE2C

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: d22760135097dd94da45b74280fb4d408dfe5d09f6f4ff3793cf992284b1661f
Instruction ID: bd7d6781bbb51d916320b6b500ca48028f2ab8f40dbba2476fe6c7af54ade580
Opcode Fuzzy Hash: d22760135097dd94da45b74280fb4d408dfe5d09f6f4ff3793cf992284b1661f
Instruction Fuzzy Hash: 7C41F522A48A8195EB20EF22D8812FD6370FB447ACF811272DE5D575E9DF7CDA85CB10

Function 00007FF7C4105810 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00007FF7C4105873

Strings

d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp, xrefs: 00007FF7C4105842

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CreateInstance
String ID: d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp
API String ID: 542301482-4154765878
Opcode ID: 14aafecefa20e9860b8ee12c269226518a6562bc8fdbbd7b4a5c63767ea08d00
Instruction ID: 67139014f14c4cd7535ae1e7e671333393ea43935afecc05baab2bc193f08a89
Opcode Fuzzy Hash: 14aafecefa20e9860b8ee12c269226518a6562bc8fdbbd7b4a5c63767ea08d00
Instruction Fuzzy Hash: 1B215E66B18A4282EB14EF17E4D4279B3A0FB88BA8F944436EE4E47764DF2CD444C710

Function 00007FF7C41410B0 Relevance: 3.4, APIs: 2, Instructions: 372COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C41419A5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4141B28

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 7b7730ee37c83265af0e29a2ad46a84a1375ab3977f4ba9c50997fe6df8a076b
Instruction ID: 47b89b8eb3a20f15757542029c33fe5e6e2fdbe3db696d4ec1dc30b33b1bb597
Opcode Fuzzy Hash: 7b7730ee37c83265af0e29a2ad46a84a1375ab3977f4ba9c50997fe6df8a076b
Instruction Fuzzy Hash: 6CF1BF22F04B4686FB00EF66E4842ACA7A1BB45BB8F995635DE4D17795EF3CD481C320

Function 00007FF7C414F1B8 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNELBASE ref: 00007FF7C414F1D9

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 677ea510a7776c4316773a18f87642b9b716e8750f8448cfe36950ca3ee5330e
Instruction ID: 82c1f88b58ffbd67ca53aaad0e2a49addcfe389105bcb3b33f85e325d7cb6b5d
Opcode Fuzzy Hash: 677ea510a7776c4316773a18f87642b9b716e8750f8448cfe36950ca3ee5330e
Instruction Fuzzy Hash: B6F082A692C04287E2956E5AE0E5B789390EB54B29FD01131E28E42BD4EA1CD5458B21

Function 00007FF7C42CD084 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b21d9d18dfe1e3d240a916f345d58af2051f716ce605decd530715c3b79d86f8
Instruction ID: 800c319cb2be8d321943727a55b8990583ef156d565dc8af75ff50ffaff9a006
Opcode Fuzzy Hash: b21d9d18dfe1e3d240a916f345d58af2051f716ce605decd530715c3b79d86f8
Instruction Fuzzy Hash: B881B232A14A2186FB60EE26D4C237DA360FB84BACF954636EE1E97785DF39D4418350

Function 00007FF7C4013820 Relevance: 33.9, APIs: 3, Strings: 16, Instructions: 621
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4013980
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4013BA9
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4013C96

Strings

Software\Microsoft\OneDrive, xrefs: 00007FF7C4013D12
OdsuDownloadOneDriveSetupEndTime, xrefs: 00007FF7C4013E90
StandaloneUpdater::PerformUpdate, xrefs: 00007FF7C40138DB, 00007FF7C40139F6, 00007FF7C4013A47, 00007FF7C4013B0C, 00007FF7C4013B49
UnexpectedFailure, xrefs: 00007FF7C40143AF
StandaloneUpdater, xrefs: 00007FF7C40143CC
D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdater.cpp, xrefs: 00007FF7C40138E8, 00007FF7C4013A02, 00007FF7C4013A53, 00007FF7C4013B1C, 00007FF7C4013C67, 00007FF7C4013FD0, 00007FF7C40143DB
BootstrapperUsingFallback, xrefs: 00007FF7C40143C0
binaryFilePath, xrefs: 00007FF7C4013C08
OdsuDownloadOneDriveSetupStartTime, xrefs: 00007FF7C4013E01
mode, xrefs: 00007FF7C401386E
result, xrefs: 00007FF7C4013F89
OdsuCheckForUpdateStartTime, xrefs: 00007FF7C4013CE5
versionNumber, xrefs: 00007FF7C4013AAC
\StandaloneUpdater\OneDriveSetup.exe, xrefs: 00007FF7C4013BD6
OdsuCheckForUpdateEndTime, xrefs: 00007FF7C4013D72
\OneDrive.exe, xrefs: 00007FF7C401401E

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource
String ID: BootstrapperUsingFallback$D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdater.cpp$OdsuCheckForUpdateEndTime$OdsuCheckForUpdateStartTime$OdsuDownloadOneDriveSetupEndTime$OdsuDownloadOneDriveSetupStartTime$Software\Microsoft\OneDrive$StandaloneUpdater$StandaloneUpdater::PerformUpdate$UnexpectedFailure$\OneDrive.exe$\StandaloneUpdater\OneDriveSetup.exe$binaryFilePath$mode$result$versionNumber
API String ID: 628915230-3803347822
Opcode ID: 33b48419e4d0c677ce5cef387aaed9637095bc19af47dfbce4911a3541f3ba0e
Instruction ID: 753afeed5ccd67b96c239339b5f9e84d9721f1f544c28077dca884a334154b96
Opcode Fuzzy Hash: 33b48419e4d0c677ce5cef387aaed9637095bc19af47dfbce4911a3541f3ba0e
Instruction Fuzzy Hash: DF624072A48BC285E720AF26E4C42EDBBB4FB94758F904139CA8D53A69DF7CD194C710

Function 00007FF7C4105CF0 Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 168
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32 ref: 00007FF7C4105D23
EnterCriticalSection.KERNEL32 ref: 00007FF7C4105D6D
LeaveCriticalSection.KERNEL32 ref: 00007FF7C4105D84
WaitForSingleObject.KERNEL32 ref: 00007FF7C4105E40
WaitForSingleObject.KERNEL32 ref: 00007FF7C4105E5E
CompareStringW.KERNEL32 ref: 00007FF7C4105ED7
WaitForSingleObject.KERNEL32 ref: 00007FF7C4105F43

Strings

WebClient(%p): Download failed due to disk full error, stop retrying, xrefs: 00007FF7C4105F69
WebClient, xrefs: 00007FF7C4105D05
WebClient(%p): Download attempt #%u (max %u), xrefs: 00007FF7C4105E06
WebClient(%p): Download succeeded. No changes from previous ECS download, xrefs: 00007FF7C4105EF9
d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp, xrefs: 00007FF7C4105F88
ECSConfigJSON, xrefs: 00007FF7C4105EC9
WebClient(%p): Download attempt #%u result hr=0x%08X, xrefs: 00007FF7C4105E89
WebClient(%p): Leaving Initialize(), xrefs: 00007FF7C4105F97

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ObjectSingleWait$CriticalSection$CompareEnterEventLeaveResetString
String ID: ECSConfigJSON$WebClient$WebClient(%p): Download attempt #%u (max %u)$WebClient(%p): Download attempt #%u result hr=0x%08X$WebClient(%p): Download failed due to disk full error, stop retrying$WebClient(%p): Download succeeded. No changes from previous ECS download$WebClient(%p): Leaving Initialize()$d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp
API String ID: 3331951236-2224942753
Opcode ID: 79388c2f2550d67b7cc665928dcdf7124444024a4e56655f102d1d95c4c4c7f9
Instruction ID: 87a915057d74c2e0bcdfd4ddf13c8c297b12393c6a6380a4763c25f348e72897
Opcode Fuzzy Hash: 79388c2f2550d67b7cc665928dcdf7124444024a4e56655f102d1d95c4c4c7f9
Instruction Fuzzy Hash: A1714131B04A4197E718EF27E9C82E9A3A1FB44BA8F944136DA9D477A0CF3DE455C324

Function 00007FF7C40A0584 Relevance: 25.0, APIs: 8, Strings: 6, Instructions: 482COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C40A0D2C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C40A0D32
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C40A0D38
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C40A0D3E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C40A0D44
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C40A0D4A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C40A0D50
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C40A0D56

Strings

rtTime, xrefs: 00007FF7C40A06B5
trend, xrefs: 00007FF7C40A0ADF
unhealthyReportCount, xrefs: 00007FF7C40A0A4E
scores, xrefs: 00007FF7C40A0771
DeviceHealth::ScoreRecorder::LoadHealthScores, xrefs: 00007FF7C40A05CE, 00007FF7C40A062A, 00007FF7C40A0669, 00007FF7C40A0734, 00007FF7C40A07F0
d:\dbs\sh\odct\0223_153807_0\cmd\o\client\onedrive\Product\Logging\HealthScoreRecorder.cpp, xrefs: 00007FF7C40A05DA, 00007FF7C40A0636, 00007FF7C40A0675, 00007FF7C40A0740, 00007FF7C40A07FC

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: DeviceHealth::ScoreRecorder::LoadHealthScores$d:\dbs\sh\odct\0223_153807_0\cmd\o\client\onedrive\Product\Logging\HealthScoreRecorder.cpp$rtTime$scores$trend$unhealthyReportCount
API String ID: 3668304517-2805105714
Opcode ID: 586e388819ef2fdbf8408010eb88910b7513098c3c8781b001d95b307a109b73
Instruction ID: adac533c4a69a04b4f3fdd155f000c6640de2139e0df4879d41817e4901f9c75
Opcode Fuzzy Hash: 586e388819ef2fdbf8408010eb88910b7513098c3c8781b001d95b307a109b73
Instruction Fuzzy Hash: E422A223A54B8585EB10EF66D8802ADB3B1FB547ACF914672DA5D077A9DF3CE480C720

Function 00007FF7C401BD50 Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 315COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF7C401BDB2
CreateEventW.KERNEL32 ref: 00007FF7C401BE33
GetLastError.KERNEL32 ref: 00007FF7C401BE45
GetLastError.KERNEL32 ref: 00007FF7C401BEDA
CloseHandle.KERNEL32 ref: 00007FF7C401C263

Strings

downloadUrl, xrefs: 00007FF7C401C00C
downloadId, xrefs: 00007FF7C401BFDB
D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\WebClientUpdateDownloader.cpp, xrefs: 00007FF7C401BEA3, 00007FF7C401BF38, 00007FF7C401C078, 00007FF7C401C11A, 00007FF7C401C199, 00007FF7C401C224
nqV, xrefs: 00007FF7C401BE83
WebClientUpdateDownloader::DownloadUpdateFile, xrefs: 00007FF7C401BE97, 00007FF7C401BF2C, 00007FF7C401C06D, 00007FF7C401C10F, 00007FF7C401C18C, 00007FF7C401C217
waitResult, xrefs: 00007FF7C401C158
result, xrefs: 00007FF7C401BE59, 00007FF7C401BEEE, 00007FF7C401BFC6, 00007FF7C401C0DC, 00007FF7C401C143

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CloseErrorHandleLast$CreateEvent
String ID: D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\WebClientUpdateDownloader.cpp$WebClientUpdateDownloader::DownloadUpdateFile$downloadId$downloadUrl$nqV$result$waitResult
API String ID: 157767052-3667972493
Opcode ID: 448f304648f0b553a8326a5c6088b419eab9513dfb42b23a4743c7bb6694b2e9
Instruction ID: f04f35d70d50a69880ab5386c20b50913e78e940d0c47798c301175f900d222a
Opcode Fuzzy Hash: 448f304648f0b553a8326a5c6088b419eab9513dfb42b23a4743c7bb6694b2e9
Instruction Fuzzy Hash: 6CF18F72A08A568AEB10EF22D4C02A9BBB4FB8476CF91013ADE4D53764DF7CE584C750

Function 00007FF7C4105208 Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 351synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7C4105249
WaitForSingleObject.KERNEL32 ref: 00007FF7C4105366
LeaveCriticalSection.KERNEL32 ref: 00007FF7C410571E

Strings

true, xrefs: 00007FF7C4105662
WebClient, xrefs: 00007FF7C410558F, 00007FF7C410569D, 00007FF7C41056F0
WebClient(%p): Failed to set BITS security flags, xrefs: 00007FF7C4105588
false, xrefs: 00007FF7C4105669
WebClient(%p): BITS temporary file=[%ls], foreground download=%ls, xrefs: 00007FF7C4105696
d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp, xrefs: 00007FF7C410528B, 00007FF7C4105336, 00007FF7C41056D5
WebClient(%p): Leaving BeginDownloadUsingBITS(), xrefs: 00007FF7C41056E9

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CriticalSection$EnterLeaveObjectSingleWait
String ID: WebClient$WebClient(%p): BITS temporary file=[%ls], foreground download=%ls$WebClient(%p): Failed to set BITS security flags$WebClient(%p): Leaving BeginDownloadUsingBITS()$d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp$false$true
API String ID: 501323975-3526201224
Opcode ID: 71bc7b768be871d095d986434fe72f45f0e7b0fe0b96271553c8005254bb9894
Instruction ID: bbeb4d65f1cf517d7190160095c478f4a6070e511a0993185fdea86bd8b58f36
Opcode Fuzzy Hash: 71bc7b768be871d095d986434fe72f45f0e7b0fe0b96271553c8005254bb9894
Instruction Fuzzy Hash: 01F14C36B08A0692EB14EF26E4D42ADA761FB54FACFA04036CA8D57764DF39E454C360

Function 00007FF7C4012200 Relevance: 19.5, APIs: 2, Strings: 9, Instructions: 234COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C40123BB
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C40123D3

Strings

diagnosticssync, xrefs: 00007FF7C401250B
\PreSignInSettingsConfig.json, xrefs: 00007FF7C4012273
PreSignInSettingsConfigJSON, xrefs: 00007FF7C401245C
D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdater.cpp, xrefs: 00007FF7C401256F
High, xrefs: 00007FF7C40124D5
46aaba30eaa7421a8df89563496ade33_UpdateRingSettingsDownloadResult, xrefs: 00007FF7C4012504
UpdateRingSettingsDownloadResult, xrefs: 00007FF7C401251C
StandaloneUpdater::DownloadAndApplyUpdateRingSettings, xrefs: 00007FF7C4012562
result, xrefs: 00007FF7C4012527

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource
String ID: 46aaba30eaa7421a8df89563496ade33_UpdateRingSettingsDownloadResult$D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdater.cpp$High$PreSignInSettingsConfigJSON$StandaloneUpdater::DownloadAndApplyUpdateRingSettings$UpdateRingSettingsDownloadResult$\PreSignInSettingsConfig.json$diagnosticssync$result
API String ID: 628915230-2204762119
Opcode ID: 4754d27e277f2f4189f2c741d2d881eb45502ee4a599f90aea6b7d5f6c92f9f7
Instruction ID: 936a14a9adfa9aaf6ba14ad7142986dcc458c8f1b3bff90aa58ae90828bd4e4a
Opcode Fuzzy Hash: 4754d27e277f2f4189f2c741d2d881eb45502ee4a599f90aea6b7d5f6c92f9f7
Instruction Fuzzy Hash: C3C16D32A18A8696EB20EF26D8802ECB374FB84BACF854136DA4D57769DF3CD544C710

Function 00007FF7C4105FC0 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 215synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000057,-00000050,00007FF7C4106387), ref: 00007FF7C4105FF1
WaitForSingleObject.KERNEL32 ref: 00007FF7C4106174
QueueUserWorkItem.KERNEL32 ref: 00007FF7C410621D
GetLastError.KERNEL32 ref: 00007FF7C410622A
LeaveCriticalSection.KERNEL32 ref: 00007FF7C41062C4

Strings

WebClient(%p): Beginning Async Download, id=[%ls], highPri=[%ls], Uri=[%ls], xrefs: 00007FF7C41061E1
true, xrefs: 00007FF7C41061AC
WebClient, xrefs: 00007FF7C41061E8, 00007FF7C4106263
false, xrefs: 00007FF7C41061B3
d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp, xrefs: 00007FF7C4106014, 00007FF7C410618C
WebClient(%p): Leaving DownloadFileAsync(), xrefs: 00007FF7C410625C

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CriticalSection$EnterErrorItemLastLeaveObjectQueueSingleUserWaitWork
String ID: WebClient$WebClient(%p): Beginning Async Download, id=[%ls], highPri=[%ls], Uri=[%ls]$WebClient(%p): Leaving DownloadFileAsync()$d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp$false$true
API String ID: 1248182837-3046352543
Opcode ID: a572cc35dbbd941d7d8ed0ec7ae4a644a3a017dbf6c0632b18bbe6dc2dd70a6a
Instruction ID: 6d53e492703615ff688fbd4dce24647e68ae51b762f36907cde123076398256a
Opcode Fuzzy Hash: a572cc35dbbd941d7d8ed0ec7ae4a644a3a017dbf6c0632b18bbe6dc2dd70a6a
Instruction Fuzzy Hash: CF81E366B18B4282EA14AF17E9C82B9A3A1FF45FA8F904535CE9D07794CF3DE554C320

Function 00007FF7C4028450 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 180COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C402849E
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C40284BC

Part of subcall function 00007FF7C401B694: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C401B6EF

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C40285F7

Strings

Software\Microsoft\OneDrive\UpdateOfficeConfig, xrefs: 00007FF7C4028515, 00007FF7C4028668
ODSUUpdateXMLUrlFromOC, xrefs: 00007FF7C4028610
EnvironmentTypeFromOC, xrefs: 00007FF7C40284E9
StandaloneUpdaterController::TryGetOneDriveAGUpdateXMLUrl, xrefs: 00007FF7C40285B6, 00007FF7C4028708
UpdateXMLUrlFromOC, xrefs: 00007FF7C4028609
D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdaterController.cpp, xrefs: 00007FF7C40285C3, 00007FF7C4028715
environmentType, xrefs: 00007FF7C4028575

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource$_invalid_parameter_noinfo_noreturn
String ID: D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdaterController.cpp$EnvironmentTypeFromOC$ODSUUpdateXMLUrlFromOC$Software\Microsoft\OneDrive\UpdateOfficeConfig$StandaloneUpdaterController::TryGetOneDriveAGUpdateXMLUrl$UpdateXMLUrlFromOC$environmentType
API String ID: 879565387-657031256
Opcode ID: 024cb9e4afe8532b8f0676c3a38b22721e30e224a8a87ec33f1248681245305b
Instruction ID: 770b28ba8b59b07b97cbd54e28dcea3b77415c16b4f7bf4aff61b9d9ad2aca63
Opcode Fuzzy Hash: 024cb9e4afe8532b8f0676c3a38b22721e30e224a8a87ec33f1248681245305b
Instruction Fuzzy Hash: FF914C62B08B429AE710EFA2D4805ED7775BB847ACF814136DE4C27AA9EF3CD149C750

Function 00007FF7C4106D60 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159filesynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF7C4106DFC
EnterCriticalSection.KERNEL32 ref: 00007FF7C4106E43
SHCreateStreamOnFileEx.SHLWAPI ref: 00007FF7C4106E81
LeaveCriticalSection.KERNEL32 ref: 00007FF7C4106EA5
LeaveCriticalSection.KERNEL32 ref: 00007FF7C4106EE9
SetEvent.KERNEL32 ref: 00007FF7C4106F73

Strings

WebClient, xrefs: 00007FF7C4106F10, 00007FF7C4106F4F
WebClient(%p): Download of '%s' finished successfully., xrefs: 00007FF7C4106F09
d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp, xrefs: 00007FF7C4106DB6, 00007FF7C4106E93
WebClient(%p): Download of '%ls' failed, xrefs: 00007FF7C4106F48

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CriticalSection$Leave$CreateEnterEventFileObjectSingleStreamWait
String ID: WebClient$WebClient(%p): Download of '%ls' failed$WebClient(%p): Download of '%s' finished successfully.$d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp
API String ID: 1068316540-2193786703
Opcode ID: 01cf9ae1d5b07311e1410f3c3882c59ab8a09c8e85b2a86914b9e6f41a59d2e0
Instruction ID: cde7d01023e01a748378fac86370753d7d96b4511e97997993853a6f63a34e1f
Opcode Fuzzy Hash: 01cf9ae1d5b07311e1410f3c3882c59ab8a09c8e85b2a86914b9e6f41a59d2e0
Instruction Fuzzy Hash: B9616032718A4682EB14EF17E8943ADA361FB84FA8F954036DA8E47764DF3DE445C314

Function 00007FF7C401602C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00007FF7C4016061
CommandLineToArgvW.SHELL32 ref: 00007FF7C4016071
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C401607F
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C40160F3
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C401611F
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C401613F

Strings

/firstsetup, xrefs: 00007FF7C40160AA
D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdater.cpp, xrefs: 00007FF7C40161D6
StandaloneUpdater, xrefs: 00007FF7C401618E
StandaloneUpdater::HandleZeroExhaustPolicy, xrefs: 00007FF7C40161C9

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource$CommandLine$Argv
String ID: /firstsetup$D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdater.cpp$StandaloneUpdater$StandaloneUpdater::HandleZeroExhaustPolicy
API String ID: 491714849-1820092732
Opcode ID: c45ef09b500ad10163d3b4325438d0846adf12c6d3357f1b7db4a593bf5f35e3
Instruction ID: 220581943b6ca7568a399796aacad1f51ef315d3121dcd9c134c67b1c6274f25
Opcode Fuzzy Hash: c45ef09b500ad10163d3b4325438d0846adf12c6d3357f1b7db4a593bf5f35e3
Instruction Fuzzy Hash: 4D519432A08B4296EB10AF26D8C12ADB760FB84B98F854076EA4D17755DF3DD544C750

Function 00007FF7C41050CC Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 79synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF7C41050DF
EnterCriticalSection.KERNEL32 ref: 00007FF7C4105108
LeaveCriticalSection.KERNEL32 ref: 00007FF7C410512E

Strings

WebClient, xrefs: 00007FF7C410515C, 00007FF7C41051D4
WebClient(%p): BeginDownloadAttempt: using %ls, xrefs: 00007FF7C4105155
BITS, xrefs: 00007FF7C4105134
WebClient(%p): Leaving BeginDownloadAttempt(), xrefs: 00007FF7C41051CD
d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp, xrefs: 00007FF7C41051BE
URLMon, xrefs: 00007FF7C410513B

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CriticalSection$EnterLeaveObjectSingleWait
String ID: BITS$URLMon$WebClient$WebClient(%p): BeginDownloadAttempt: using %ls$WebClient(%p): Leaving BeginDownloadAttempt()$d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp
API String ID: 501323975-1611066937
Opcode ID: 71be3a4496e1ca19b384613c83b18469630f4cb63c5398c6aa1a02d83a1bbe88
Instruction ID: ddc3a6dabf76ea22bd0342049bd7b5a028b7d69b64d1f219aa2907b24f44010a
Opcode Fuzzy Hash: 71be3a4496e1ca19b384613c83b18469630f4cb63c5398c6aa1a02d83a1bbe88
Instruction Fuzzy Hash: 23317265B08A4682EB01EF27E8D53B9A362AF85FACF944036CD4E472A5DF7DD445C320

Function 00007FF7C4106FC8 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 288COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32 ref: 00007FF7C4107072
GetLastError.KERNEL32 ref: 00007FF7C410707C
SHGetValueW.SHLWAPI ref: 00007FF7C4107184
SHGetValueW.SHLWAPI ref: 00007FF7C4107202

Strings

File, xrefs: 00007FF7C41071F1
d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp, xrefs: 00007FF7C4107054
GUID, xrefs: 00007FF7C4107176

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Value$ErrorLastPathTemp
String ID: File$GUID$d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp
API String ID: 4253884725-2326459497
Opcode ID: 2e4440596deb87ef5c58fcde1d58ad0fadc3362386fc0bccb84bf98f95bc534b
Instruction ID: d2eaf50926bdbde99b5c8ecbcd9869651d4b712737b824139ec4220c9fb5c219
Opcode Fuzzy Hash: 2e4440596deb87ef5c58fcde1d58ad0fadc3362386fc0bccb84bf98f95bc534b
Instruction Fuzzy Hash: FCC1B472B08B4682EB10EF66E4841BDA7A1FB45BA8FA04136DE9E07794DF3DE544C710

Function 00007FF7C4124258 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 164registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE ref: 00007FF7C412436B
RegOpenKeyExW.KERNELBASE ref: 00007FF7C41243E7
RegGetValueW.KERNELBASE ref: 00007FF7C4124447
RegGetValueW.KERNELBASE ref: 00007FF7C4124483
RegCloseKey.KERNELBASE ref: 00007FF7C41244A1

Strings

Wow6432Node\, xrefs: 00007FF7C41242B9
CLSID\, xrefs: 00007FF7C41242C9
CsiSyncClient.exe, xrefs: 00007FF7C4124264
\LocalServer32, xrefs: 00007FF7C41242E7

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: OpenValue$Close
String ID: CLSID\$CsiSyncClient.exe$Wow6432Node\$\LocalServer32
API String ID: 3504879307-2792177521
Opcode ID: f6181fd79e36a383b537d39158a2cd1c1fadc960eab39a6b73049f2598fa36cc
Instruction ID: 2b5c019a28f093ec265f9fc4ffe201851af8d006e61824ed8f23fcc2981393b5
Opcode Fuzzy Hash: f6181fd79e36a383b537d39158a2cd1c1fadc960eab39a6b73049f2598fa36cc
Instruction Fuzzy Hash: 6471A272B08B4285FB10EF26E8802ADA7A0FF957ACF905035DA8D57AA9DF3CD545C710

Function 00007FF7C4015C14 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 139sleepCOMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4015C62
Sleep.KERNEL32 ref: 00007FF7C4015D17
EventUnregister.ADVAPI32 ref: 00007FF7C4015D92
Sleep.KERNEL32 ref: 00007FF7C4015DA3
CoUninitialize.OLE32 ref: 00007FF7C4015E54

Strings

Software\Microsoft\OneDrive, xrefs: 00007FF7C4015E00
StandaloneUpdaterSafeMode, xrefs: 00007FF7C4015DD3
StandaloneUpdater::Run, xrefs: 00007FF7C4015C81, 00007FF7C4015D42
D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdater.cpp, xrefs: 00007FF7C4015C88, 00007FF7C4015D4F

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Sleep$Aligned_get_default_resourceEventUninitializeUnregister
String ID: D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdater.cpp$Software\Microsoft\OneDrive$StandaloneUpdater::Run$StandaloneUpdaterSafeMode
API String ID: 3660630638-3811060141
Opcode ID: 325bed5babb8b840d698e9db4deec1df7fcde38012751f1eabce0eb2e532ab69
Instruction ID: 1632689739f7fe2720857e69282f765a835905be797782adc2f725280f2ac8b7
Opcode Fuzzy Hash: 325bed5babb8b840d698e9db4deec1df7fcde38012751f1eabce0eb2e532ab69
Instruction Fuzzy Hash: 95619432A58A8295E710BF22E4C02B9B7B1FB847ACF851576EA4D176A5DF3CE144C710

Function 00007FF7C401E994 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 234COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C401E9E1
GetCommandLineW.KERNEL32 ref: 00007FF7C401EB6C
CommandLineToArgvW.SHELL32 ref: 00007FF7C401EB7D

Part of subcall function 00007FF7C401B694: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C401B6EF

Strings

BTSP, xrefs: 00007FF7C401EC0B
PERM, xrefs: 00007FF7C401EA2C
/firstsetup, xrefs: 00007FF7C401EBA7
FeatureSet, xrefs: 00007FF7C401ECC5
WVD, xrefs: 00007FF7C401EAE0

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CommandLine$Aligned_get_default_resourceArgv_invalid_parameter_noinfo_noreturn
String ID: /firstsetup$BTSP$FeatureSet$PERM$WVD
API String ID: 1486046747-662314634
Opcode ID: 636f1f1aa8ab065e091b1cba61957444b1c32ac410c26c08ad43d8fa7fe18b30
Instruction ID: e643eb143de907285432d32cc168376fb57614984b59219d924ef3db9da8c2ba
Opcode Fuzzy Hash: 636f1f1aa8ab065e091b1cba61957444b1c32ac410c26c08ad43d8fa7fe18b30
Instruction Fuzzy Hash: 5BB15023B58B4299FB10EFA2D4911EC6770FB5475CB81503ADE4D63A99EF38D54AC320

Function 00007FF7C4116324 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 137COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4116353
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4116373
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4116421
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4116438
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4116509
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4116532

Strings

/allusers, xrefs: 00007FF7C41163F0, 00007FF7C41164EC
/firstsetup, xrefs: 00007FF7C41164BC

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource
String ID: /allusers$/firstsetup
API String ID: 628915230-3656141830
Opcode ID: 41b52546280e2efd49a74099a39e15c682177040806e24bd6cd13039c79346cd
Instruction ID: d74c52c4a44038302c7c312fac3b35f371a3b76155b0060b5b836854dd5a6b22
Opcode Fuzzy Hash: 41b52546280e2efd49a74099a39e15c682177040806e24bd6cd13039c79346cd
Instruction Fuzzy Hash: 01614062A18A1186EB50EF66E8852BC6370BB54BBCF904335EA6E577E5DF3DD044C320

Function 00007FF7C410359C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 118memoryfileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF7C41035D6
SysFreeString.OLEAUT32 ref: 00007FF7C410363A
VariantChangeType.OLEAUT32 ref: 00007FF7C4103655
VariantClear.OLEAUT32 ref: 00007FF7C4103697
SysAllocString.OLEAUT32 ref: 00007FF7C41036BD
SHCreateStreamOnFileW.SHLWAPI ref: 00007FF7C41036F8

Strings

d:\dbs\sh\odct\0223_153807_0\cmd\16\client\onedrive\Setup\standalone\UpdateXMLParser\UpdateXMLParser.cpp, xrefs: 00007FF7C410370D
UpdateXMLParser::GetXMLStream, xrefs: 00007FF7C41036FE

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Variant$String$AllocChangeClearCreateFileFreeInitStreamType
String ID: UpdateXMLParser::GetXMLStream$d:\dbs\sh\odct\0223_153807_0\cmd\16\client\onedrive\Setup\standalone\UpdateXMLParser\UpdateXMLParser.cpp
API String ID: 593505129-1166790419
Opcode ID: 61e4e20d6135379b598a958582408b599f23d2c11c12bb70ab0bed160ccc378c
Instruction ID: 80612b0970758ab0777fc1ce844839b0efd5827c17f1a454bf8a3c7b5c471cff
Opcode Fuzzy Hash: 61e4e20d6135379b598a958582408b599f23d2c11c12bb70ab0bed160ccc378c
Instruction Fuzzy Hash: 0241C362F04A4A86FB00AF67E8851AC63B1BB58FB8F945532CE1D57764EE3CD585C320

Function 00007FF7C41080D0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 99synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C4065BC0: EnterCriticalSection.KERNEL32(?,?,6666666666666667,?,00000000,00007FF7C40656B4), ref: 00007FF7C4065BE5
Part of subcall function 00007FF7C4065BC0: LeaveCriticalSection.KERNEL32 ref: 00007FF7C4065C08

WaitForSingleObject.KERNEL32 ref: 00007FF7C4108155
CoInitializeEx.OLE32 ref: 00007FF7C4108175
WaitForSingleObject.KERNEL32 ref: 00007FF7C41081BB
CoUninitialize.OLE32 ref: 00007FF7C410821E

Strings

WebClient, xrefs: 00007FF7C410813D, 00007FF7C41081ED
WebClient(%p): Background thread exiting, hr=0x%08X, xrefs: 00007FF7C41081E6
d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp, xrefs: 00007FF7C4108120, 00007FF7C41081A9
WebClient(%p): Background thread started, xrefs: 00007FF7C4108136

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CriticalObjectSectionSingleWait$EnterInitializeLeaveUninitialize
String ID: WebClient$WebClient(%p): Background thread exiting, hr=0x%08X$WebClient(%p): Background thread started$d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp
API String ID: 2683532163-4021486414
Opcode ID: dc18c2a81bc163a8748b7adec07f97e7be33acccccfd19cc711958619b535fb2
Instruction ID: 95522ceb56d50b760f7c670d2309bc0b4ecc3261272161cf31bfd03174961709
Opcode Fuzzy Hash: dc18c2a81bc163a8748b7adec07f97e7be33acccccfd19cc711958619b535fb2
Instruction Fuzzy Hash: D1415325B0CA4282EB04AF17E8952B9A362BF84FA8F984436D94E573A4DF7DD445C720

Function 00007FF7C4107DF0 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C4065BC0: EnterCriticalSection.KERNEL32(?,?,6666666666666667,?,00000000,00007FF7C40656B4), ref: 00007FF7C4065BE5
Part of subcall function 00007FF7C4065BC0: LeaveCriticalSection.KERNEL32 ref: 00007FF7C4065C08

WaitForMultipleObjects.KERNEL32 ref: 00007FF7C4107E58
GetLastError.KERNEL32 ref: 00007FF7C4107E6C

Strings

WebClient, xrefs: 00007FF7C4107E0F
WebClient(%p): WaitForMultipleObjects() DownloadCompleted was signaled., xrefs: 00007FF7C4107EA7
WebClient(%p): WaitForMultipleObjects() Abort was signaled., xrefs: 00007FF7C4107EB0
WebClient(%p): WaitForDownloadAttempt(), xrefs: 00007FF7C4107E1A
WebClient(%p): WaitForMultipleObjects() TryCompleted was signaled., xrefs: 00007FF7C4107E9E
WebClient(%p): WaitForDownloadAttempt(), WaitForMultipleObjects() returned hr=0x%08X, xrefs: 00007FF7C4107E7E

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveMultipleObjectsWait
String ID: WebClient$WebClient(%p): WaitForDownloadAttempt()$WebClient(%p): WaitForDownloadAttempt(), WaitForMultipleObjects() returned hr=0x%08X$WebClient(%p): WaitForMultipleObjects() Abort was signaled.$WebClient(%p): WaitForMultipleObjects() DownloadCompleted was signaled.$WebClient(%p): WaitForMultipleObjects() TryCompleted was signaled.
API String ID: 1888064639-1074600636
Opcode ID: 9033252cf058b3952cc62b4c05938be6a7d4315af6bc6dac307de367de8e1db8
Instruction ID: 06bee710de63b8e752a19994e39bb6702d7be7597898fe5bc76438d852495e0a
Opcode Fuzzy Hash: 9033252cf058b3952cc62b4c05938be6a7d4315af6bc6dac307de367de8e1db8
Instruction Fuzzy Hash: B4217172B08B4182E640EF16E9956F9B3A0FB48BA8FD00136D95D977A0CF3DE905C760

Function 00007FF7C42D003C Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C42CFC1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C42CFC5D
Part of subcall function 00007FF7C42CFC1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C42CFCDD
Part of subcall function 00007FF7C42CFC1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C42CFD31
Part of subcall function 00007FF7C42CFC1C: _get_daylight.LIBCMT ref: 00007FF7C42CFD89

CreateFileW.KERNELBASE ref: 00007FF7C42D0142
CreateFileW.KERNEL32 ref: 00007FF7C42D0192
GetLastError.KERNEL32 ref: 00007FF7C42D01C2
GetFileType.KERNELBASE ref: 00007FF7C42D01D7
GetLastError.KERNEL32 ref: 00007FF7C42D01E1
CloseHandle.KERNEL32 ref: 00007FF7C42D0214
CloseHandle.KERNEL32 ref: 00007FF7C42D0378
CreateFileW.KERNEL32 ref: 00007FF7C42D03AD
GetLastError.KERNEL32 ref: 00007FF7C42D03BC

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: db3f8f3ff8ef0fe14cbd5ee168f45bc9ee01bce68d8b76161bb959add01bb626
Instruction ID: eef6e01fe69e8e4c926db7f5e7c5086ef6ab25cb586bd960a18eb0cf133741b5
Opcode Fuzzy Hash: db3f8f3ff8ef0fe14cbd5ee168f45bc9ee01bce68d8b76161bb959add01bb626
Instruction Fuzzy Hash: A6C1B033B28A4185EB10DFA6C4816ACB771EB49BACB815225DE2E973E4DF39D455C310

Function 00007FF7C410DD5C Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C410DDA2
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C410DE5C
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C410DF0E

Strings

MSFTInternal, xrefs: 00007FF7C410DDD2, 00007FF7C410DE86
Software\Microsoft\SQMClient, xrefs: 00007FF7C410DEB5, 00007FF7C410DF64
IsTest, xrefs: 00007FF7C410DF3B
Software\Policies\Microsoft\SQMClient, xrefs: 00007FF7C410DDFC

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource
String ID: IsTest$MSFTInternal$Software\Microsoft\SQMClient$Software\Policies\Microsoft\SQMClient
API String ID: 628915230-530480142
Opcode ID: 9987272d9afe37239ba4b992b7eb05d3f258229c01e98c0f71a71129e1c3eb41
Instruction ID: 7fea4d52c1235877d4479318eaa671d7f57436ed175066b317c7943dce6b5678
Opcode Fuzzy Hash: 9987272d9afe37239ba4b992b7eb05d3f258229c01e98c0f71a71129e1c3eb41
Instruction Fuzzy Hash: F7716D22A14B429AE710AF32D4801EDB770FB95B9CF855136EA4C13BAAEF3CD645C350

Function 00007FF7C41063D8 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 154synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00007FF7C40E1714), ref: 00007FF7C4106416
WaitForSingleObject.KERNEL32 ref: 00007FF7C4106467
PathFileExistsW.SHLWAPI ref: 00007FF7C41064F5
LeaveCriticalSection.KERNEL32 ref: 00007FF7C41065EE

Strings

WebClient, xrefs: 00007FF7C41065B6
WebClient(%p): Leaving GetDownloadedData(), xrefs: 00007FF7C41065AF
d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp, xrefs: 00007FF7C4106450

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CriticalSection$EnterExistsFileLeaveObjectPathSingleWait
String ID: WebClient$WebClient(%p): Leaving GetDownloadedData()$d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp
API String ID: 2555838569-1528802841
Opcode ID: 91ee02311ba42dd27d9a44baceb2f7b170826da9612bf55770dc038ec588b051
Instruction ID: abd325dda380db3501cdd1e6cdf033615221233722b0c02dfa509670ef41944a
Opcode Fuzzy Hash: 91ee02311ba42dd27d9a44baceb2f7b170826da9612bf55770dc038ec588b051
Instruction Fuzzy Hash: 1761D332B18B0286FB10EF66E4842BDA371BB94BACF904136CE4E53798DE38D455C364

Function 00007FF7C4064D10 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7C4064D59
LeaveCriticalSection.KERNEL32 ref: 00007FF7C4064EE2

Part of subcall function 00007FF7C4064B6C: EnterCriticalSection.KERNEL32 ref: 00007FF7C4064BC8
Part of subcall function 00007FF7C4064B6C: LeaveCriticalSection.KERNEL32 ref: 00007FF7C4064C52

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4064D99
SHGetFolderPathW.SHELL32 ref: 00007FF7C4064DF7

Strings

d:\dbs\sh\odct\0223_153807_0\cmd\l\client\onedrive\Setup\Standalone\fsmanager\fsmanagerimpl.cpp, xrefs: 00007FF7C4064D20
Microsoft OneDrive\setup\logs, xrefs: 00007FF7C4064E2A
Microsoft\OneDrive\setup\logs, xrefs: 00007FF7C4064E33

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Aligned_get_default_resourceFolderPath
String ID: Microsoft OneDrive\setup\logs$Microsoft\OneDrive\setup\logs$d:\dbs\sh\odct\0223_153807_0\cmd\l\client\onedrive\Setup\Standalone\fsmanager\fsmanagerimpl.cpp
API String ID: 2987415128-2058268419
Opcode ID: c3711834d42646a347f2246e7448991f8de90d73d4a93258ea3bb61567791b3d
Instruction ID: 459a4ded97a44bf54b42db35120d977be365092b0d72110a41cf1cfe06f37100
Opcode Fuzzy Hash: c3711834d42646a347f2246e7448991f8de90d73d4a93258ea3bb61567791b3d
Instruction Fuzzy Hash: E951A632A18B8192E710EF26E4C02AAF764FB94768F914136DF9D136A4DF7CD184C714

Function 00007FF7C4053440 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7C4053E6E,?,?,00000000,00007FF7C42CD601,?,?,?,?,00007FF7C414DCC6), ref: 00007FF7C40535BF
GetProcAddressForCaller.KERNELBASE(?,?,?,00007FF7C4053E6E,?,?,00000000,00007FF7C42CD601,?,?,?,?,00007FF7C414DCC6), ref: 00007FF7C40535CB

Strings

ext-ms-, xrefs: 00007FF7C405351C
api-ms-, xrefs: 00007FF7C4053509

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: AddressCallerFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3520295827-537541572
Opcode ID: 12cf3816012bc3fe5c1545f350b9c82583d50d18c9a010ba7ee4c444b87a26e5
Instruction ID: 171c92fe3e1ec512d35f914512170eb6f22bd987b5ad3002e8b161945b9ba608
Opcode Fuzzy Hash: 12cf3816012bc3fe5c1545f350b9c82583d50d18c9a010ba7ee4c444b87a26e5
Instruction Fuzzy Hash: C9412261B58E0281FA12FF17A8842B5A395FF44BF8F89553ADD0D8B784DE3CE0858324

Function 00007FF7C4104D88 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 91registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C4065BC0: EnterCriticalSection.KERNEL32(?,?,6666666666666667,?,00000000,00007FF7C40656B4), ref: 00007FF7C4065BE5
Part of subcall function 00007FF7C4065BC0: LeaveCriticalSection.KERNEL32 ref: 00007FF7C4065C08

Part of subcall function 00007FF7C401B694: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C401B6EF

DeleteCriticalSection.KERNEL32 ref: 00007FF7C4104DF8
RegCloseKey.KERNELBASE ref: 00007FF7C4104E0A
FindCloseChangeNotification.KERNELBASE ref: 00007FF7C4104E4F
CloseHandle.KERNEL32 ref: 00007FF7C4104E66
CloseHandle.KERNEL32 ref: 00007FF7C4104E7A

Strings

WebClient(%p): destroyed, xrefs: 00007FF7C4104DB4
WebClient, xrefs: 00007FF7C4104DBB

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Close$CriticalSection$Handle$ChangeDeleteEnterFindLeaveNotification_invalid_parameter_noinfo_noreturn
String ID: WebClient$WebClient(%p): destroyed
API String ID: 872555116-1053654690
Opcode ID: e0026fbbe3b5c5738bfe8db654fb63cdbe3f06c8936f89669fcffcfb11580f91
Instruction ID: 546238bf67a0bc5a49d4e0cd2c09d2294f5e22164a41198c59d82a70f6a4cc7a
Opcode Fuzzy Hash: e0026fbbe3b5c5738bfe8db654fb63cdbe3f06c8936f89669fcffcfb11580f91
Instruction Fuzzy Hash: 4141E432A15E4586EB44EF26D4D53B8A370FF94F6DF944536CA0E4A2A4DF2DE448C324

Function 00007FF7C40F78C8 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 274COMMON

Download Yara Rule

Strings

settings, xrefs: 00007FF7C40F793A
UpdateRingSettingsParser::GetSettingsFromJsonObject, xrefs: 00007FF7C40F7913, 00007FF7C40F7BCE, 00007FF7C40F7C45
d:\dbs\sh\odct\0223_153807_0\cmd\1k\client\onedrive\Product\UpdateRingSettings\UpdateRingSettingsParser.cpp, xrefs: 00007FF7C40F791D, 00007FF7C40F7BDA, 00007FF7C40F7C51
value, xrefs: 00007FF7C40F7A02

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID:
String ID: UpdateRingSettingsParser::GetSettingsFromJsonObject$d:\dbs\sh\odct\0223_153807_0\cmd\1k\client\onedrive\Product\UpdateRingSettings\UpdateRingSettingsParser.cpp$settings$value
API String ID: 0-676100781
Opcode ID: 9b4ea6b1c8da8fbfa575d10a5459b1591690021d5a505221282f77402bcb23d2
Instruction ID: f3d6fbd90e6eefa750c215d21082160c13166079ebb72a9f6e06b2b959bebe2b
Opcode Fuzzy Hash: 9b4ea6b1c8da8fbfa575d10a5459b1591690021d5a505221282f77402bcb23d2
Instruction Fuzzy Hash: 7FB1C222F58A4642FB10AFA6D8C02ADA3A1FB84BACF855136DA0D53795DF3CE481C351

Function 00007FF7C410FE2C Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 187COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.KERNELBASE ref: 00007FF7C410FED9
GetFileVersionInfoW.KERNELBASE ref: 00007FF7C410FF52
VerQueryValueW.KERNELBASE ref: 00007FF7C410FFB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4110136

Strings

\StringFileInfo\%04x%04x\OriginalFilename, xrefs: 00007FF7C4110009
\VarFileInfo\Translation, xrefs: 00007FF7C410FFA0

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_invalid_parameter_noinfo_noreturn
String ID: \StringFileInfo\%04x%04x\OriginalFilename$\VarFileInfo\Translation
API String ID: 1927219033-1556208207
Opcode ID: f305a5d4802fe668cf9fda1918c8f33807acb5595fd4314793707687fdf3c57f
Instruction ID: 4fe52e194d1cc16e0051f261c7ca57e8816226232025e093ef5a8d2350482ed6
Opcode Fuzzy Hash: f305a5d4802fe668cf9fda1918c8f33807acb5595fd4314793707687fdf3c57f
Instruction Fuzzy Hash: 41915072B08B8585EB10EF6AE4802ADA7B1FB88BA8F904236DE4C57764DF7DD544C710

Function 00007FF7C411EFC8 Relevance: 10.6, APIs: 7, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fce0f33238d65008f2d20c9c729817b1b59526dabd6495b1cc8238be10422c2
Instruction ID: 022c2f298b9ebe839effe1633270f5a5bc19949306ee8869689a704f20ca350d
Opcode Fuzzy Hash: 7fce0f33238d65008f2d20c9c729817b1b59526dabd6495b1cc8238be10422c2
Instruction Fuzzy Hash: 75510865A08B4686FB50AF57E8C4338A3B1AB85FACF944035DA8D5B3A5CF3DE445C321

Function 00007FF7C4110600 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4110644
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4110679
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4110698
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C41106CD

Part of subcall function 00007FF7C401B694: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C401B6EF

Strings

Software\Microsoft\SQMClient, xrefs: 00007FF7C4110724
IsTest, xrefs: 00007FF7C41106F9

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource$_invalid_parameter_noinfo_noreturn
String ID: IsTest$Software\Microsoft\SQMClient
API String ID: 879565387-4109838640
Opcode ID: 874cf461619d02d71a53b7bf2cc27a9772faef1abe9e4d95d36d8211a1b40f82
Instruction ID: 99cff744a48c685faef25b4d83f228a993df1652e5a03351417aee5fe7a6b1b2
Opcode Fuzzy Hash: 874cf461619d02d71a53b7bf2cc27a9772faef1abe9e4d95d36d8211a1b40f82
Instruction Fuzzy Hash: 80517B22B04B429AEB10EF62D4801EC7374FB88B9CB805136DE4D27B69EF38D215C354

Function 00007FF7C4107A3C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 103COMMON

Download Yara Rule

APIs

PathFindFileNameW.SHLWAPI ref: 00007FF7C4107ABA
SHSetValueW.SHLWAPI ref: 00007FF7C4107B78
SHSetValueW.SHLWAPI ref: 00007FF7C4107BB5

Strings

File, xrefs: 00007FF7C4107B9C
d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp, xrefs: 00007FF7C4107A85
GUID, xrefs: 00007FF7C4107B5E

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Value$FileFindNamePath
String ID: File$GUID$d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp
API String ID: 419649710-2326459497
Opcode ID: 61be581ee4f4e13ce5220fc344eefe86a59dc6ce0e020272d6b7c5bdbdf8ffc8
Instruction ID: ca94c385a997e9e4d1ae8f2933e60af309f891bacaf15b002a405995a2fd2b73
Opcode Fuzzy Hash: 61be581ee4f4e13ce5220fc344eefe86a59dc6ce0e020272d6b7c5bdbdf8ffc8
Instruction Fuzzy Hash: A2419225F0864283EB21AF13E488379A760FB44BA8FA44436CA9D47794CF3DE6958360

Function 00007FF7C4012E00 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 94synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE ref: 00007FF7C4012E56
GetLastError.KERNEL32 ref: 00007FF7C4012E5F

Strings

ErrorCode, xrefs: 00007FF7C4012E7E
D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdater.cpp, xrefs: 00007FF7C4012EA6, 00007FF7C4012F2A
StandaloneUpdater::GrabUpdateMutex, xrefs: 00007FF7C4012E95, 00007FF7C4012F1B
result, xrefs: 00007FF7C4012F10

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID: D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdater.cpp$ErrorCode$StandaloneUpdater::GrabUpdateMutex$result
API String ID: 1925916568-3043308129
Opcode ID: a1376326dd3b1872f4736c24994f544964e7e33b6354d60dc54d6590e43706d6
Instruction ID: d28ea3fa6789a885565749b9ed7b3b888717287d11c9ad077035606602c3b7a5
Opcode Fuzzy Hash: a1376326dd3b1872f4736c24994f544964e7e33b6354d60dc54d6590e43706d6
Instruction Fuzzy Hash: 89416A32A14A418AE710EF22E4843A9B7B0FB84BACF81053AEA4D53B64DF7CD159C750

Function 00007FF7C4106684 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32 ref: 00007FF7C41066E4
GetLastError.KERNEL32 ref: 00007FF7C41066F0
GetTempFileNameW.KERNELBASE ref: 00007FF7C410673C
GetLastError.KERNEL32 ref: 00007FF7C4106746

Strings

wct, xrefs: 00007FF7C410672D
d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp, xrefs: 00007FF7C4106712

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ErrorLastTemp$FileNamePath
String ID: d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp$wct
API String ID: 891594076-3157952432
Opcode ID: 7c689e38abf892a117ad0f63fcdc77bfebe8d9a62452ffa2c8f7ad640b5c6618
Instruction ID: 5c65f9115b687b2bc3855efcb7006938ebd90b0a39144b76320199e6eeafda82
Opcode Fuzzy Hash: 7c689e38abf892a117ad0f63fcdc77bfebe8d9a62452ffa2c8f7ad640b5c6618
Instruction Fuzzy Hash: DA31EA65B08B4282F720BF22E4C47B9A3A0FB48B78FD10236DA9D47685DF2DD545C720

Function 00007FF7C4028218 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 71COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4028253

Strings

https://g.live.com/1rewlive5skydrive/ODSUProductionV2, xrefs: 00007FF7C40282B5
https://g.live.com/1rewlive5skydrive/ODSUEnterpriseV2, xrefs: 00007FF7C40282F1
https://g.live.com/1rewlive5skydrive/ODSUMsitFastV2, xrefs: 00007FF7C40282E2
https://g.live.com/1rewlive5skydrive/ODSUMsitSlowV2, xrefs: 00007FF7C40282D3
https://g.live.com/1rewlive5skydrive/ODSUInsiderV2, xrefs: 00007FF7C40282C4

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource
String ID: https://g.live.com/1rewlive5skydrive/ODSUEnterpriseV2$https://g.live.com/1rewlive5skydrive/ODSUInsiderV2$https://g.live.com/1rewlive5skydrive/ODSUMsitFastV2$https://g.live.com/1rewlive5skydrive/ODSUMsitSlowV2$https://g.live.com/1rewlive5skydrive/ODSUProductionV2
API String ID: 628915230-2666494377
Opcode ID: fc5f28df7a64533c7fc09b240dc73a366c47016fd2901c59741e6046db3daf2b
Instruction ID: cd463d4cb176ecea700ef97d56109da20c5fc4ad2b9a110387961ef54bf26053
Opcode Fuzzy Hash: fc5f28df7a64533c7fc09b240dc73a366c47016fd2901c59741e6046db3daf2b
Instruction Fuzzy Hash: BE318176A5CB8281EA30EF06E4C0269A371FB85BE8FD14275EA4D17A95CF2CE645C710

Function 00007FF7C4028334 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 71COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C402836F

Strings

https://g.live.com/1rewlive5skydrive/MsitFastV2, xrefs: 00007FF7C40283FE
https://g.live.com/1rewlive5skydrive/OneDriveInsiderV2, xrefs: 00007FF7C40283E0
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2, xrefs: 00007FF7C40283D1
https://g.live.com/1rewlive5skydrive/OneDriveEnterpriseV2, xrefs: 00007FF7C402840D
https://g.live.com/1rewlive5skydrive/MsitSlowV2, xrefs: 00007FF7C40283EF

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource
String ID: https://g.live.com/1rewlive5skydrive/MsitFastV2$https://g.live.com/1rewlive5skydrive/MsitSlowV2$https://g.live.com/1rewlive5skydrive/OneDriveEnterpriseV2$https://g.live.com/1rewlive5skydrive/OneDriveInsiderV2$https://g.live.com/1rewlive5skydrive/OneDriveProductionV2
API String ID: 628915230-3224108899
Opcode ID: d27a8643cb7814f9687577b3580c83703914e9127744403af444ea6afeca996e
Instruction ID: da2a24cd7edef27146b80a8765c4ddc92223b51a9bf5fec5aeed689060e4cd7a
Opcode Fuzzy Hash: d27a8643cb7814f9687577b3580c83703914e9127744403af444ea6afeca996e
Instruction Fuzzy Hash: 56319422A5CB8282EA70EF07E4C5279A371BB84BE8FC15175DA4D07695DF2DD584C710

Function 00007FF7C4080440 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 488COMMON

Download Yara Rule

APIs

_Mtx_unlock.LIBCPMT ref: 00007FF7C408073A
_Mtx_unlock.LIBCPMT ref: 00007FF7C4080929

Strings

BinaryLoggingSession::StartLoggingSession, xrefs: 00007FF7C40806D7
aodl, xrefs: 00007FF7C4080517
d:\dbs\sh\odct\0223_153807_0\cmd\o\client\onedrive\Product\Logging\BinaryLoggingSession.cpp, xrefs: 00007FF7C40806DE

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Mtx_unlock
String ID: BinaryLoggingSession::StartLoggingSession$aodl$d:\dbs\sh\odct\0223_153807_0\cmd\o\client\onedrive\Product\Logging\BinaryLoggingSession.cpp
API String ID: 1418687624-3898848689
Opcode ID: eca28e88f72505fcbd84cec41083c5ee5f3dee9bc8b705ceb11f2578b4c9047b
Instruction ID: 15d673e2f07c0cc41ce15adb5f375f8dcba7a5be51b04b8b5b14c60f1a424857
Opcode Fuzzy Hash: eca28e88f72505fcbd84cec41083c5ee5f3dee9bc8b705ceb11f2578b4c9047b
Instruction Fuzzy Hash: 79127B32B49A8682EB14EF26D5802BCA774FB84FA8F854132DE5D17765DF38D4A5C310

Function 00007FF7C40267E0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4026834
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4026B8F

Strings

StandaloneUpdaterController::ShouldApplyUpdate, xrefs: 00007FF7C40268BC, 00007FF7C4026952, 00007FF7C40269E1, 00007FF7C4026A96, 00007FF7C4026B4A, 00007FF7C4026BDE
StandaloneUpdaterController::IsMachineThrottled, xrefs: 00007FF7C4026BBB
D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdaterController.cpp, xrefs: 00007FF7C40268C8, 00007FF7C402695E, 00007FF7C40269ED, 00007FF7C4026AA2, 00007FF7C4026B56, 00007FF7C4026BC7, 00007FF7C4026BEA

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource
String ID: D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdaterController.cpp$StandaloneUpdaterController::IsMachineThrottled$StandaloneUpdaterController::ShouldApplyUpdate
API String ID: 628915230-281803223
Opcode ID: ab148a67b1b4bdbea7aba0ab5eb149c78a2cfe35870d0b051df4cd16cf680d0c
Instruction ID: 3f6911a2d62066a085e31fac5b2adcc6b755c618c3717fc2ffb902c85000f7f4
Opcode Fuzzy Hash: ab148a67b1b4bdbea7aba0ab5eb149c78a2cfe35870d0b051df4cd16cf680d0c
Instruction Fuzzy Hash: AEC19372A14A1296EB20EF52D4C45ADB3B4FB44B9CF860079DE0D63695CF3CD5A4C7A0

Function 00007FF7C40E82C8 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 249COMMON

Download Yara Rule

APIs

AcquireSRWLockShared.KERNEL32 ref: 00007FF7C40E834A
ReleaseSRWLockShared.KERNEL32 ref: 00007FF7C40E853A

Strings

UpdateRingRampGroup, xrefs: 00007FF7C40E859F
d:\dbs\sh\odct\0223_153807_0\cmd\1k\client\onedrive\Product\UpdateRingSettings\UpdateRingSettingsManager.cpp, xrefs: 00007FF7C40E861D
UpdateRingSettingsManager::PropagateRampsToTelemetry, xrefs: 00007FF7C40E8611

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: LockShared$AcquireRelease
String ID: UpdateRingRampGroup$UpdateRingSettingsManager::PropagateRampsToTelemetry$d:\dbs\sh\odct\0223_153807_0\cmd\1k\client\onedrive\Product\UpdateRingSettings\UpdateRingSettingsManager.cpp
API String ID: 2614130328-582473772
Opcode ID: 42b33e794c358f1b1698e4638fc3d8292aaa83d80e3fd95960ec1d7242516bd6
Instruction ID: 8de5cfaf8e7d5e9dba55a5a1a0eb7028d3a73f8ddfbf8bbc9316b41a6cedd40e
Opcode Fuzzy Hash: 42b33e794c358f1b1698e4638fc3d8292aaa83d80e3fd95960ec1d7242516bd6
Instruction Fuzzy Hash: 56B1D463B48A8592EB20EF26D4C0069E7B1FB84B98F855176EACD037A9DF3CD591C710

Function 00007FF7C401C5CC Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 210COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C401C6BD

Strings

D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\WebClientUpdateDownloader.cpp, xrefs: 00007FF7C401C68B
WebClientUpdateDownloader::CopyOverDownloadedData, xrefs: 00007FF7C401C67E
result, xrefs: 00007FF7C401C63D

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource
String ID: D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\WebClientUpdateDownloader.cpp$WebClientUpdateDownloader::CopyOverDownloadedData$result
API String ID: 628915230-877556936
Opcode ID: 70dc243cdfd7fbb94f9ecaec77b5a85526c702f685c0049bb7ceefdf6e8bd674
Instruction ID: c5f54bdcbfe2871b55d648848f9877a05f7f1d8a78a253bf7a7f029084b5539c
Opcode Fuzzy Hash: 70dc243cdfd7fbb94f9ecaec77b5a85526c702f685c0049bb7ceefdf6e8bd674
Instruction Fuzzy Hash: 89916032B48B4685EB10EF66D4802ACA3B5BB84BACF865076DE0D67769EF3CD445C350

Function 00007FF7C408B578 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 00007FF7C408B5FF
std::ios_base::failure::failure.LIBCPMT ref: 00007FF7C408B653

Strings

ios_base::failbit set, xrefs: 00007FF7C408B627
ios_base::badbit set, xrefs: 00007FF7C408B578, 00007FF7C408B5F3, 00007FF7C408B61B
ios_base::eofbit set, xrefs: 00007FF7C408B62E

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: std::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2264918676-1866435925
Opcode ID: 47085ac235619f3cb2bc2866e4c8642aa0954896132e664907964907f12d0016
Instruction ID: f742ddec7c863b54f725246d2f13826f0afe76d353a5bdbe7ba0578732c2f2dc
Opcode Fuzzy Hash: 47085ac235619f3cb2bc2866e4c8642aa0954896132e664907964907f12d0016
Instruction Fuzzy Hash: 8F71BD72A09A4285EB50EF26D4802B8B770FB54B9CFC64076EA4D47798DF3CD596C360

Function 00007FF7C40F9730 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 169COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C40F977C
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C40F9860

Strings

Software\Microsoft\OneDrive\PreSignInSettingsOverrides, xrefs: 00007FF7C40F97AB, 00007FF7C40F98CD
OverridesProvider::ReadSettingsOverrides, xrefs: 00007FF7C40F9962
d:\dbs\sh\odct\0223_153807_0\cmd\1k\client\onedrive\Product\UpdateRingSettings\OverridesProviderWin.cpp, xrefs: 00007FF7C40F996E

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource
String ID: OverridesProvider::ReadSettingsOverrides$Software\Microsoft\OneDrive\PreSignInSettingsOverrides$d:\dbs\sh\odct\0223_153807_0\cmd\1k\client\onedrive\Product\UpdateRingSettings\OverridesProviderWin.cpp
API String ID: 628915230-1023140038
Opcode ID: 9e7bc028d644bad1eb08db3f48b31f23875adfba7d9aca4f716a3850984b7531
Instruction ID: ac82c57507b470763135f2f0bea9d20fcb0b57f877a2fdf43950a9b393d6034a
Opcode Fuzzy Hash: 9e7bc028d644bad1eb08db3f48b31f23875adfba7d9aca4f716a3850984b7531
Instruction Fuzzy Hash: 30718022B48A4196FB10EF62E4802EDA3B1FB8476CF911136DE4D63AA9DF3CD549C750

Function 00007FF7C41246E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C4124258: RegOpenKeyExW.KERNELBASE ref: 00007FF7C412436B
Part of subcall function 00007FF7C4124258: RegOpenKeyExW.KERNELBASE ref: 00007FF7C41243E7

Part of subcall function 00007FF7C41244F4: GetLongPathNameW.KERNELBASE ref: 00007FF7C4124567
Part of subcall function 00007FF7C41244F4: StrStrIW.SHLWAPI ref: 00007FF7C4124579

PathRemoveFileSpecW.SHLWAPI ref: 00007FF7C4124782
GetFileVersionInfoSizeW.VERSION ref: 00007FF7C41247AC
GetFileVersionInfoW.VERSION ref: 00007FF7C41247DC
VerQueryValueW.VERSION ref: 00007FF7C41247FD

Strings

false, xrefs: 00007FF7C41246E6

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: File$InfoOpenPathVersion$LongNameQueryRemoveSizeSpecValue
String ID: false
API String ID: 1687329707-734881840
Opcode ID: 08e9ff1be93866122acf6a0d2e87b31156f8ddadd897695e0af009d22ab42d8a
Instruction ID: 33972b30c5605583850c8c6fc745a1f67bc9961f823f0b16f4eb930d2a090e3e
Opcode Fuzzy Hash: 08e9ff1be93866122acf6a0d2e87b31156f8ddadd897695e0af009d22ab42d8a
Instruction Fuzzy Hash: C561C612A1865286EF20EF27E8811FDA760FF857ACF815031EA8D576AADF3CD545C710

Function 00007FF7C40F94D0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C40F951C
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C40F95E9

Strings

Software\Microsoft\OneDrive\PreSignInRampOverrides, xrefs: 00007FF7C40F9548, 00007FF7C40F9651
OverridesProvider::ReadRampOverrides, xrefs: 00007FF7C40F96CD
d:\dbs\sh\odct\0223_153807_0\cmd\1k\client\onedrive\Product\UpdateRingSettings\OverridesProviderWin.cpp, xrefs: 00007FF7C40F96D9

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource
String ID: OverridesProvider::ReadRampOverrides$Software\Microsoft\OneDrive\PreSignInRampOverrides$d:\dbs\sh\odct\0223_153807_0\cmd\1k\client\onedrive\Product\UpdateRingSettings\OverridesProviderWin.cpp
API String ID: 628915230-3983309578
Opcode ID: f537ae53efe46b1c3d2b1fccfc7304e6036029b17f07d6e284acbc28c6804c76
Instruction ID: 52c909480ec837aaa75cc27b5d84be62da787588871fc99ec37b223096f1b9ad
Opcode Fuzzy Hash: f537ae53efe46b1c3d2b1fccfc7304e6036029b17f07d6e284acbc28c6804c76
Instruction Fuzzy Hash: 06616D22B44A419AFB10EFB2D8802ED73B1BB887ACF814136DE4D67695EF38E555C350

Function 00007FF7C4111978 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C41119B8

Part of subcall function 00007FF7C401B694: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C401B6EF

Strings

16.0.11425.20202, xrefs: 00007FF7C4111AD9
AudienceData, xrefs: 00007FF7C41119E3
Dogfood, xrefs: 00007FF7C4111A75
Software\Microsoft\Office\ClickToRun\Configuration, xrefs: 00007FF7C4111A0D

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource_invalid_parameter_noinfo_noreturn
String ID: 16.0.11425.20202$AudienceData$Dogfood$Software\Microsoft\Office\ClickToRun\Configuration
API String ID: 4266926526-2226149379
Opcode ID: e4ef1327850a9f4ee370ff85bb07f830235563c686a12bdb94924ea65abb30eb
Instruction ID: 47c7c9848897683a2d3bfc17c7cd5b70fb5ee4525bdc55d42d3ae2c5e35f353c
Opcode Fuzzy Hash: e4ef1327850a9f4ee370ff85bb07f830235563c686a12bdb94924ea65abb30eb
Instruction Fuzzy Hash: AF51B432A14B42DAE720AF21E4806EDB374FB94B6CF854135EA4C57B99EF38E644C354

Function 00007FF7C408B484 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 00007FF7C408B50D
std::ios_base::failure::failure.LIBCPMT ref: 00007FF7C408B561

Strings

ios_base::failbit set, xrefs: 00007FF7C408B535
ios_base::badbit set, xrefs: 00007FF7C408B501, 00007FF7C408B529
ios_base::eofbit set, xrefs: 00007FF7C408B53C

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: std::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2264918676-1866435925
Opcode ID: b238f849d1da87789555524576970b916821299d5b6d2f3034c790bee82e9df8
Instruction ID: 0b6a235c1acb4721e7226044cfc9b9afa2ef2f48d2378e57d1e586b7838bd175
Opcode Fuzzy Hash: b238f849d1da87789555524576970b916821299d5b6d2f3034c790bee82e9df8
Instruction Fuzzy Hash: 7A210162A5950282EF54FF02D4D22F8A730FF90B5CFC55076E60E426A5DE7CE186C360

Function 00007FF7C4105AB4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SHDeleteValueW.SHLWAPI(?,?,?,00007FF7C4105322), ref: 00007FF7C4105B09
SHDeleteValueW.SHLWAPI(?,?,?,00007FF7C4105322), ref: 00007FF7C4105B2F
SHDeleteKeyW.SHLWAPI(?,?,?,00007FF7C4105322), ref: 00007FF7C4105B4E

Strings

File, xrefs: 00007FF7C4105B28
GUID, xrefs: 00007FF7C4105B02

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Delete$Value
String ID: File$GUID
API String ID: 3273747370-2566199573
Opcode ID: 3361484d5dd1688e8405f217570241a2c1cd8fc92435ee25ecd727e40d3acda7
Instruction ID: bb25c1a0f320bbf868947e28edd1fe8c40a6e491c58883e630d193d99d505e60
Opcode Fuzzy Hash: 3361484d5dd1688e8405f217570241a2c1cd8fc92435ee25ecd727e40d3acda7
Instruction Fuzzy Hash: A4117821614D85D2DB44EF16E4C92ACE361FB44FA8F948036D74D57255CF38E4AAC364

Function 00007FF7C410EE14 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 310COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7C410F148

Strings

failed with hr=, xrefs: 00007FF7C410F18F
OpenProcess on PID=, xrefs: 00007FF7C410F1D3
Found process, PID=, xrefs: 00007FF7C410F0B8
Attempting to find process by name: , xrefs: 00007FF7C410EE77

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ErrorLast
String ID: failed with hr=$Attempting to find process by name: $Found process, PID=$OpenProcess on PID=
API String ID: 1452528299-3248908137
Opcode ID: 57d183f817150ec273e360e367ab56e2662b588d00195dc9d77f94c1e0a3eff7
Instruction ID: bfce1616be0d3aa1be4db340f385d2e655b67e0b6130d34a918301830a6e53b1
Opcode Fuzzy Hash: 57d183f817150ec273e360e367ab56e2662b588d00195dc9d77f94c1e0a3eff7
Instruction Fuzzy Hash: EAD1D832A18B4286EB10EF62E4C46ADBB70FB94B9CF915032EA8D53665DF3CD584C710

Function 00007FF7C4038A2C Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7C4038A3B

Part of subcall function 00007FF7C4038638: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7C403865A

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7C4038A50
__scrt_release_startup_lock.LIBCMT ref: 00007FF7C4038ABE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7C4038B11
__scrt_is_managed_app.LIBCMT ref: 00007FF7C4038B34

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock
String ID:
API String ID: 4144305933-0
Opcode ID: 7138c5c5c74faf1bf17974996c6e54c09794ee1c4a732ecb393a2382692d3021
Instruction ID: 9ea36375212e818e94d7fad7ea693139322397728347a15187c2da414ffb5d8b
Opcode Fuzzy Hash: 7138c5c5c74faf1bf17974996c6e54c09794ee1c4a732ecb393a2382692d3021
Instruction Fuzzy Hash: 83316D62E8860341FA14BF2796D23B9AAD1BF413ACFC654F5D94D0B2D3DE2CE4848234

Function 00007FF7C40E62F4 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 201COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00007FF7C40E657A
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF7C40E65AD

Strings

d:\dbs\sh\odct\0223_153807_0\cmd\1k\client\onedrive\Product\UpdateRingSettings\UpdateRingSettingsManager.cpp, xrefs: 00007FF7C40E6554
UpdateRingSettingsManager::ApplyRampOverrides, xrefs: 00007FF7C40E6548

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: UpdateRingSettingsManager::ApplyRampOverrides$d:\dbs\sh\odct\0223_153807_0\cmd\1k\client\onedrive\Product\UpdateRingSettings\UpdateRingSettingsManager.cpp
API String ID: 17069307-3830362791
Opcode ID: ba887e6362c2516b28591cffdac90769e83cfc55b7cddffc49f6c846d6d31dd3
Instruction ID: a971095a49f18e3ecbe2998b39a1e9cf3f6b679f25643bd7ce9b472d1fa53dc5
Opcode Fuzzy Hash: ba887e6362c2516b28591cffdac90769e83cfc55b7cddffc49f6c846d6d31dd3
Instruction Fuzzy Hash: D791D322B58A8595EB10EF66E4C00EDB771FB84758FC11032EA8E53AA9DF3CD995C710

Function 00007FF7C4088E50 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 187COMMON

Download Yara Rule

Strings

ios_base::failbit set, xrefs: 00007FF7C4089073
ios_base::badbit set, xrefs: 00007FF7C4089067
ios_base::eofbit set, xrefs: 00007FF7C408907A

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID:
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 0-1866435925
Opcode ID: 87714f46442f176217039e32116a0ddcfafe3d8b16a52a7ecf97f7fcb6cd7d3d
Instruction ID: aa1319c6950c35daf58df4396e55ee338b98553db4b72b532699235f087c9099
Opcode Fuzzy Hash: 87714f46442f176217039e32116a0ddcfafe3d8b16a52a7ecf97f7fcb6cd7d3d
Instruction Fuzzy Hash: FC719B23648A4585DB10EF0AD6C027CA762FB84FA8B968172DE4D477A6CF3DD881D360

Function 00007FF7C4065DD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 131COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4065E78

Strings

Chk, xrefs: 00007FF7C4065E84
!ERROR! (0x%08X) , xrefs: 00007FF7C4065F3E
gfffffff, xrefs: 00007FF7C4065E0B

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: !ERROR! (0x%08X) $Chk$gfffffff
API String ID: 3668304517-404882245
Opcode ID: 94933b167fa7cb938bf16d4f0f5a34dedb9e2272ef9a79088a4ac39beb586fed
Instruction ID: 0bee386de38aa8e32288728072a840664a58c18aa8ec3bfeddd162ab05ae6239
Opcode Fuzzy Hash: 94933b167fa7cb938bf16d4f0f5a34dedb9e2272ef9a79088a4ac39beb586fed
Instruction Fuzzy Hash: F251B562B58A8262FA10AF13F4803E9D350EB847B8FC54475DF4E47A85DF7CE5858721

Function 00007FF7C4085BE8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C408642C: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C4086458

std::ios_base::failure::failure.LIBCPMT ref: 00007FF7C4085DBE

Strings

ios_base::failbit set, xrefs: 00007FF7C4085D92
ios_base::badbit set, xrefs: 00007FF7C4085D86
ios_base::eofbit set, xrefs: 00007FF7C4085D99

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: LockitLockit::_std::_std::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1478341485-1866435925
Opcode ID: f9d2e84a63df5cbfce4b6b53e26713151c0e05150a0695005156167181ad00f4
Instruction ID: 1d51beb251c788be195ba41f75d73f07c4e0260306b7030e977d2c13696b624d
Opcode Fuzzy Hash: f9d2e84a63df5cbfce4b6b53e26713151c0e05150a0695005156167181ad00f4
Instruction Fuzzy Hash: 36519A72608B8582DB20EF1AE5C02A9F760FB84BA8F958036DB8D47B65DF7DD485C710

Function 00007FF7C40E6630 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00007FF7C40E6724
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF7C40E679D

Strings

d:\dbs\sh\odct\0223_153807_0\cmd\1k\client\onedrive\Product\UpdateRingSettings\UpdateRingSettingsManager.cpp, xrefs: 00007FF7C40E66AE
UpdateRingSettingsManager::ApplySettingsOverrides, xrefs: 00007FF7C40E66A2

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: UpdateRingSettingsManager::ApplySettingsOverrides$d:\dbs\sh\odct\0223_153807_0\cmd\1k\client\onedrive\Product\UpdateRingSettings\UpdateRingSettingsManager.cpp
API String ID: 17069307-752743626
Opcode ID: 40f6a16484bc96071de589d7d75a9e541dbf9f9eeb885bfdb1df9a089e7509ae
Instruction ID: 562c6a54cdec272aca19715a18bf66b0db0ecd6bd8e1e2cf5e08a24c98c37123
Opcode Fuzzy Hash: 40f6a16484bc96071de589d7d75a9e541dbf9f9eeb885bfdb1df9a089e7509ae
Instruction Fuzzy Hash: 5F515222B54A0585FF00AF22D4903BCA7A1FB48B9CF894475CA4D17795DF3CE991C364

Function 00007FF7C40A03E4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C40A04C5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C40A04CB

Strings

DeviceHealth::ScoreRecorder::Initialize, xrefs: 00007FF7C40A04FF
d:\dbs\sh\odct\0223_153807_0\cmd\o\client\onedrive\Product\Logging\HealthScoreRecorder.cpp, xrefs: 00007FF7C40A050B

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: DeviceHealth::ScoreRecorder::Initialize$d:\dbs\sh\odct\0223_153807_0\cmd\o\client\onedrive\Product\Logging\HealthScoreRecorder.cpp
API String ID: 3668304517-3147790837
Opcode ID: a8a6e27a6bef2a6b4dd8401e3530a5e022f3669b3e2b2d08a84b601a2dab8951
Instruction ID: 2b6c958a4b4cce869c9298954970c97ba8112c6ac2b410ef7762f5eba792d04b
Opcode Fuzzy Hash: a8a6e27a6bef2a6b4dd8401e3530a5e022f3669b3e2b2d08a84b601a2dab8951
Instruction Fuzzy Hash: 3D41BE62A54A4A85FB00AF66D8843ADA371FB85BBCF911235DA5C066D6DF3CD4C0C320

Function 00007FF7C40954F0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111COMMON

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 00007FF7C409567E

Strings

ios_base::failbit set, xrefs: 00007FF7C4095652
ios_base::badbit set, xrefs: 00007FF7C4095646
ios_base::eofbit set, xrefs: 00007FF7C4095659

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: std::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2264918676-1866435925
Opcode ID: 7a919d8a825dafe9a351aa55b289e998eddbaa0a7f4385a493efb2bdf812f25c
Instruction ID: dde6d80443478ed853ad8e2f19e00ef10bf714be804956ef1889438adc4e68fd
Opcode Fuzzy Hash: 7a919d8a825dafe9a351aa55b289e998eddbaa0a7f4385a493efb2bdf812f25c
Instruction Fuzzy Hash: 5451CE32645B8585EB10DF16E9C57A8B3A1FB84BACF9A8135CA0D47760DF3ED146C340

Function 00007FF7C4124240 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE ref: 00007FF7C4136DCB
FreeLibrary.KERNELBASE ref: 00007FF7C4136E56

Strings

WofIsExternalFile, xrefs: 00007FF7C4136DE9
wofutil.dll, xrefs: 00007FF7C4136DAD

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Library$FreeLoad
String ID: WofIsExternalFile$wofutil.dll
API String ID: 534179979-1578866952
Opcode ID: 74b2b2c819f6d5cf1847ea2736576c82eedb666c69edd6b7fe44470a726a7b9b
Instruction ID: 22dab665970168b5f7032cdcfb113a48df8fa11d4e3a8810ea82c23baa5f584d
Opcode Fuzzy Hash: 74b2b2c819f6d5cf1847ea2736576c82eedb666c69edd6b7fe44470a726a7b9b
Instruction Fuzzy Hash: 6E212B71B18B4582EB60AF17E88016AA3A1EB98FA8F845136DD4D57764CF3DE445C710

Function 00007FF7C4016228 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 63COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4016263

Strings

D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdater.cpp, xrefs: 00007FF7C4016303
StandaloneUpdater, xrefs: 00007FF7C40162A4
StandaloneUpdater::HandleChinaTypeApproval, xrefs: 00007FF7C40162F4

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource
String ID: D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdater.cpp$StandaloneUpdater$StandaloneUpdater::HandleChinaTypeApproval
API String ID: 628915230-1525699153
Opcode ID: c91feb166604a7cc0378e5acb3ca1e2e53f7663bd691e564398c4a7cac623b0b
Instruction ID: 383783130230c4e73c9260d257616167c525206debb52cfddbded7412c69753c
Opcode Fuzzy Hash: c91feb166604a7cc0378e5acb3ca1e2e53f7663bd691e564398c4a7cac623b0b
Instruction Fuzzy Hash: 25317122A18B8586EB50EF16E8C1369A7A0FBD57A9F854075E98D43765CF3CD045CB20

Function 00007FF7C410E590 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE ref: 00007FF7C410E613
RegDeleteValueW.KERNELBASE ref: 00007FF7C410E631
RegCloseKey.KERNELBASE ref: 00007FF7C410E64F

Strings

Software\Microsoft\OneDrive, xrefs: 00007FF7C410E59C

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\OneDrive
API String ID: 849931509-3283851750
Opcode ID: 32d9244246d1992a65adcc5ad3f9ad6a620cd7300ab76fa773eb912995376f28
Instruction ID: 62323fc965dcc8d488d792aad7b5664aa6e80c7adc8ba32ad362fdba0c293f15
Opcode Fuzzy Hash: 32d9244246d1992a65adcc5ad3f9ad6a620cd7300ab76fa773eb912995376f28
Instruction Fuzzy Hash: AB21A472714B4582EB109F27F9C5A2AA7B1FB89BD8F905036DE4D83B24DE2DD494C710

Function 00007FF7C411AF40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE ref: 00007FF7C411AF9F
RegSetValueExW.KERNELBASE ref: 00007FF7C411AFDE
RegCloseKey.ADVAPI32 ref: 00007FF7C411AFEB

Strings

UpdateDescriptionXml, xrefs: 00007FF7C411AF42

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CloseCreateValue
String ID: UpdateDescriptionXml
API String ID: 1818849710-2514070205
Opcode ID: cf0b3a7420e4d22434441805a8ba46aa01c8c67b2242518831d03f8621292be2
Instruction ID: 68b7bd25819016c239b0115bc6e1be3903d28d16e7d775d493a0a47fb7f12159
Opcode Fuzzy Hash: cf0b3a7420e4d22434441805a8ba46aa01c8c67b2242518831d03f8621292be2
Instruction Fuzzy Hash: 70219273A18A4282E7609F62E48576AB7A0FB84BE8F444135EE8C46654CF7CC1958B50

Function 00007FF7C40E2720 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C4110D90: GetLastError.KERNEL32 ref: 00007FF7C4110E06
Part of subcall function 00007FF7C4110D90: StringFromGUID2.OLE32 ref: 00007FF7C4110E40

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C40E276B

Part of subcall function 00007FF7C4065BC0: EnterCriticalSection.KERNEL32(?,?,6666666666666667,?,00000000,00007FF7C40656B4), ref: 00007FF7C4065BE5
Part of subcall function 00007FF7C4065BC0: LeaveCriticalSection.KERNEL32 ref: 00007FF7C4065C08

Strings

UpdateRingSettingsDownloader, xrefs: 00007FF7C40E279A, 00007FF7C40E27C1
Failed to set machine ID, no need to download settings. Machine ID: %ls, xrefs: 00007FF7C40E27BA
Update settings. hresult = %x, xrefs: 00007FF7C40E2793

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CriticalSection$Aligned_get_default_resourceEnterErrorFromLastLeaveString
String ID: Failed to set machine ID, no need to download settings. Machine ID: %ls$Update settings. hresult = %x$UpdateRingSettingsDownloader
API String ID: 412170431-2296922706
Opcode ID: 119f6e13fb46291855f4127d67f527a38a63b138703d1cf0f9a7a0489a95b6f6
Instruction ID: 016eef4fc69ceaf49bf0bd0da408ad9d881c00d9a94e35aa7a59e8a503214ec1
Opcode Fuzzy Hash: 119f6e13fb46291855f4127d67f527a38a63b138703d1cf0f9a7a0489a95b6f6
Instruction Fuzzy Hash: 2C219262B28A8696EB00AF56F4804A9A370FBC8BA8FC11036FE8D43655DF3CD545C710

Function 00007FF7C4116AA8 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 48COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4116AE3

Strings

OneDriveSetup.exe, xrefs: 00007FF7C4116B07
OneDriveUpdaterService.exe, xrefs: 00007FF7C4116B3B
OneDriveStandaloneUpdater.exe, xrefs: 00007FF7C4116B21

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource
String ID: OneDriveSetup.exe$OneDriveStandaloneUpdater.exe$OneDriveUpdaterService.exe
API String ID: 628915230-2437466349
Opcode ID: 38b2820c0630f54c051373c87e7e1680c98f506226e1634054b6403dfa50633a
Instruction ID: 15a84f4c26d4a2168ca76ee02e2aff21fc7a089c9a5e40bcdab0d83d2e6c7d8a
Opcode Fuzzy Hash: 38b2820c0630f54c051373c87e7e1680c98f506226e1634054b6403dfa50633a
Instruction Fuzzy Hash: 93219252A0D7C352EB10BF32E8D1165A770BBC576CFC50179E98C561A6DFACE244C724

Function 00007FF7C405DD74 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF7C405DD14), ref: 00007FF7C405DE97
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF7C405DD14), ref: 00007FF7C405DF21

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: c22c136ad7da4be2a86e7befceb2637fd3ceef22e23df49dd2282a87cdc296e8
Instruction ID: 5b48207cf6c6c61e5bd601d7e052a14638f87f0059f70360e0824f32c4a2424e
Opcode Fuzzy Hash: c22c136ad7da4be2a86e7befceb2637fd3ceef22e23df49dd2282a87cdc296e8
Instruction Fuzzy Hash: 3091F132E58A1285FB50AF6694C06BDA7A1FF44BACF858176DE0E13694CF38E0C1D724

Function 00007FF7C41102EC Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION ref: 00007FF7C4110357
GetFileVersionInfoW.VERSION ref: 00007FF7C411039B
VerQueryValueW.VERSION ref: 00007FF7C41103BD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4110571

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1927219033-0
Opcode ID: db13498da46a2c7ece3ec984e49cebe1a310b38b8b5eb059d1b85ab52139e8a4
Instruction ID: 564922708f007d8c145eb409c1421d4397f12dbf16d532a6d272e5267b4299f3
Opcode Fuzzy Hash: db13498da46a2c7ece3ec984e49cebe1a310b38b8b5eb059d1b85ab52139e8a4
Instruction Fuzzy Hash: E791A662E18B8182EB10DF35D5812BDA770FB95B9CF51A221DE8C539A6DF38E1D5C700

Function 00007FF7C4134FFC Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF7C413507E

Strings

', xrefs: 00007FF7C413503F
MachineId, xrefs: 00007FF7C4135047
Software\Microsoft\SQMClient, xrefs: 00007FF7C4135055

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ErrorLast
String ID: '$MachineId$Software\Microsoft\SQMClient
API String ID: 1452528299-1507667817
Opcode ID: 9527abf31fd9fbf22428c0eba52a235ea669481e82987c677b9db191330cc292
Instruction ID: 369bd49444c5bd9c896ba8970c453d8913f30c79c11dea8aa57d44f6350c7c87
Opcode Fuzzy Hash: 9527abf31fd9fbf22428c0eba52a235ea669481e82987c677b9db191330cc292
Instruction Fuzzy Hash: C211A92171864186EB50EF26F5853B9B391FF84B68FC00135D98D83696DF3CD5088B50

Function 00007FF7C41350A8 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF7C413512A

Strings

UserId, xrefs: 00007FF7C41350F3
', xrefs: 00007FF7C41350EB
Software\Microsoft\SQMClient, xrefs: 00007FF7C4135101

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ErrorLast
String ID: '$Software\Microsoft\SQMClient$UserId
API String ID: 1452528299-1208274305
Opcode ID: 7028caa977fdf96f92654840885df27c2a8bab7bf6cf4ae10f73bc11007d4a44
Instruction ID: 4cd41a50ff9220cbcb6806530a4b5fdb3bcac1645e158ec4895c60f4b3a920eb
Opcode Fuzzy Hash: 7028caa977fdf96f92654840885df27c2a8bab7bf6cf4ae10f73bc11007d4a44
Instruction Fuzzy Hash: 6D11A92171C64296EB50EF26F5913B9B391FF84BA8FC04135D98D83695DF7CD5088B10

Function 00007FF7C40E8E90 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C40E9113

Strings

d:\dbs\sh\odct\0223_153807_0\cmd\1k\client\onedrive\Product\UpdateRingSettings\UpdateRingSettingsManager.cpp, xrefs: 00007FF7C40E8F20
UpdateRingSettingsManager::TryUpdate, xrefs: 00007FF7C40E8F19

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: UpdateRingSettingsManager::TryUpdate$d:\dbs\sh\odct\0223_153807_0\cmd\1k\client\onedrive\Product\UpdateRingSettings\UpdateRingSettingsManager.cpp
API String ID: 3668304517-1924243555
Opcode ID: d33c9962e8118329a0de4bf8f0d9f473af4224b52c75f8d5e43379656e0b7b56
Instruction ID: 1b2c823d441ce200a7facea61a0f0f6462b7084b0cc6c6fe6ad7408b2246c95a
Opcode Fuzzy Hash: d33c9962e8118329a0de4bf8f0d9f473af4224b52c75f8d5e43379656e0b7b56
Instruction Fuzzy Hash: 3E810222F44A498AEB00BF72D4802BCA371BB45BBCF854171DE5D27695DE38E495C358

Function 00007FF7C4080EEC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 152fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF7C40810B3
GetLastError.KERNEL32 ref: 00007FF7C40810C6

Strings

invalid hash bucket count, xrefs: 00007FF7C4081045

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: invalid hash bucket count
API String ID: 1214770103-1101463472
Opcode ID: 0459557b1758c9892a8d412e3491ddb4900acb5f1b90690342782e9167a49da1
Instruction ID: 77287836be5acbdca183920cbe56efefd1d81a68f434bc34057c39fd2c79fbed
Opcode Fuzzy Hash: 0459557b1758c9892a8d412e3491ddb4900acb5f1b90690342782e9167a49da1
Instruction Fuzzy Hash: 9051AD33605B81C2D7009F12E9901ACB3A4FB48BB8B958235EBAD47796DF78D4A5C310

Function 00007FF7C4135C10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4135C7D

Strings

Software\Microsoft\Windows\CurrentVersion\DeviceAccess, xrefs: 00007FF7C4135CD6, 00007FF7C4135D9A
ActivePolicyCode, xrefs: 00007FF7C4135CAA, 00007FF7C4135D6E

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource
String ID: ActivePolicyCode$Software\Microsoft\Windows\CurrentVersion\DeviceAccess
API String ID: 628915230-3119669494
Opcode ID: 3acae6c7e7d20a13308c83eb941f20220a86f0bedeacf2f9722a5e590bb60590
Instruction ID: be8eb337adc0abf8a84772710be88b1d8b1aaefd918cbda786e2ada6269a64a3
Opcode Fuzzy Hash: 3acae6c7e7d20a13308c83eb941f20220a86f0bedeacf2f9722a5e590bb60590
Instruction Fuzzy Hash: 4E615032B14B429AEB10EF61E4801EC6375FB94B9CF815236EE4D53A99EF38D245C364

Function 00007FF7C40E01A0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C40649A8: EnterCriticalSection.KERNEL32 ref: 00007FF7C40649CD
Part of subcall function 00007FF7C40649A8: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00007FF7C4064414), ref: 00007FF7C40649F4

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C40E02E5

Strings

Downloaded file is too big: %lld bytes, xrefs: 00007FF7C40E0204
Failed to fetch data, xrefs: 00007FF7C40E0282

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CriticalSection$EnterLeave_invalid_parameter_noinfo_noreturn
String ID: Downloaded file is too big: %lld bytes$Failed to fetch data
API String ID: 2008198395-2480692681
Opcode ID: 91a22837ad8ec0b63f19964c41bac959b80edd4ee8bbed5e3e92b4042916a88b
Instruction ID: c16f84a3e639ea2d75d228eb009df02d4b189b7a10433fca7bc44403206debd3
Opcode Fuzzy Hash: 91a22837ad8ec0b63f19964c41bac959b80edd4ee8bbed5e3e92b4042916a88b
Instruction Fuzzy Hash: 3931A072B54A4589EB00AF77D4802ECA361AB88BACF954136EE0D57799DE3CD581C314

Function 00007FF7C4076D98 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

SHCreateDirectoryExW.SHELL32(?,?,?,?,?,?,00000000,?,?,00007FF7C407717D), ref: 00007FF7C4076EA3
CoTaskMemFree.OLE32(?,?,?,?,?,?,00000000,?,?,00007FF7C407717D), ref: 00007FF7C4076EC5

Strings

Microsoft\OneDrive\logs, xrefs: 00007FF7C4076DE8

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CreateDirectoryFreeTask
String ID: Microsoft\OneDrive\logs
API String ID: 701814230-1342002985
Opcode ID: 30d40df8687429ec63a985edcabe2bc3b9a1d7921f75a4115c69225b9d9ed251
Instruction ID: 57d7cd5ebfc4cbcebdf03d9c4c61076dc831383d4ef3a8dbe0a091276ab996d2
Opcode Fuzzy Hash: 30d40df8687429ec63a985edcabe2bc3b9a1d7921f75a4115c69225b9d9ed251
Instruction Fuzzy Hash: C441E622A08A4182EB10AF26D48127DB370FB547ACF854535DB4D47656DF3CF5E0C361

Function 00007FF7C411F868 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C411F8C7

Strings

Software\Microsoft\OneDrive, xrefs: 00007FF7C411F917
EnableFasterRingUpdate, xrefs: 00007FF7C411F8B6

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource
String ID: EnableFasterRingUpdate$Software\Microsoft\OneDrive
API String ID: 628915230-2463706878
Opcode ID: 2dd6d65cea684e73399aea0e189dbc3efa96bdd3bebc6524caaefdee2def031e
Instruction ID: 9784c905657db870539f12ffb5b180db94da4ef5009cee1df33a5bd5a199bb2a
Opcode Fuzzy Hash: 2dd6d65cea684e73399aea0e189dbc3efa96bdd3bebc6524caaefdee2def031e
Instruction Fuzzy Hash: 6E418C32E18B029AE710EF62D4912ACB370FB98B58F811036DA4C637A5DF38D64AC350

Function 00007FF7C4113F98 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7C4114007
StringFromGUID2.OLE32 ref: 00007FF7C4114058

Strings

00000000-0000-0000-0000-000000000000, xrefs: 00007FF7C4114025

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ErrorFromLastString
String ID: 00000000-0000-0000-0000-000000000000
API String ID: 3006059378-2169625225
Opcode ID: 34ef2f68a09a61820b4c2817cd890da18039c26a080f46f4e74543acaceb0fc1
Instruction ID: 172b857f991fb55883454cb63c817985a2abb3a89b18e6832faea5a7b3860c1e
Opcode Fuzzy Hash: 34ef2f68a09a61820b4c2817cd890da18039c26a080f46f4e74543acaceb0fc1
Instruction Fuzzy Hash: C5215221A1CA4642FA20BF17F8912FAA360FF94BA8FC05235EADE47596DF2CD144C750

Function 00007FF7C41244F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C42CCF90: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C42CCFA4

GetLongPathNameW.KERNELBASE ref: 00007FF7C4124567
StrStrIW.SHLWAPI ref: 00007FF7C4124579

Strings

CsiSyncClient.exe, xrefs: 00007FF7C41244F9

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: LongNamePath_invalid_parameter_noinfo
String ID: CsiSyncClient.exe
API String ID: 2490818102-1478280356
Opcode ID: 5f09272a820b5787a0241981bc3b370ed49144f4a83b6643df02407e9ee2b343
Instruction ID: a6fb7b9504c0dcebc88e5c43769d4206a6f3eb40dda05551986b72a4b541f8bd
Opcode Fuzzy Hash: 5f09272a820b5787a0241981bc3b370ed49144f4a83b6643df02407e9ee2b343
Instruction Fuzzy Hash: 7E11D651B1964242FE34BF13B8917B6D280AF84FA8FC40035DD8E47395FE3CE1428660

Function 00007FF7C411FC24 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C411FC49

Part of subcall function 00007FF7C401B694: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C401B6EF

Strings

Software\Microsoft\OneDrive, xrefs: 00007FF7C411FCAC
UpdateRingPostAuthConditions, xrefs: 00007FF7C411FC82

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource_invalid_parameter_noinfo_noreturn
String ID: Software\Microsoft\OneDrive$UpdateRingPostAuthConditions
API String ID: 4266926526-1747481121
Opcode ID: 0fd571bcdba47acaee44bd6feeabe7f12668f816fbea5d979bd084b9ce94cd7f
Instruction ID: fdc840c75f53c875aa194a05a93a801474e55d560fcb625d23a9b066b076f4f8
Opcode Fuzzy Hash: 0fd571bcdba47acaee44bd6feeabe7f12668f816fbea5d979bd084b9ce94cd7f
Instruction Fuzzy Hash: 8C21AE22F14B5299FB10EFA2E8806EC7374BB94758F815135DE4C67A69DF78D145C310

Function 00007FF7C41059E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE ref: 00007FF7C4105A4D

Strings

Software\Microsoft\OneDrive\Installer\BITS, xrefs: 00007FF7C4105A28
d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp, xrefs: 00007FF7C4105A75

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Create
String ID: Software\Microsoft\OneDrive\Installer\BITS$d:\dbs\sh\odct\0223_153807_0\cmd\m\client\onedrive\Setup\standalone\webclient\webclient.cpp
API String ID: 2289755597-2170662684
Opcode ID: 561e55094ef5e03da29d174d4485ab7789939f26d37239ad73716eff0a219b71
Instruction ID: 8e3d9cdc325251a575dd59cbd6ce2d2264257c62d57c8cc368678cec986bdea5
Opcode Fuzzy Hash: 561e55094ef5e03da29d174d4485ab7789939f26d37239ad73716eff0a219b71
Instruction Fuzzy Hash: 4B118162B18B8287E710AF56F4C127AF3A0FB88778F904639EA9D46A55DF7CD0548B10

Function 00007FF7C41123C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C4111B9C: _Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4111BA0

SHGetValueW.SHLWAPI ref: 00007FF7C4112435

Strings

Software\Microsoft\OneDrive, xrefs: 00007FF7C4112429
Version, xrefs: 00007FF7C411241D

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resourceValue
String ID: Software\Microsoft\OneDrive$Version
API String ID: 2543255588-344254544
Opcode ID: 316d76a3d0effa9c20cca153c0195670e9c1dd36ee62bd0f6ca5aad0db5aff17
Instruction ID: 734b7143736cc4991c1abd4d13beff566e87da080e7a16c3dbe1772423fbe0ca
Opcode Fuzzy Hash: 316d76a3d0effa9c20cca153c0195670e9c1dd36ee62bd0f6ca5aad0db5aff17
Instruction Fuzzy Hash: 7711662261CA8582EA10EF55F4C53AAB370FB85B68F801236EB9D03695DF3CD145CB10

Function 00007FF7C401C900 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 00007FF7C401C97E

Strings

D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\WebClientUpdateDownloader.cpp, xrefs: 00007FF7C401C93E
WebClientUpdateDownloader::OnDownloadFinished, xrefs: 00007FF7C401C92F

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Event
String ID: D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\WebClientUpdateDownloader.cpp$WebClientUpdateDownloader::OnDownloadFinished
API String ID: 4201588131-4285687176
Opcode ID: df334dddfe5031c2549479ef8661131533f6e47b096c33f3768104e3ed1a7c43
Instruction ID: 6d25f69bd13f6c7b10ddd0a6dd1faf9767da69343d225bfaf2b0f12a7324cc04
Opcode Fuzzy Hash: df334dddfe5031c2549479ef8661131533f6e47b096c33f3768104e3ed1a7c43
Instruction Fuzzy Hash: 54017572A1CA4186E720EF21E4923B9B7A0FB88369F800535E98D46695DF7CD148CB10

Function 00007FF7C407F570 Relevance: 4.7, APIs: 3, Instructions: 246COMMON

Download Yara Rule

APIs

_Mtx_unlock.LIBCPMT ref: 00007FF7C407F775
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C407F7A5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C407F91F

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Mtx_unlock
String ID:
API String ID: 3867719841-0
Opcode ID: 6d6b3e4155746caf47c0f523568494c76331a8f05d2c9096db2fff648c612de4
Instruction ID: 251032dcbed6d0a56a79bcd2811b87fa1b1692943a02070265fbec4b22b0a717
Opcode Fuzzy Hash: 6d6b3e4155746caf47c0f523568494c76331a8f05d2c9096db2fff648c612de4
Instruction Fuzzy Hash: AFA18172B48A8585EB50EF26E4803ADB7A1FB84BA8F854172DE5D437A5CF3CE491C710

Function 00007FF7C40872A0 Relevance: 4.7, APIs: 3, Instructions: 152timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C4038858: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C4038888
Part of subcall function 00007FF7C4038858: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C403888E
Part of subcall function 00007FF7C4038858: __GSHandlerCheckCommon.LIBCMT ref: 00007FF7C40388A2

GetSystemTime.KERNEL32 ref: 00007FF7C4087390
SystemTimeToFileTime.KERNEL32 ref: 00007FF7C408739E
CompareFileTime.KERNEL32 ref: 00007FF7C408741E

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Time$Concurrency::cancel_current_taskFileSystem$CheckCommonCompareHandler
String ID:
API String ID: 2357225875-0
Opcode ID: 308ed3bd1c0d3ff40e0db2f463adb552832af9fdaf42dfb905ab381cd85138d4
Instruction ID: 7e783cc2a68f85215ab65018ce4e3afa3ad18aeee8b821861c0fc4d142e133c1
Opcode Fuzzy Hash: 308ed3bd1c0d3ff40e0db2f463adb552832af9fdaf42dfb905ab381cd85138d4
Instruction Fuzzy Hash: A8618C32B04A419AEB00EF66D9801AC77B1FB48B9CB815076DE0E53758DF38D895C350

Function 00007FF7C410EA74 Relevance: 4.6, APIs: 3, Instructions: 129registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE ref: 00007FF7C410EB1F
RegEnumKeyExW.ADVAPI32 ref: 00007FF7C410EB6F
RegCloseKey.ADVAPI32 ref: 00007FF7C410EC26

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: 76036d0cb1828e072940a03cdf12fffab531da981f2086b2564bea9fc3c6c661
Instruction ID: 721f3a5713ff0e1b55cc3b8e0cd2420429f43059509906579cc08a2270328ae4
Opcode Fuzzy Hash: 76036d0cb1828e072940a03cdf12fffab531da981f2086b2564bea9fc3c6c661
Instruction Fuzzy Hash: 0241D536A08B8182E720AF17F98426AE7A0FB847ACF901136EE8D43794DF7DD485D710

Function 00007FF7C410EC54 Relevance: 4.6, APIs: 3, Instructions: 119registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE ref: 00007FF7C410ECE3
RegEnumValueW.ADVAPI32 ref: 00007FF7C410ED33
RegCloseKey.ADVAPI32 ref: 00007FF7C410EDEA

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CloseEnumOpenValue
String ID:
API String ID: 4012628704-0
Opcode ID: 5535cf94339a3f41eee311b4cbe2deb904bb1b88178c715e23694bf9c43b597e
Instruction ID: 8dcc9b3cd41712bc46dabaa236e3e0a94b5f902291a45154ce857da50b148221
Opcode Fuzzy Hash: 5535cf94339a3f41eee311b4cbe2deb904bb1b88178c715e23694bf9c43b597e
Instruction Fuzzy Hash: CF41A833A08B8183E6209F17F8842AAE3A0FB84BA8F914535DE9D07B94DF7CD555C710

Function 00007FF7C4140A9C Relevance: 4.6, APIs: 3, Instructions: 108COMMON

Download Yara Rule

APIs

shared_ptr.LIBCPMT ref: 00007FF7C4140B0C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4140BA8
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C4140BB4

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturnshared_ptr
String ID:
API String ID: 1838787889-0
Opcode ID: 48804624218ca76a882a9e3f9f7c02d2065f7ed42dfc5549bee531f95b8d48f9
Instruction ID: 0aa63469156604634a4c3334f6694884e4a4dafdc5be9ff38e96d935c4512bbb
Opcode Fuzzy Hash: 48804624218ca76a882a9e3f9f7c02d2065f7ed42dfc5549bee531f95b8d48f9
Instruction Fuzzy Hash: 09310662B0465246FD14FE23A4842BC96A5AB44FFCF995571DEAC07BC5EE3CE4828318

Function 00007FF7C414C0DC Relevance: 4.6, APIs: 3, Instructions: 91COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C414C100
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C414C1C1
std::_Locinfo::~_Locinfo.LIBCPMT ref: 00007FF7C414C215

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: std::_$Concurrency::cancel_current_taskLocinfoLocinfo::~_LockitLockit::_
String ID:
API String ID: 400335648-0
Opcode ID: 897e9a7f2828f84e3745df2b0885f2593a3bc68b42fe3aa68dd1e2fb0a6e7619
Instruction ID: 5cadeafdb12fb334bc8e457e6b463c0383d84aacf14c4f6ad0434a9010dc322d
Opcode Fuzzy Hash: 897e9a7f2828f84e3745df2b0885f2593a3bc68b42fe3aa68dd1e2fb0a6e7619
Instruction Fuzzy Hash: 6B416A26A08B4582EB14EF16E49026DA761FB88FD8F859532DE8D03B69EF3CD951C350

Function 00007FF7C42BDA84 Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C42BDAAB

Part of subcall function 00007FF7C42BDA38: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C42BDA4F

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C42BDB58
_local_unwind.LIBVCRUNTIME ref: 00007FF7C42BDB69

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_local_unwind
String ID:
API String ID: 1677304287-0
Opcode ID: 6fe01124587191e27233f4c75016b79927349169d73242d7148f3472c8829fbe
Instruction ID: de0cf0b36d1fc251d1b795065feecd7e5de3a00a786b9ef6da02546228b30934
Opcode Fuzzy Hash: 6fe01124587191e27233f4c75016b79927349169d73242d7148f3472c8829fbe
Instruction Fuzzy Hash: C521C531A2894681EA44FF16D4D22FCB360EB99BA8FC51271E90E473D1DE7DE545C320

Function 00007FF7C408642C Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C4086458

Part of subcall function 00007FF7C402DBAC: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C402DBD3

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C4086527

Part of subcall function 00007FF7C408715C: std::_Locinfo::~_Locinfo.LIBCPMT ref: 00007FF7C4087236

std::_Facet_Register.LIBCPMT ref: 00007FF7C40864DC

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_LocinfoLocinfo::~_Register
String ID:
API String ID: 2315694003-0
Opcode ID: 5cfb39fb0a01a8a0683c0257c668e4fccde2ac57817baf4d9bafa5adfa5bba71
Instruction ID: 6bbca65621841c54ce53988711664ca025a2358ad1c3f877187ac54ed41f9ee4
Opcode Fuzzy Hash: 5cfb39fb0a01a8a0683c0257c668e4fccde2ac57817baf4d9bafa5adfa5bba71
Instruction Fuzzy Hash: 7D318F26A49B4181EA14BF13E5C017DA760FB88FB8F8A1575DA5D077A5DE3CE481C320

Function 00007FF7C411262C Relevance: 4.6, APIs: 3, Instructions: 70registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,00000000,?,?,00007FF7C400FDCD), ref: 00007FF7C4112692
RegQueryValueExW.KERNELBASE ref: 00007FF7C41126E0
RegCloseKey.KERNELBASE ref: 00007FF7C4112713

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 987b7138fe94a6851b97319996b35f0643cb5bdc09944c6e770f5c79a8db5598
Instruction ID: 18267f327a2d6aebfb8471abf430caa3ae6077f3112be16a24f08b6dea5961e3
Opcode Fuzzy Hash: 987b7138fe94a6851b97319996b35f0643cb5bdc09944c6e770f5c79a8db5598
Instruction Fuzzy Hash: B021A232728B5286EB209F26F4C461BB2B0FB85B98F901136EB8D43A54DE3DD5548B20

Function 00007FF7C4112730 Relevance: 4.6, APIs: 3, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,00000000,?,00000000,00007FF7C40E2B03), ref: 00007FF7C4112787
RegQueryValueExW.KERNELBASE ref: 00007FF7C41127D5
RegCloseKey.ADVAPI32 ref: 00007FF7C411280A

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 5047a86c199932b5af0a7911cf9a30ca49b67aa1e8f684d0206cfdbfec1a6a05
Instruction ID: 1f56beb113c16c6bf5164e8877cdf308751b745c90b1f905d52c819d48cdfa95
Opcode Fuzzy Hash: 5047a86c199932b5af0a7911cf9a30ca49b67aa1e8f684d0206cfdbfec1a6a05
Instruction Fuzzy Hash: 5D21A632A18B4286EB209F16F4C462AB3F0FB48BA9F905135EB8D47754DF3DD4558B20

Function 00007FF7C402EE70 Relevance: 4.6, APIs: 3, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF7C402EEC9
RegQueryValueExW.KERNELBASE ref: 00007FF7C402EF17
RegCloseKey.ADVAPI32 ref: 00007FF7C402EF4A

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 9c33a27fa1d419cd47717bba867c6a458436254db0b5b9f138c9db466695d678
Instruction ID: 2fb2bd0f3dc50b22b5a59ec8c4c2a2d571217a93d4065ef330c91d57be2634d6
Opcode Fuzzy Hash: 9c33a27fa1d419cd47717bba867c6a458436254db0b5b9f138c9db466695d678
Instruction Fuzzy Hash: CB21C732758B4286EB609F16F4C466AB7E0FB897A8F800136EB8D47B54DE3CD054CB50

Function 00007FF7C4028F30 Relevance: 4.6, APIs: 3, Instructions: 64COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4028F68
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4028F7A
PathFileExistsW.KERNELBASE ref: 00007FF7C4028FD0

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource$ExistsFilePath
String ID:
API String ID: 2289898590-0
Opcode ID: d8a21661d1f567ad713d53faa6c69bd0ec26cdbde39bb947187881bd5eb12523
Instruction ID: d351a14ede40f3bee1a0b96ceee573e5fbdcad8e9bc8b24b4c127c9767a1262d
Opcode Fuzzy Hash: d8a21661d1f567ad713d53faa6c69bd0ec26cdbde39bb947187881bd5eb12523
Instruction Fuzzy Hash: 7B215236A08F4682EB20AF17E4C416DA361FB88F98F944232EA8D47764DF3DD541C710

Function 00007FF7C4135154 Relevance: 4.6, APIs: 3, Instructions: 64registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE ref: 00007FF7C41351B7
RegQueryValueExW.KERNELBASE ref: 00007FF7C41351E2
RegCloseKey.KERNELBASE ref: 00007FF7C4135203

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 571d7be88da916435b1834045258c9542402878e43f99d626120bfe0add84d47
Instruction ID: 8cb60d71550bf0434916adbd7e9753375accedc3f0e43a68e9fda0e4480ad194
Opcode Fuzzy Hash: 571d7be88da916435b1834045258c9542402878e43f99d626120bfe0add84d47
Instruction Fuzzy Hash: 5F21972671974587E760DF52B89057AB3E0EB44FA8F841131EE8D43A14EF3CD544CB10

Function 00007FF7C402F220 Relevance: 4.6, APIs: 3, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE ref: 00007FF7C402F28C
RegSetValueExW.KERNELBASE ref: 00007FF7C402F2D0
RegCloseKey.ADVAPI32 ref: 00007FF7C402F2DD

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: aded8b8a11ba7c276ec9837d47961e10a92c73dba9c669fb721afac7271ce716
Instruction ID: f1207abc3581070932cd1a21af56d7ae2ab1d3fad1ed857f6f5ba0ce5f7f68d8
Opcode Fuzzy Hash: aded8b8a11ba7c276ec9837d47961e10a92c73dba9c669fb721afac7271ce716
Instruction Fuzzy Hash: 8621B832A18A8582EB609F52F48436AF3A0FBC5BECF544135DA4D47758CF3CC0588B50

Function 00007FF7C414C1C8 Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C414C226

Part of subcall function 00007FF7C402D904: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C402D91B
Part of subcall function 00007FF7C402D904: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7C402D95A

Part of subcall function 00007FF7C414C3FC: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C414C449
Part of subcall function 00007FF7C414C3FC: _Getctype.LIBCPMT ref: 00007FF7C414C4A6
Part of subcall function 00007FF7C414C3FC: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C414C552
Part of subcall function 00007FF7C414C3FC: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C414C5CC

std::_Locinfo::~_Locinfo.LIBCPMT ref: 00007FF7C414C215
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C414C299

Part of subcall function 00007FF7C4038140: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7C4038149

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskGetctypeLocinfoLocinfo::_Locinfo::~_Locinfo_ctorstd::bad_alloc::bad_alloc
String ID:
API String ID: 1625665728-0
Opcode ID: db2911422380c632175408739cb0f9d9dd673d901138753845d45aec4756bf97
Instruction ID: 1566b1274e3e2a1e47360a39f4341e8ab1777cf943c26c42b51aaaa019f5a9c2
Opcode Fuzzy Hash: db2911422380c632175408739cb0f9d9dd673d901138753845d45aec4756bf97
Instruction Fuzzy Hash: FC217126609A4692EA60EF52F4D06B9A360FF84B98F855531DA8D03B65EF3CE950C720

Function 00007FF7C4038858 Relevance: 4.5, APIs: 3, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C4038888

Part of subcall function 00007FF7C4038140: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7C4038149

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C403888E
__GSHandlerCheckCommon.LIBCMT ref: 00007FF7C40388A2

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Concurrency::cancel_current_task$CheckCommonHandlerstd::bad_alloc::bad_alloc
String ID:
API String ID: 578624868-0
Opcode ID: 84b5d08723c792a72248bd953c951071d923513f621b148705325d60b2f4c97c
Instruction ID: 56727eb7ccc53fd37762378d94f8a562b76e718e73aa4ba1e99e0f7738edad83
Opcode Fuzzy Hash: 84b5d08723c792a72248bd953c951071d923513f621b148705325d60b2f4c97c
Instruction Fuzzy Hash: CDE03052E9914341FD5C7FB305861B485902F597F8EDA16F0ED3D063C2EE0CE5D18660

Function 00007FF7C4024BCC Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 288COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32 ref: 00007FF7C4024DB9

Part of subcall function 00007FF7C41102EC: GetFileVersionInfoSizeW.VERSION ref: 00007FF7C4110357
Part of subcall function 00007FF7C41102EC: GetFileVersionInfoW.VERSION ref: 00007FF7C411039B
Part of subcall function 00007FF7C41102EC: VerQueryValueW.VERSION ref: 00007FF7C41103BD

Strings

\OneDriveSetup.exe, xrefs: 00007FF7C4024E01

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: FileInfoVersion$FolderPathQuerySizeSpecialValue
String ID: \OneDriveSetup.exe
API String ID: 1814992152-3077312612
Opcode ID: e35f0874c524c9a54ba95860ee363a254550973427a80d986ed0578d9fd3e349
Instruction ID: 927461f5f38c5cdc1092ff2698af48a57c34d7e5e7fdb2b29710c59c734e7e28
Opcode Fuzzy Hash: e35f0874c524c9a54ba95860ee363a254550973427a80d986ed0578d9fd3e349
Instruction Fuzzy Hash: 22D1AD73605B4586DB60DF2AD98026DB3B4FB48FA8B568126CE5C53BA4DF3CE891C350

Function 00007FF7C4139968 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 182COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C4139BF4

Strings

gfffffff, xrefs: 00007FF7C413998D

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: gfffffff
API String ID: 118556049-1523873471
Opcode ID: aaf06d691201b316cb0a75739cd8089afc561bff66ceabfb1394e48e1df54b50
Instruction ID: 355eb4c1420643ffa67bb370a2ab3272bf3d39aeaae08c6a8cdb4a430a7909c5
Opcode Fuzzy Hash: aaf06d691201b316cb0a75739cd8089afc561bff66ceabfb1394e48e1df54b50
Instruction Fuzzy Hash: E071F5B3B18B8582DA10DF1AF58846DB3A8FB58BD8B519226DF9D87750DF38E190C300

Function 00007FF7C414591C Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF7C4145B28

Strings

bad conversion, xrefs: 00007FF7C4145B21

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: bad conversion
API String ID: 909987262-2629740042
Opcode ID: 08b8b637e1ef0ffd60f1d62ffb69fb264ecce0c716dfe29943364dda724ac44e
Instruction ID: 8549cefada984ed70777b38bc7a06851b821e15ee294f944e3cbd659b6877d85
Opcode Fuzzy Hash: 08b8b637e1ef0ffd60f1d62ffb69fb264ecce0c716dfe29943364dda724ac44e
Instruction Fuzzy Hash: 55618B22B14B459AE710EFA2E4801AD73B5FB44B6CF905025DF8D13A94EF38D569C354

Function 00007FF7C4077024 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

PathIsRelativeW.SHLWAPI ref: 00007FF7C407714B

Strings

Common, xrefs: 00007FF7C40770FB

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: PathRelative
String ID: Common
API String ID: 1021466915-3795875175
Opcode ID: f77da248145983928a9af540ca05c0cc98d414fe47319e63f26ceb968230cfae
Instruction ID: 394fda0bc42b0678954ab9ffc87a0277514d46798ca8b149a858977fcea3ca2e
Opcode Fuzzy Hash: f77da248145983928a9af540ca05c0cc98d414fe47319e63f26ceb968230cfae
Instruction Fuzzy Hash: B3617D22F4868189E710EFA6D8802AC77B1FB457ACF811075DE4E6BB69DF38E449C350

Function 00007FF7C412FE98 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 151COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C41300C5

Strings

gfffffff, xrefs: 00007FF7C412FEC2

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: gfffffff
API String ID: 118556049-1523873471
Opcode ID: da01ae192f33f6329a4d01478e68d8cfb8486efb935b6df04ae80f15bc066f32
Instruction ID: 3e01e316f6ae57fe5671b436eff0c2b3061c7924300ae5489058652c6e1e690f
Opcode Fuzzy Hash: da01ae192f33f6329a4d01478e68d8cfb8486efb935b6df04ae80f15bc066f32
Instruction Fuzzy Hash: 6851D422A04B8983D660DF26F980269B3A0F748BE8F549125EFDD53B55EF38E185D301

Function 00007FF7C40A5C78 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

std::_Hash_seq.LIBCPMT ref: 00007FF7C40A5C9D

Strings

unordered_map/set too long, xrefs: 00007FF7C40A5E2F

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Hash_seqstd::_
String ID: unordered_map/set too long
API String ID: 1492732761-306623848
Opcode ID: 029ef4cb25c6206ee7907666c3dbdfe142d820341cede23331935b3dbe97df31
Instruction ID: 7000407cece5998a9561dc02bc7edc8232b276d9cb70a9df3f8a4dadfd8b3728
Opcode Fuzzy Hash: 029ef4cb25c6206ee7907666c3dbdfe142d820341cede23331935b3dbe97df31
Instruction Fuzzy Hash: 3351F363659B4582EA24AF57E08027CB360FF88BE8F998532DE4E17755DF3CE1918320

Function 00007FF7C408676C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C4050184: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7C4050198

GetCurrentProcessId.KERNEL32 ref: 00007FF7C4086867

Strings

%Y-%m-%d.%H%M, xrefs: 00007FF7C408682D

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Time$CurrentFileProcessSystem
String ID: %Y-%m-%d.%H%M
API String ID: 2307650585-1379819877
Opcode ID: 00358643d3f73428f411666e1901820eea312d2db20b01d83f188d314e8ebf8f
Instruction ID: 849fa7b1246c3dfeebd8ad06c320ac580177a8d411143cdc742794cbcca25535
Opcode Fuzzy Hash: 00358643d3f73428f411666e1901820eea312d2db20b01d83f188d314e8ebf8f
Instruction Fuzzy Hash: A641A422A48A4291EB20FF52E8812EDB760FF857A8FC15036EA4D476A5DF3CD585C750

Function 00007FF7C4125438 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412544E

Strings

Software\Microsoft\RDInfraAgent, xrefs: 00007FF7C4125478

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource
String ID: Software\Microsoft\RDInfraAgent
API String ID: 628915230-1656033187
Opcode ID: 485e5e2662def4e13307c9d88d03b02b218f023320d276624961288b31bde128
Instruction ID: 66390805caf09d0fd750247c52c31143a63bc899b1df3bb390b006b950bc5243
Opcode Fuzzy Hash: 485e5e2662def4e13307c9d88d03b02b218f023320d276624961288b31bde128
Instruction Fuzzy Hash: A1015232A28B8196DB009F16E48009EB370FB84B94F845225FB8D53B9ADF3CD105CB40

Function 00007FF7C4064F8C Relevance: 3.2, APIs: 2, Instructions: 159fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C4064B6C: EnterCriticalSection.KERNEL32 ref: 00007FF7C4064BC8
Part of subcall function 00007FF7C4064B6C: LeaveCriticalSection.KERNEL32 ref: 00007FF7C4064C52

Part of subcall function 00007FF7C4064D10: EnterCriticalSection.KERNEL32 ref: 00007FF7C4064D59
Part of subcall function 00007FF7C4064D10: _Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4064D99
Part of subcall function 00007FF7C4064D10: SHGetFolderPathW.SHELL32 ref: 00007FF7C4064DF7

CreateFileW.KERNELBASE ref: 00007FF7C4065174
GetLastError.KERNEL32 ref: 00007FF7C4065189

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CriticalSection$Enter$Aligned_get_default_resourceCreateErrorFileFolderLastLeavePath
String ID:
API String ID: 2826797238-0
Opcode ID: 90bd16fff8ac0a4754d0e071c97363f575fe83fcc3b6586f31f010bfe3450a01
Instruction ID: 8c956c6f1be5fef8fb69249212a5ed01b156635f8389ff7dc32f627a6715734c
Opcode Fuzzy Hash: 90bd16fff8ac0a4754d0e071c97363f575fe83fcc3b6586f31f010bfe3450a01
Instruction Fuzzy Hash: 4A717032B58B8295FB00DF66E8802E9A3A4FB947ACF910136DE4D57A95DF3CE584C710

Function 00007FF7C4071CA0 Relevance: 3.1, APIs: 2, Instructions: 121registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE ref: 00007FF7C4071D25
RegCloseKey.ADVAPI32 ref: 00007FF7C4071E22

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: c9b898542888d0d6629e1275e2cf395d777ecab5d06fa451b5648c931f9c77e2
Instruction ID: 13f4a3b0317048d95cb98b634f9fa93fc86f6ccdb7049ad51fa131003fbe9e16
Opcode Fuzzy Hash: c9b898542888d0d6629e1275e2cf395d777ecab5d06fa451b5648c931f9c77e2
Instruction Fuzzy Hash: 1651A322B54A8299F710EF72E4811FCA3B1BB9476CF814531EE4D56A9ADF38D584C350

Function 00007FF7C401A488 Relevance: 3.1, APIs: 2, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C401A5ED
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C401A5F9

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 38d3b42bab1e8fcd92fc5d5db9615c84184a78f71e1ce146a9ad9010599ad38d
Instruction ID: 202525f8ccbbd1bfadbd86b596cb91962db8e34c7c044565ddc2fa14b8c7055f
Opcode Fuzzy Hash: 38d3b42bab1e8fcd92fc5d5db9615c84184a78f71e1ce146a9ad9010599ad38d
Instruction Fuzzy Hash: 18411923B4864255EE14BF2799852B9A261BF44BF8F850672DE2E477D1EE3CE0C18710

Function 00007FF7C414409C Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4144210
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4144216

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 64e159eec5ba67525ac31ea5e6e38ee7a2dc667cd3b5c9a182241cb9c5b4b3c1
Instruction ID: 74a9d41788c97d4328a08bcd845a350de8f1be3b6d68e803c2696847cfac5448
Opcode Fuzzy Hash: 64e159eec5ba67525ac31ea5e6e38ee7a2dc667cd3b5c9a182241cb9c5b4b3c1
Instruction Fuzzy Hash: 6541C262B1466246FF00AF6BA8853ACA361AB55FFCF841631DE1C177C5EF38E4828350

Function 00007FF7C40A7268 Relevance: 3.1, APIs: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C40A7308
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C40A73AE

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 94b301dab37ccdcd7c436ec9dfde98726f86b6323355a47e008ff0cbc47d1e02
Instruction ID: 8a2cfcb68d0dca5c5672d264c34f1a7b726db889e15be6dc81a4504f60055f5a
Opcode Fuzzy Hash: 94b301dab37ccdcd7c436ec9dfde98726f86b6323355a47e008ff0cbc47d1e02
Instruction Fuzzy Hash: 37419FB3B14A4481EB08AF26C58836CA361EB54FBDF928672DB5C076D9CF6DD8D08354

Function 00007FF7C40E8D1C Relevance: 3.1, APIs: 2, Instructions: 102COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00007FF7C40E8DB2
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF7C40E8E25

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID:
API String ID: 17069307-0
Opcode ID: 218f1446f38a1950de1cfaebd2ce496f9eeebb6780045b956c224588b2cbc886
Instruction ID: d0e0c94dca6be0688df0192fcb8dcd4cdb501b064e951f9ffb52a614132656eb
Opcode Fuzzy Hash: 218f1446f38a1950de1cfaebd2ce496f9eeebb6780045b956c224588b2cbc886
Instruction Fuzzy Hash: FF416C22B54B0685FB00EF62D9913BCA3A5BB48BE8F854471DE4C17B59DF3CE5928360

Function 00007FF7C4112834 Relevance: 3.1, APIs: 2, Instructions: 99registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE ref: 00007FF7C41128C8
RegCloseKey.KERNELBASE ref: 00007FF7C4112998

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: 309f8565431deecee6466e2eb5a7511012c0eddc588f092cbe7bc37eb1711fcc
Instruction ID: c332678e1bee25e593ef18e9527215e904e7d0193c703b502042f2cbceadeda1
Opcode Fuzzy Hash: 309f8565431deecee6466e2eb5a7511012c0eddc588f092cbe7bc37eb1711fcc
Instruction Fuzzy Hash: 1E41B372708B8586EB209F1AE4806AAA7B0F789BA8F404236DF9C57764DE7DD444C710

Function 00007FF7C40E6A04 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00007FF7C40E6AD4
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF7C40E6B06

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID:
API String ID: 17069307-0
Opcode ID: a52f02afd52039ef20a21c2a8fd9b749793abeb58375e6f487ae6f462ea6dec8
Instruction ID: e030f79b82a4508acd47915757179ff6e171220b53bba814c1ccaa369cd4ab8c
Opcode Fuzzy Hash: a52f02afd52039ef20a21c2a8fd9b749793abeb58375e6f487ae6f462ea6dec8
Instruction Fuzzy Hash: A131C422A48A4981EF51EF16E080379A7A1EB84FACFD94471DB8E07795CF2CD8A1C714

Function 00007FF7C4130B3C Relevance: 3.1, APIs: 2, Instructions: 86registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE ref: 00007FF7C4130BC1
RegCloseKey.KERNELBASE ref: 00007FF7C4130C4B

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: c021bee72f9394e60f5ab8f3802e77c66cb397d71389ea3ad5861b0d11f4287b
Instruction ID: 813f590f3e45caf7a358fab4859a3df423ae52b5b15c47b0a505011c3c5c1a1e
Opcode Fuzzy Hash: c021bee72f9394e60f5ab8f3802e77c66cb397d71389ea3ad5861b0d11f4287b
Instruction Fuzzy Hash: 1F313072608B818AE7209F5AE8C42AAA7B0F789FA9F544136DF8C47768CF3DD554C710

Function 00007FF7C405D824 Relevance: 3.1, APIs: 2, Instructions: 74fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00007FF7C405D8D7
GetLastError.KERNEL32 ref: 00007FF7C405D8F3

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: b210457f69cdedcc833c522d187e1f57bd8b44b0908bf27100a7769f8ef38535
Instruction ID: 8a4943b94745ee75bbc5a45f387c0b0a825ab897420297cdb6278b7b41fe197c
Opcode Fuzzy Hash: b210457f69cdedcc833c522d187e1f57bd8b44b0908bf27100a7769f8ef38535
Instruction Fuzzy Hash: F931C532A19B8196DB10AF16E4802E9B7A0FB58798F858033EF8D83754DF3CD555C714

Function 00007FF7C4110D90 Relevance: 3.1, APIs: 2, Instructions: 66COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7C4110E06
StringFromGUID2.OLE32 ref: 00007FF7C4110E40

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ErrorFromLastString
String ID:
API String ID: 3006059378-0
Opcode ID: 6bb9f58bdb983c4b8aa3b46d06469b26feb6c11e6b41b97f60ccaf098538320f
Instruction ID: 663366f7a13ea1ad6b8c496bf682a249db22b2fdfb699f01654bcaf95c74254e
Opcode Fuzzy Hash: 6bb9f58bdb983c4b8aa3b46d06469b26feb6c11e6b41b97f60ccaf098538320f
Instruction Fuzzy Hash: C121C822B18B4582E720EF17E4C02AAA7B0FB98B68FC04235EADD43695DF3CD545C760

Function 00007FF7C4038940 Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00007FF7C4038957
_RTC_Initialize.LIBCMT ref: 00007FF7C4038978

Part of subcall function 00007FF7C4047184: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C40471B6

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Initialize_invalid_parameter_noinfo_set_fmode
String ID:
API String ID: 3548387204-0
Opcode ID: 36fc153796fea83cdf4f3a541401c628bb0157591ca3492735c06590df4852bb
Instruction ID: 8b983874938d465aac4fe19c07b84378d219dc536bbb39c9c3b903a6f2bd5b11
Opcode Fuzzy Hash: 36fc153796fea83cdf4f3a541401c628bb0157591ca3492735c06590df4852bb
Instruction Fuzzy Hash: F7119A51E9950342FA54BFB346C62B8C9916F9832DFCB14F4E90D462E3EE1CB8D08672

Function 00007FF7C40636D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF7C406354D,?,?,00000000,00007FF7C4063602), ref: 00007FF7C406373E
GetLastError.KERNEL32(?,?,?,00007FF7C406354D,?,?,00000000,00007FF7C4063602), ref: 00007FF7C4063748

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: f7a5f2ce10f31a94824610c7345421d26d13861c99f7259af3626c606b309b64
Instruction ID: e30fe42a233a0a51c83f111f730ab8463574cfd77265da22bb27cab5b64fcc5e
Opcode Fuzzy Hash: f7a5f2ce10f31a94824610c7345421d26d13861c99f7259af3626c606b309b64
Instruction Fuzzy Hash: 07210761B58A8241FE647F63A0D12BC95829F407BCF8542BDEE1E473C5CE7CE4C08220

Function 00007FF7C4052E8C Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,00000000,00007FF7C4047326,?,?,?,00007FF7C40475EE,?,?,?,?,00007FF7C4060DE0,?,?,?), ref: 00007FF7C4052EA0
FreeEnvironmentStringsW.KERNEL32(?,?,00000000,00007FF7C4047326,?,?,?,00007FF7C40475EE,?,?,?,?,00007FF7C4060DE0,?,?,?), ref: 00007FF7C4052F0A

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: eeb74cd6e0af9f6bd475ca350fb883224579acd6067a959c8a7b97642224c8ab
Instruction ID: d52a40db73380416e32cea0525cf365004335fe7a7e48e1ab1b0b3293714c3cf
Opcode Fuzzy Hash: eeb74cd6e0af9f6bd475ca350fb883224579acd6067a959c8a7b97642224c8ab
Instruction Fuzzy Hash: 8F018611E48B5141DA10BF126455069A360EF54BB4FC94174DE6E137D5DE2CE4828754

Function 00007FF7C4032A4C Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

shared_ptr.LIBCPMT ref: 00007FF7C4032A74
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4032AD7

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnshared_ptr
String ID:
API String ID: 2168938143-0
Opcode ID: d005dbde5efec947eb4f736d471612ec88b3744960d2571c3b00fbc7fb13794b
Instruction ID: 1394f38a4218d7b86ca9a04354c967c420b6769ce97d371f5098ae033b3a7c85
Opcode Fuzzy Hash: d005dbde5efec947eb4f736d471612ec88b3744960d2571c3b00fbc7fb13794b
Instruction Fuzzy Hash: 87016162B4494543FE24AE26D58436DE761EB48BF8F5D4A75DB2C0BA89CF7CD4D08310

Function 00007FF7C401B82C Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C401B85A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C401B860
__std_exception_copy.LIBVCRUNTIME ref: 00007FF7C401B88C

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2371198981-0
Opcode ID: 09fa084edcc1f4ca3c0daf4fd6dbf2df63a84f8f3a2beedbb96584f1974857ea
Instruction ID: c398fea8f779ca071cb57f189fe3c733784bf971775da065fabb91abccd764fe
Opcode Fuzzy Hash: 09fa084edcc1f4ca3c0daf4fd6dbf2df63a84f8f3a2beedbb96584f1974857ea
Instruction Fuzzy Hash: D9F06251E4574A90DE15AF62D4C10A953A09F59B78B854B71DA2C0A3D1EE2CE5D5C310

Function 00007FF7C4050F00 Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,00007FF7C4047783,00007FF7C4056682,?,?,?,00007FF7C40569FF,?,?,00000000,00007FF7C4057568,?,?,?,00007FF7C405749B), ref: 00007FF7C4050F16
GetLastError.KERNEL32(?,?,00007FF7C4047783,00007FF7C4056682,?,?,?,00007FF7C40569FF,?,?,00000000,00007FF7C4057568,?,?,?,00007FF7C405749B), ref: 00007FF7C4050F20

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: 0b6dae97ffca4b8e32fb011204c4957ed53db2bc798c70a76fbcb7083b5f3604
Instruction ID: 4ebc0e79420698588070938256fd7ffbcdb97afa073064ca41c9a88255a74559
Opcode Fuzzy Hash: 0b6dae97ffca4b8e32fb011204c4957ed53db2bc798c70a76fbcb7083b5f3604
Instruction Fuzzy Hash: D5E08610F59A0242FF187FF354D50B895648F84B79FC55874C94D42291ED2C68C19334

Function 00007FF7C4107F48 Relevance: 2.6, APIs: 2, Instructions: 106COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7C4107F6F
LeaveCriticalSection.KERNEL32 ref: 00007FF7C410808C

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 959598d607d225d787bff5bc479d776011f20bafc3898567677b3ebb6d11edb2
Instruction ID: 0994c5ac5e5a4879fd4c74d2e01367623b3bb6952c984b6a5f82c6a0466e4e47
Opcode Fuzzy Hash: 959598d607d225d787bff5bc479d776011f20bafc3898567677b3ebb6d11edb2
Instruction Fuzzy Hash: 0E412736A09F0586EB14AF26E49432CA760FF88FA9F584132CE5D03768DF6ED844C364

Function 00007FF7C40649A8 Relevance: 2.5, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7C40649CD
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00007FF7C4064414), ref: 00007FF7C40649F4

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: dbf070c3ab106ad0012074d281cdb6d096a90a5a7d16d8a09526fedf964e80d3
Instruction ID: 4454dce95b62d28f65fa1c904697827e4e9ffa2b68fb0bfbcf575ad9b02fdae6
Opcode Fuzzy Hash: dbf070c3ab106ad0012074d281cdb6d096a90a5a7d16d8a09526fedf964e80d3
Instruction Fuzzy Hash: 95F0897570875052F714AF12B4840E9E715EB957E9F400135EF8D03B55CF3CD59AC618

Function 00007FF7C4065BC0 Relevance: 2.5, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,6666666666666667,?,00000000,00007FF7C40656B4), ref: 00007FF7C4065BE5
LeaveCriticalSection.KERNEL32 ref: 00007FF7C4065C08

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 08f4d9a072a5697c8e9ee5f465f55970225a7c6f687ee7213528f5e382713201
Instruction ID: 98310248281153a87450c33c307f1b986b3753f605b6ee724161bade2f09768e
Opcode Fuzzy Hash: 08f4d9a072a5697c8e9ee5f465f55970225a7c6f687ee7213528f5e382713201
Instruction Fuzzy Hash: E5F0A776608B9492E7109F12B4440DAE710EB85BE9F400039EF8D03B55CF3CD59AC718

Function 00007FF7C4143180 Relevance: 1.8, APIs: 1, Instructions: 255COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4144623

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 2a4b86ad36b716e41aabe01d66633124b1eeca7650ef80b4c12497063eb21f87
Instruction ID: 5d413f2263dcc3fbce682c4e2a625a95ae67ff941fdaa774ee542b6e7f57f021
Opcode Fuzzy Hash: 2a4b86ad36b716e41aabe01d66633124b1eeca7650ef80b4c12497063eb21f87
Instruction Fuzzy Hash: 67B16762B04A518AEB14DE6BE4803ADB7A1FB44FACF946136CE8D47799DF38D841C350

Function 00007FF7C4120378 Relevance: 1.7, APIs: 1, Instructions: 241COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C412038D

Part of subcall function 00007FF7C41167FC: GetCurrentProcess.KERNEL32 ref: 00007FF7C4116856

Part of subcall function 00007FF7C4116AA8: _Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4116AE3

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource$CurrentProcess
String ID:
API String ID: 3082324263-0
Opcode ID: f63771f413988e58959b0a5d12e7bf235cafc9bed3305a75b9ba23d3fe877673
Instruction ID: 6e4d4f9d237af65298cc2fad36f1562aed7aace1d8b7cba07819ea3b766da82c
Opcode Fuzzy Hash: f63771f413988e58959b0a5d12e7bf235cafc9bed3305a75b9ba23d3fe877673
Instruction Fuzzy Hash: 6CB1A122A18B818AEB20EF61E8801EDB7B0FB9475CF805135EF8D57A9ADF38D545C750

Function 00007FF7C408BE40 Relevance: 1.7, APIs: 1, Instructions: 209COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C408C0E9

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 89f08a7217b56e2cdbd635fbeb737cdc213b5bca2ce99f3ac6117d0e27162c99
Instruction ID: ece0cc8a3a4437c1e563fe6d177f46135ecdaf904ae508c9c8001c517edae0dc
Opcode Fuzzy Hash: 89f08a7217b56e2cdbd635fbeb737cdc213b5bca2ce99f3ac6117d0e27162c99
Instruction Fuzzy Hash: B7A15B73609A41C8DB20AF26C5C02AC73B1FB58B9CF925232EA4D47B99DF3AD484C710

Function 00007FF7C4144A1C Relevance: 1.7, APIs: 1, Instructions: 193COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4144CDC

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: f03c3821ee799b612c4c567ba139c09d8d0eb6adae2e2614be4315f6b1291335
Instruction ID: 0c6346e59fe9c0a9eaefa7e822603cd9faac2a06bf8aa04625809c42f5620fe0
Opcode Fuzzy Hash: f03c3821ee799b612c4c567ba139c09d8d0eb6adae2e2614be4315f6b1291335
Instruction Fuzzy Hash: 5481AE32F18A419AEB10EF62E4802AD73B1EB54B6CF845535CE8D13A98EF38E559C354

Function 00007FF7C40A6AF8 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_Mtx_init_in_situ.LIBCPMT ref: 00007FF7C40A6B2C

Part of subcall function 00007FF7C4038858: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C4038888
Part of subcall function 00007FF7C4038858: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C403888E
Part of subcall function 00007FF7C4038858: __GSHandlerCheckCommon.LIBCMT ref: 00007FF7C40388A2

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Concurrency::cancel_current_task$CheckCommonHandlerMtx_init_in_situ
String ID:
API String ID: 1568983462-0
Opcode ID: 71bf19e9faa3c9284b18db263c737d84c6aab8fcef08b1ac508b36802013550d
Instruction ID: b762f0f1258ca99041e4ab8f81e22ec7620e4fd051a4be7e815ff9b442e3dcb4
Opcode Fuzzy Hash: 71bf19e9faa3c9284b18db263c737d84c6aab8fcef08b1ac508b36802013550d
Instruction Fuzzy Hash: D3514333245B80A6C7099F20E98029DBBF8FB88758F958029DB9C53724EF78E5B5C350

Function 00007FF7C42CDA0C Relevance: 1.6, APIs: 1, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C42CDA34

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ff31d3cc53424af764c390567fb79b5fe55bc895cf04ef9fbb9ce5241749c6c7
Instruction ID: a2130b43fa4ab396e85856029936996c00c829fdd9eed69a1cbf902d4cffd8c4
Opcode Fuzzy Hash: ff31d3cc53424af764c390567fb79b5fe55bc895cf04ef9fbb9ce5241749c6c7
Instruction Fuzzy Hash: B341B73291861583FA74AF1AE4C127DB3A0EB91B68F940231DA9E877D1DF2DE443C760

Function 00007FF7C413F5B0 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C413F733

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: ab34ffbba8abc48d363c605bf10efc9ba95eea93dd8ad3a6bdaaed00d9a42e00
Instruction ID: c4cf4468a5d83e730317dc2e77baae35fbd25f67b778fbeb521f57c3e9542492
Opcode Fuzzy Hash: ab34ffbba8abc48d363c605bf10efc9ba95eea93dd8ad3a6bdaaed00d9a42e00
Instruction Fuzzy Hash: 8041B133614B4586EB10EF22E4813AEB7A1FB897A8F814631EA8D07B95DF7CD581C750

Function 00007FF7C407E398 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C4086530: _Mtx_init_in_situ.LIBCPMT ref: 00007FF7C4086589

_Mtx_init_in_situ.LIBCPMT ref: 00007FF7C407E4A6

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Mtx_init_in_situ
String ID:
API String ID: 3366076730-0
Opcode ID: 2239276cf98b74a5188a8bbe0c96f75c3de580ac14bb543414dddb355def5e71
Instruction ID: 04e3d9e632739dfb7e59c10069cbeeea1fe352d7bf44d92600247fc86d1a8b79
Opcode Fuzzy Hash: 2239276cf98b74a5188a8bbe0c96f75c3de580ac14bb543414dddb355def5e71
Instruction Fuzzy Hash: 0841E333155BD185E7409F61E8843D973A8F748F98F58823AEB9C4BB99EF7490A5C320

Function 00007FF7C4061BF0 Relevance: 1.6, APIs: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C4061CE7

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ce5b99f190d0430723ef27ac96a51395b3a63e38a9d235c041903079eb58a6d3
Instruction ID: 03f667c7cedc52899a701889aeedc809ed6eca15399035d184615f855631abb9
Opcode Fuzzy Hash: ce5b99f190d0430723ef27ac96a51395b3a63e38a9d235c041903079eb58a6d3
Instruction Fuzzy Hash: 64318F22B58A4155E7457F9794C12BCAA64AF80BB8FC306B5D91E073D3DEBCA4808731

Function 00007FF7C4019AF8 Relevance: 1.6, APIs: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C4019BC6

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: e91fce25f638684a5b8254f95a9dbc90ae5d50a3f2ca227cec01f8f2134244bf
Instruction ID: 1c1e1af622008cb26f197126cdef0d5d51e958caf974490c54c343ff4b98cc7e
Opcode Fuzzy Hash: e91fce25f638684a5b8254f95a9dbc90ae5d50a3f2ca227cec01f8f2134244bf
Instruction Fuzzy Hash: EF21F762F48A4184EA14AF17A5802B8A270EB54BF8F584771EB7D077D5EF2CD0D1C340

Function 00007FF7C408715C Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

std::_Locinfo::~_Locinfo.LIBCPMT ref: 00007FF7C4087236

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: LocinfoLocinfo::~_std::_
String ID:
API String ID: 2823473280-0
Opcode ID: 691b85cd56ca58f63016942d18bc75eca041c70522621e457475bc6abc1f2dc1
Instruction ID: 2b0bd018d728ad7a79bbe288cba4d8090295c78d945c038562e40762616bb27f
Opcode Fuzzy Hash: 691b85cd56ca58f63016942d18bc75eca041c70522621e457475bc6abc1f2dc1
Instruction Fuzzy Hash: DE21C832A49B4185EB20EF16E5803B9B3A0FF847A4F864571EA4C03795EF3CD490C350

Function 00007FF7C42CF8E0 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C42CF903

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ff68aeca87b4da2310bf737107c7627ecdde129dcf4df9af6470528147ee77d2
Instruction ID: ad0ed1ec4bebaef33b008b800fcd0c397ce78043fa885fba947daeb3aa3b3d0c
Opcode Fuzzy Hash: ff68aeca87b4da2310bf737107c7627ecdde129dcf4df9af6470528147ee77d2
Instruction Fuzzy Hash: 7621C832A0868246EB71AF19D481379B6A0EB84B6CF954234EB5D476D9DF3ED4408B10

Function 00007FF7C42CCDB8 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C42CCDE9

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 43b982df4bdcc9a0eb6a9274553db4681419506a585dd51b9a3da18eb664f449
Instruction ID: 57cfbeb5b8871a58a9553c305da9a517e958dcfec68d0ce619ae462ecd05bd80
Opcode Fuzzy Hash: 43b982df4bdcc9a0eb6a9274553db4681419506a585dd51b9a3da18eb664f449
Instruction Fuzzy Hash: 2B11D821A1C68282FA70BF47948127DE264BF45BA8FC50434EE4C97B86DF3DD8409760

Function 00007FF7C4116710 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE ref: 00007FF7C41167AD

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 59d978035e98c39ff22f13dfbc1f3998f132d7ff43caa30dfb46fe568dfab0c9
Instruction ID: 59966368b4108ddb74922a454ab933f098d0ea893b3b4ebe61916df306027c6a
Opcode Fuzzy Hash: 59d978035e98c39ff22f13dfbc1f3998f132d7ff43caa30dfb46fe568dfab0c9
Instruction Fuzzy Hash: 9D213076608A4682EB609F16E48036AB770FB89FD8F944136DA4D07728CF3ED544CB10

Function 00007FF7C4065C18 Relevance: 1.6, APIs: 1, Instructions: 50fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00007FF7C4065C83

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: a256ef63936d6bdb1731879260660355e04c8c4ea8c7bd0c33fa6792688f90d2
Instruction ID: 806666249f715b1f7bd61ea34d30d4fab28bc85d9f245582b3ca5396835fb946
Opcode Fuzzy Hash: a256ef63936d6bdb1731879260660355e04c8c4ea8c7bd0c33fa6792688f90d2
Instruction Fuzzy Hash: DC11C262B68B4645EE54AF62B49127AE3A0BF847B8F864435DE4E0BB55CE3CE4408610

Function 00007FF7C4081280 Relevance: 1.5, APIs: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00007FF7C40812E4

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: fede611926bd553b2d0ebb1fdc686398f0d9474feeb4c19362613e88661a10a9
Instruction ID: b20dd2fb12280a4251e2d1f4698fd3429c439fff52bf654bec106256d7e4c265
Opcode Fuzzy Hash: fede611926bd553b2d0ebb1fdc686398f0d9474feeb4c19362613e88661a10a9
Instruction Fuzzy Hash: B5119A3277869142EB10EF16E585769B350F784BF4F801235F65A4BB85CF3DD1518B40

Function 00007FF7C410D3C4 Relevance: 1.5, APIs: 1, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7C410D272), ref: 00007FF7C410D437

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 24ce0d325fb44d3bd056293ed65412aae83f5baa574ba06e185e6f3732a8e999
Instruction ID: c2a5de0fe206bf090051a1aeab438c2e18bd21aed64efd8dfe6419207e487666
Opcode Fuzzy Hash: 24ce0d325fb44d3bd056293ed65412aae83f5baa574ba06e185e6f3732a8e999
Instruction Fuzzy Hash: A211E9B1714B4581EB10AF26F4D1A66B7A1FB98BD8F901136CE4D83B25CE3CD490C710

Function 00007FF7C407EDD8 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

_Mtx_unlock.LIBCPMT ref: 00007FF7C407EE63

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 72438f761be25e108077e82a679225d603157860a1885808aa871e83059a702a
Instruction ID: d26d99a182402a764c058a71c141ed85597bac2155b1f40e61c408886e9027cd
Opcode Fuzzy Hash: 72438f761be25e108077e82a679225d603157860a1885808aa871e83059a702a
Instruction Fuzzy Hash: E0117032704A4582EB14AF27B4902ADA765EB98BE8F880571EF8E47B55DF3DE4418350

Function 00007FF7C4140D98 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4140E24

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 550a4f931fb56f287c68c2df5d72d76bc8604f324f8494a2b60a442bfbebadb6
Instruction ID: 93b7946aa927bd900dbaf9bfe33cace9b10b8e1f45eddd06b58788aedc405b4c
Opcode Fuzzy Hash: 550a4f931fb56f287c68c2df5d72d76bc8604f324f8494a2b60a442bfbebadb6
Instruction Fuzzy Hash: 4101C0A2B1054546EE18BE33D4953BCA3609F44FBCF982675CA2C0E1C6DE2CE9D4C390

Function 00007FF7C4048D64 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C4048D8F

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: da745c093014d2f81b6c0f8073760d4483a5e0a34614487dddc869a4a90146a8
Instruction ID: 6c86c45e5aec5f8e3b88c8cfa501c3955dc7a1a1464ec7a0402c255e768c8e01
Opcode Fuzzy Hash: da745c093014d2f81b6c0f8073760d4483a5e0a34614487dddc869a4a90146a8
Instruction Fuzzy Hash: 4D111436A10B069DEB10AFA0D4812EC37B8FB0436CF911A36EA4D12B59EF34C194C3A0

Function 00007FF7C4051870 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7C405149A,?,?,?,00007FF7C4046A01,?,?,?,?,00007FF7C405169E,?,?,00000000), ref: 00007FF7C40518C5

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f6f58e17aaaf3202dd725def8ae694481d68a40c727e5b06579fb5c9be69bc33
Instruction ID: 11af557e7616a36f472600ceded56d82279b85f28917a40eccb5dbbf838cd1b5
Opcode Fuzzy Hash: f6f58e17aaaf3202dd725def8ae694481d68a40c727e5b06579fb5c9be69bc33
Instruction Fuzzy Hash: E7F03C10F89A0641FE647EA364812B492859F44BA8FCA5470CD0E8A2C2EE1CA4D08238

Function 00007FF7C41482C4 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

_Yarn.LIBCPMT ref: 00007FF7C414831D

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Yarn
String ID:
API String ID: 1767336200-0
Opcode ID: 42c5f168b88bf70b6cedf738c2cdc578343e93d7a1bd0c5c1daaa99887097674
Instruction ID: 25bb239112e78b838a8e4c5edcda898986bfbce8810eae721538362ce50771bc
Opcode Fuzzy Hash: 42c5f168b88bf70b6cedf738c2cdc578343e93d7a1bd0c5c1daaa99887097674
Instruction Fuzzy Hash: C3018FB2605B8486DB149F2EE58015877B0F719FC8BA4A134DB8C43715DB39C4B2C700

Function 00007FF7C411F38C Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C411F868: _Aligned_get_default_resource.LIBCPMT ref: 00007FF7C411F8C7

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C411F3A3

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource
String ID:
API String ID: 628915230-0
Opcode ID: 4d65320993bc7012d4227e75c0166f2c78762cf2a76a65eaf2ee75e7e401246c
Instruction ID: ce65ae84d59043b6810cca63af0015eb7a755837269f0db2f06d395dc9215dfe
Opcode Fuzzy Hash: 4d65320993bc7012d4227e75c0166f2c78762cf2a76a65eaf2ee75e7e401246c
Instruction Fuzzy Hash: 41011B7291868582EB21AF52E580269B3B0FB89B6CF840235DACD06295CF3CE185C615

Function 00007FF7C413F82C Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C4032A4C: shared_ptr.LIBCPMT ref: 00007FF7C4032A74

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C413F898

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnshared_ptr
String ID:
API String ID: 2168938143-0
Opcode ID: 9ed8cf880f7cc7bd8b5ab9524d65615aa2c5f7851869210192ac80e09264b114
Instruction ID: 9aaac0f2ae1501a52462a0b0b0085797bf9a98983fcb16c9cd3c58088d1bc16b
Opcode Fuzzy Hash: 9ed8cf880f7cc7bd8b5ab9524d65615aa2c5f7851869210192ac80e09264b114
Instruction Fuzzy Hash: 96F06DA2B5458682FF1CBE66E18937CA712EB19FACFD01471DA4C0A68ADF6DD4C48350

Function 00007FF7C4120A30 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00007FF7C4120A66

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: b92e2adce9a8fbe29abd0cd764d7c42809e477a869babeda42e830652301f614
Instruction ID: 1c8565a136286416193a6133d32ec6c5f618a12b607155ae4db4eff4da623fae
Opcode Fuzzy Hash: b92e2adce9a8fbe29abd0cd764d7c42809e477a869babeda42e830652301f614
Instruction Fuzzy Hash: 86F0672261CA8096E6609F51F4D53AAA370FB84768FC15331D7AD476D5DF7CD148C740

Function 00007FF7C4054E88 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF7C4051685,?,?,00000000,00007FF7C4046A77,?,?,?,00007FF7C4047783,?,?,?,00007FF7C4047679), ref: 00007FF7C4054EC6

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: abcb5a8b87a5b71316a14f217ff42fbe299c9595cd5410c0e55a3f12113f42e9
Instruction ID: 039d84a35d3d4f08ccda1f91b03de9cfd5d36f8df39a68e7bc6b4c7dde3d8646
Opcode Fuzzy Hash: abcb5a8b87a5b71316a14f217ff42fbe299c9595cd5410c0e55a3f12113f42e9
Instruction Fuzzy Hash: C1F05E10F8DA4641FE557EA35AC13F5D1808F447B8FCA0674D92E862C1DE6CA8D0A238

Function 00007FF7C407F746 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_Mtx_unlock.LIBCPMT ref: 00007FF7C407F775

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 16e842590be2e7df17869df71923ce9b31f12df57d3ec26b15337c0df8650b20
Instruction ID: 0855c2015cf4a3ce5c9ea8130ef40d475ee0155a7c7b0af2855d617cdd6b3cbe
Opcode Fuzzy Hash: 16e842590be2e7df17869df71923ce9b31f12df57d3ec26b15337c0df8650b20
Instruction Fuzzy Hash: 94E0922770468181EA11EF22F5413AAA310BB89FE9F4400338F4D03756CF3CC0C38614

Function 00007FF7C42CD5D4 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C42CD5E8

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a91d87733f2431b6f55e9b58867493385ccae49aff1c5ec6964c4aba7c861886
Instruction ID: 6cec60d3e18b4a93acf71b0cd6689716c2cc1035c89947060f3c09225a62b359
Opcode Fuzzy Hash: a91d87733f2431b6f55e9b58867493385ccae49aff1c5ec6964c4aba7c861886
Instruction Fuzzy Hash: DBE0ED71E5910286FA653FA689823BDA2A49F5176CFD24570D51C473C2DE7E28824731

Function 00007FF7C4123110 Relevance: 1.5, APIs: 1, Instructions: 20registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNELBASE ref: 00007FF7C412315B

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Enum
String ID:
API String ID: 2928410991-0
Opcode ID: 58a5cb2ba9b800201c87955cf8d299cf42edeff4c5b22bdaf35e29357395d10f
Instruction ID: e43ab27471841918add151edb9cd380f1a0f68bfcf43513d9fdb6a762e786f8a
Opcode Fuzzy Hash: 58a5cb2ba9b800201c87955cf8d299cf42edeff4c5b22bdaf35e29357395d10f
Instruction Fuzzy Hash: 21E0C966629FC882D7608F16B88564AA7A4F788BD4F104115EECD43B28EF38C4608B04

Function 00007FF7C41232F0 Relevance: 1.5, APIs: 1, Instructions: 16registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE ref: 00007FF7C412331E

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 29702790335004db37999fe4fef7badbca55fb2a53bea902d276f4f85d8e0242
Instruction ID: e0e6f37872f9e99b9923f38f3abcff9a4b924fc5b48f1c2d5f9c9f32e39ef691
Opcode Fuzzy Hash: 29702790335004db37999fe4fef7badbca55fb2a53bea902d276f4f85d8e0242
Instruction Fuzzy Hash: 6ED01776A18F4882CA10CF57B84545AA760F799BD8F100212EE8C03738DE3CC1A18A08

Function 00007FF7C4113E94 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4113E9D

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource
String ID:
API String ID: 628915230-0
Opcode ID: cfd881905aefe9ddad0d19f8d21e32a2f4963ff934f57eb101df287e5a64d619
Instruction ID: d6242e4591b0df916867800e012ac08895d488334d87967523c11ea9478190fb
Opcode Fuzzy Hash: cfd881905aefe9ddad0d19f8d21e32a2f4963ff934f57eb101df287e5a64d619
Instruction Fuzzy Hash: 81D05E50B4470581DE08BF67A48126C9311AB8AFD0F885031DD0D0B351CD2CD0919320

Function 00007FF7C411F364 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C411F368

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource
String ID:
API String ID: 628915230-0
Opcode ID: 9165917813f6924b2fe427d363525dba862c3ac11501a748096fb6e98cae80e0
Instruction ID: ce34466c07565520dae364ef187b19eec28d3c5d6624cd8dd818bb6da9f6811a
Opcode Fuzzy Hash: 9165917813f6924b2fe427d363525dba862c3ac11501a748096fb6e98cae80e0
Instruction Fuzzy Hash: 02D0C979A04B85C2CA14EF4AD4910A87360BBC8F95BD04022DE4D4B325DE6CD115DB10

Non-executed Functions

Function 00007FF7C41241D0 Relevance: 44.3, APIs: 13, Strings: 12, Instructions: 572libraryloaderCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF7C41360EE
GetLastError.KERNEL32 ref: 00007FF7C4136100
LoadLibraryW.KERNEL32 ref: 00007FF7C4136242
GetProcAddress.KERNEL32 ref: 00007FF7C4136261
FreeLibrary.KERNEL32 ref: 00007FF7C4136335
GetLastError.KERNEL32 ref: 00007FF7C4136342

Part of subcall function 00007FF7C406A3E8: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C406A5B1

ReadProcessMemory.KERNEL32 ref: 00007FF7C4136416
GetLastError.KERNEL32 ref: 00007FF7C4136424
ReadProcessMemory.KERNEL32 ref: 00007FF7C41364F8
GetLastError.KERNEL32 ref: 00007FF7C413650A

Part of subcall function 00007FF7C401B694: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C401B6EF

ReadProcessMemory.KERNEL32 ref: 00007FF7C41366C2
GetLastError.KERNEL32 ref: 00007FF7C41366D0
CloseHandle.KERNEL32 ref: 00007FF7C41368EB

Strings

NtQueryInformationProcess, xrefs: 00007FF7C4136257
Allocate the buffer failed. hr=, xrefs: 00007FF7C4136627
basicInformation.PebBaseAddress is null. hr=, xrefs: 00007FF7C413687C
ReadProcessMemory failed trying to read the PEB. hr=, xrefs: 00007FF7C4136463
ReadProcessMemory failed trying to read the command line. hr=, xrefs: 00007FF7C413670F
ReadProcessMemory failed trying to read the process parameters. hr=, xrefs: 00007FF7C4136547
ntdll, xrefs: 00007FF7C413623B
LoadLibrary failed. hr=, xrefs: 00007FF7C4136381
failed with hr=, xrefs: 00007FF7C413613D
Unable to read the process basic information status=, xrefs: 00007FF7C41362C7
peb.ProcessParameters is null. hr=, xrefs: 00007FF7C41367E6
OpenProcess with pid=, xrefs: 00007FF7C4136176

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ErrorLast$Process$MemoryRead$Library$AddressCloseConcurrency::cancel_current_taskFreeHandleLoadOpenProc_invalid_parameter_noinfo_noreturn
String ID: Allocate the buffer failed. hr=$LoadLibrary failed. hr=$NtQueryInformationProcess$OpenProcess with pid=$ReadProcessMemory failed trying to read the PEB. hr=$ReadProcessMemory failed trying to read the command line. hr=$ReadProcessMemory failed trying to read the process parameters. hr=$Unable to read the process basic information status=$basicInformation.PebBaseAddress is null. hr=$failed with hr=$ntdll$peb.ProcessParameters is null. hr=
API String ID: 1051646886-941745286
Opcode ID: 748954d665aa1cded9c7f4e6cf24d62386d891dfaa643e195f21751a4f42bea8
Instruction ID: a62e6f71342aecd6eafab6be767cb739a84eb350441e0b41e7f2c08e34b1fcba
Opcode Fuzzy Hash: 748954d665aa1cded9c7f4e6cf24d62386d891dfaa643e195f21751a4f42bea8
Instruction Fuzzy Hash: 92328622A59A4292EB10AF66E4C11EAE770FFD17A8F811036EA8E42675DF3CD585C710

Function 00007FF7C416C520 Relevance: 37.2, APIs: 7, Strings: 14, Instructions: 473COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C416C5DA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C416C702
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C416C7F4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C416C922
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C416CA14
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C416CB04
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C416CBF4

Strings

Unmetered, xrefs: 00007FF7C416C632
OverDataLimit, xrefs: 00007FF7C416C620
DeviceInfo.OsName, xrefs: 00007FF7C416CA68
Unknown, xrefs: 00007FF7C416C63B, 00007FF7C416C85B
DeviceInfo.NetworkCost, xrefs: 00007FF7C416C666
Wired, xrefs: 00007FF7C416C852
Wifi, xrefs: 00007FF7C416C849
DeviceInfo.OsVersion, xrefs: 00007FF7C416CB58
DeviceInfo.OsBuild, xrefs: 00007FF7C416C978
WWAN, xrefs: 00007FF7C416C840
Metered, xrefs: 00007FF7C416C629
DeviceInfo.NetworkType, xrefs: 00007FF7C416C886
EventInfo.Level, xrefs: 00007FF7C416C55C
DeviceInfo.NetworkProvider, xrefs: 00007FF7C416C758

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: DeviceInfo.NetworkCost$DeviceInfo.NetworkProvider$DeviceInfo.NetworkType$DeviceInfo.OsBuild$DeviceInfo.OsName$DeviceInfo.OsVersion$EventInfo.Level$Metered$OverDataLimit$Unknown$Unmetered$WWAN$Wifi$Wired
API String ID: 3668304517-218813173
Opcode ID: 0936d9fa8513abb8d72f0aa2c8cea7177969ae4b6341d2e428214f12acf5c19d
Instruction ID: 406add6e3f6ebdc09cc1774b158781270b874623de14b22a4aeecdd32bc2de8d
Opcode Fuzzy Hash: 0936d9fa8513abb8d72f0aa2c8cea7177969ae4b6341d2e428214f12acf5c19d
Instruction Fuzzy Hash: 8E12CB62A1868652FA10AF2AF4853B9E361FBC57B8FC05335E9DC02AD9EF6CD145C710

Function 00007FF7C41AC7A0 Relevance: 23.5, APIs: 5, Strings: 8, Instructions: 704COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C41AA3CC: _Mtx_unlock.LIBCPMT ref: 00007FF7C41AA41A

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C41ACA7E

Part of subcall function 00007FF7C41AAD04: _Mtx_unlock.LIBCPMT ref: 00007FF7C41AAD83

Strings

%p: LogFailure(signature="%s", properties.name="%s", ...), xrefs: 00007FF7C41ACB5D
Failed to log %s event %s/%s: invalid arguments provided, xrefs: 00007FF7C41AC96B, 00007FF7C41ACD28, 00007FF7C41ACF06, 00007FF7C41AD15F
Failure, xrefs: 00007FF7C41ACD21
<unnamed>, xrefs: 00007FF7C41AC7F5, 00007FF7C41ACA94, 00007FF7C41ACB02, 00007FF7C41ACDB2, 00007FF7C41ACF57
%p: LogEvent(properties.name="%s", ...), xrefs: 00007FF7C41AC83E
%p: LogPageAction(pageActionData.actionType=%u, properties.name="%s", ...), xrefs: 00007FF7C41ACFA8
custom, xrefs: 00007FF7C41AC964, 00007FF7C41ACDB5
PageAction, xrefs: 00007FF7C41AD158

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Mtx_unlock$_invalid_parameter_noinfo_noreturn
String ID: %p: LogEvent(properties.name="%s", ...)$%p: LogFailure(signature="%s", properties.name="%s", ...)$%p: LogPageAction(pageActionData.actionType=%u, properties.name="%s", ...)$<unnamed>$Failed to log %s event %s/%s: invalid arguments provided$Failure$PageAction$custom
API String ID: 3123592497-2525901976
Opcode ID: cf801635a7be05968af9fca338abf2cce70d07d40befbe9d8097c6ad17c9b0aa
Instruction ID: 55404d818dff603e069bbd47cf06ad809384316671d4ca55b8bf144385ec4b13
Opcode Fuzzy Hash: cf801635a7be05968af9fca338abf2cce70d07d40befbe9d8097c6ad17c9b0aa
Instruction Fuzzy Hash: 1F62AF22A18B8586FB10AF66E4853ECA761FB85BACF804235EE9D17795DF38D185C310

Function 00007FF7C4114714 Relevance: 23.3, APIs: 7, Strings: 6, Instructions: 562COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C411477F
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C41147A8
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C411487F
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4114C09
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4114C35

Part of subcall function 00007FF7C401B694: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C401B6EF

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4114CFB

Part of subcall function 00007FF7C4019AF8: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C4019BC6

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4114E49

Strings

AppData\Local\Microsoft\Windows\UsrClass.dat, xrefs: 00007FF7C4114A82
Software\Microsoft\Windows NT\CurrentVersion\ProfileList\, xrefs: 00007FF7C41148FC, 00007FF7C4114D75, 00007FF7C4114EC3
9, xrefs: 00007FF7C4114EBA
\NTUSER.DAT, xrefs: 00007FF7C4114F57
NTUSER.DAT, xrefs: 00007FF7C4114A0F
ProfileImagePath, xrefs: 00007FF7C41148AE, 00007FF7C4114D28, 00007FF7C4114E76

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: 9$AppData\Local\Microsoft\Windows\UsrClass.dat$NTUSER.DAT$ProfileImagePath$Software\Microsoft\Windows NT\CurrentVersion\ProfileList\$\NTUSER.DAT
API String ID: 3723918569-2654858704
Opcode ID: 7a06866def23978929af95bf0928dd18bbafa17e8a10cc7f923a15a0776a152d
Instruction ID: dd9e0f111bcd37ffa376f95cf2d487758b019c247c9dac242f19ae8a763a113f
Opcode Fuzzy Hash: 7a06866def23978929af95bf0928dd18bbafa17e8a10cc7f923a15a0776a152d
Instruction Fuzzy Hash: 8E428022A04B519AEB10EFB6E8802ED7770FB8476CF911136EE4D17AA9DF78D149C710

Function 00007FF7C4158570 Relevance: 13.7, APIs: 5, Strings: 2, Instructions: 1497COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C4151814: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C415182A
Part of subcall function 00007FF7C4151814: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C415184F

_Find_elem.LIBCPMT ref: 00007FF7C4158F70
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4159AF8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4159AFE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4159B04
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4159B0A

Strings

0123456789-, xrefs: 00007FF7C415870A, 00007FF7C4158951, 00007FF7C4158D25, 00007FF7C4158F7B
$+xv, xrefs: 00007FF7C4158703

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$LockitLockit::_std::_$Find_elem
String ID: $+xv$0123456789-
API String ID: 713437749-795863860
Opcode ID: a827013702466e175b67674a3f574cd5622aafc6ba17de87177943ec0c0448e0
Instruction ID: 9c03806f27b45509d20d95aff96350f219f6f5f1c0758f5cb167a49153593669
Opcode Fuzzy Hash: a827013702466e175b67674a3f574cd5622aafc6ba17de87177943ec0c0448e0
Instruction Fuzzy Hash: 7AE2A332A19A8586EB509F2AE0D01BDB774FB44FA8F949036DA8E47794CF3DD891C710

Function 00007FF7C4058914 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7C40512C0: GetLastError.KERNEL32 ref: 00007FF7C40512CF
Part of subcall function 00007FF7C40512C0: FlsGetValue.KERNEL32 ref: 00007FF7C40512E4
Part of subcall function 00007FF7C40512C0: SetLastError.KERNEL32 ref: 00007FF7C405136F

Part of subcall function 00007FF7C40512C0: FlsSetValue.KERNEL32 ref: 00007FF7C4051305

GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF7C4058A84

Part of subcall function 00007FF7C40512C0: FlsSetValue.KERNEL32 ref: 00007FF7C4051332
Part of subcall function 00007FF7C40512C0: FlsSetValue.KERNEL32 ref: 00007FF7C4051343
Part of subcall function 00007FF7C40512C0: FlsSetValue.KERNEL32 ref: 00007FF7C4051354

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF7C4048841), ref: 00007FF7C4058A6B
ProcessCodePage.LIBCMT ref: 00007FF7C4058AAE
IsValidCodePage.KERNEL32 ref: 00007FF7C4058AC0
IsValidLocale.KERNEL32 ref: 00007FF7C4058AD6
GetLocaleInfoW.KERNEL32 ref: 00007FF7C4058B32
GetLocaleInfoW.KERNEL32 ref: 00007FF7C4058B4E

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: eb5083ad156808c0cd8f6aefb1b870ef16911619f18d93158d82892593add95d
Instruction ID: 5cab4c15b46876fa0d2f7a6743fb0341ddf4bbcf13820de8ab7c2540e6dbe7f4
Opcode Fuzzy Hash: eb5083ad156808c0cd8f6aefb1b870ef16911619f18d93158d82892593add95d
Instruction Fuzzy Hash: 9E718D63B48A0289FB10AF62D4816BCA3A4FF447ACF854175CE0D93695DF3DE4A4C369

Function 00007FF7C415C8E0 Relevance: 9.6, APIs: 6, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: LockitLockit::_std::_
String ID:
API String ID: 3382485803-0
Opcode ID: c5bc659ad6d2400934dc38c3d8c73492eaaf5bebfcece1907d99fc57aab27436
Instruction ID: 218e5f52d48cc7d745415d1859f3655b6e170d5bb5d64a6894d84207d62887b8
Opcode Fuzzy Hash: c5bc659ad6d2400934dc38c3d8c73492eaaf5bebfcece1907d99fc57aab27436
Instruction Fuzzy Hash: 31529662A18F8586EB109F2AE4841FDA761FB54FACF905132DA8D47B95EF3CD580C350

Function 00007FF7C40B8874 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C40B8A1B

Strings

ChainingMode, xrefs: 00007FF7C40B88DA
AES, xrefs: 00007FF7C40B88A6
ChainingModeCBC, xrefs: 00007FF7C40B88CE

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: AES$ChainingMode$ChainingModeCBC
API String ID: 3668304517-2985348328
Opcode ID: 822c79848f966aac036654f59ea58fa01759f4f509956c055eee607bd4adae95
Instruction ID: d56745ec503ab59cc37f42f21b29f88b235fe56cc5778c20a24f480d38ebe11b
Opcode Fuzzy Hash: 822c79848f966aac036654f59ea58fa01759f4f509956c055eee607bd4adae95
Instruction Fuzzy Hash: 5A51E433B5864286EB10AF66E0907B9A3A0FB887ACF854175EE4D47A99DF3CE140C714

Function 00007FF7C413C7E0 Relevance: 7.9, APIs: 5, Instructions: 359registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF7C413C84D
RegQueryInfoKeyW.ADVAPI32 ref: 00007FF7C413C8B0
RegEnumKeyExW.ADVAPI32 ref: 00007FF7C413C9E3
RegCloseKey.ADVAPI32 ref: 00007FF7C413CCDA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C413CD0A

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CloseEnumInfoOpenQuery_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3890109837-0
Opcode ID: d1a53bbb5d69a94a16ed45a0e36ab4d779bcdcf0d213a1bf01bb9bc44bcd2376
Instruction ID: d6f15e543169c256608dccb6d896da091cd5c76463dc6fa4dec25ef2c3577bfb
Opcode Fuzzy Hash: d1a53bbb5d69a94a16ed45a0e36ab4d779bcdcf0d213a1bf01bb9bc44bcd2376
Instruction Fuzzy Hash: 6AF18F33A58B9186E710DF66E8801ADB7B0FB54BACF904235DA9D53A98EF38D590C350

Function 00007FF7C40F45F8 Relevance: 1.8, APIs: 1, Instructions: 348COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C40F4B03

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 4234fe7d9ffbb3d36c05a77e151b86e7eaacfa3abc8a9b66635b20f29fb2e8d7
Instruction ID: 6f64dc3230fba3b35b4aaf79c7d2a5b6c3094f278049a87c42a2434ec6a9877b
Opcode Fuzzy Hash: 4234fe7d9ffbb3d36c05a77e151b86e7eaacfa3abc8a9b66635b20f29fb2e8d7
Instruction Fuzzy Hash: C7E1B032A4864286FA68AE67C1D477CA7E1FB557A8F824175CF4D47691CF2CE4E0C328

Function 00007FF7C40C41FC Relevance: 1.8, APIs: 1, Instructions: 314COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C40C4692

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 3b781a240ae162b9da03ee55da720aa796fc86d0f7bbc6572ff14b3c72615291
Instruction ID: 0851007dfe7ac46177f498cae858af7c067ded88354908d715466d3e04d8c5e3
Opcode Fuzzy Hash: 3b781a240ae162b9da03ee55da720aa796fc86d0f7bbc6572ff14b3c72615291
Instruction Fuzzy Hash: 3DC1C072B15B8582DA14DF1AE58426DB3A4FB64BE8F614232DE8D07B95DF78E1D2C300

Function 00007FF7C40C4698 Relevance: 1.8, APIs: 1, Instructions: 313COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C40C4B28

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: d9c27adcec7561452afd5096e476d0e8acf93d3268352a684dbc81c91fe5eee9
Instruction ID: b5dab61e4407a3fc136da62b6bfb9c2799f28c9dd81363a236c7fa4e3943ea49
Opcode Fuzzy Hash: d9c27adcec7561452afd5096e476d0e8acf93d3268352a684dbc81c91fe5eee9
Instruction Fuzzy Hash: 24D19E32A08B85C2DA20DF25E68026AB3A4F754B9CFA15225DF9D07B54DF7CE1E5C341

Function 00007FF7C40C8310 Relevance: 1.8, APIs: 1, Instructions: 286COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C40C86E8

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: a7e537dad34ba72783bbd0f504efa2ca427cfd35dc6a4e205f61720cf0c04d02
Instruction ID: 3f1aa8989409b1c956c7464c29041fc03269fe3ec266bf173e5a90f171f3601c
Opcode Fuzzy Hash: a7e537dad34ba72783bbd0f504efa2ca427cfd35dc6a4e205f61720cf0c04d02
Instruction Fuzzy Hash: 1EA11563B4879582DA24EF13B48406EE764FB95BE4F914132EE8D17B54EF3CE4818704

Function 00007FF7C4094620 Relevance: 1.8, APIs: 1, Instructions: 252COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4094977

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: afe850be9d93aad4f07be341f973cefab4ac3952d48306f1628271cf66f65505
Instruction ID: 7ad8151de17039df7332fe4a742ec95546e425350b9d925e0cc698b92d3fe459
Opcode Fuzzy Hash: afe850be9d93aad4f07be341f973cefab4ac3952d48306f1628271cf66f65505
Instruction Fuzzy Hash: 84A1D362F0C69685FB10EF66D8806BDA7A1BB65BACF864075DE4D17B84DF38D481C320

Function 00007FF7C40585E0 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C40512C0: GetLastError.KERNEL32 ref: 00007FF7C40512CF
Part of subcall function 00007FF7C40512C0: FlsGetValue.KERNEL32 ref: 00007FF7C40512E4
Part of subcall function 00007FF7C40512C0: SetLastError.KERNEL32 ref: 00007FF7C405136F

Part of subcall function 00007FF7C40512C0: FlsSetValue.KERNEL32 ref: 00007FF7C4051305

GetLocaleInfoW.KERNEL32 ref: 00007FF7C4058648

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: 900b5362cedf92cd1298dd0b44a4bc01ccecbd881f8b8c8e53c01bb734b02f26
Instruction ID: 42320195f90448b581c5c86b29ae8b462fb76940176b45fb84b40449a203259b
Opcode Fuzzy Hash: 900b5362cedf92cd1298dd0b44a4bc01ccecbd881f8b8c8e53c01bb734b02f26
Instruction Fuzzy Hash: A631B632A48A4286EB24EF33E4813AEB3A0FB44799F814475DA4D83395DF3CE4908754

Function 00007FF7C4058228 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7C40512C0: GetLastError.KERNEL32 ref: 00007FF7C40512CF
Part of subcall function 00007FF7C40512C0: FlsGetValue.KERNEL32 ref: 00007FF7C40512E4
Part of subcall function 00007FF7C40512C0: SetLastError.KERNEL32 ref: 00007FF7C405136F

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF7C4058A17,?,00000000,00000092,?,?,00000000,?,00007FF7C4048841), ref: 00007FF7C40582C6

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: fcd1d0e915c24937d86626db0e378f0fa692b7176b1ee41891a8c94a49cc2de6
Instruction ID: a05f95ad72f1560b4ea3f95b665a591869419fae82f9466e1a5baa0dd7b71c2a
Opcode Fuzzy Hash: fcd1d0e915c24937d86626db0e378f0fa692b7176b1ee41891a8c94a49cc2de6
Instruction Fuzzy Hash: 5D11D277E48E458AEB14AF16E0802B8BBA0FB50BA8F858135DA69433D0DE68D5E1C754

Function 00007FF7C40587E8 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C40512C0: GetLastError.KERNEL32 ref: 00007FF7C40512CF
Part of subcall function 00007FF7C40512C0: FlsGetValue.KERNEL32 ref: 00007FF7C40512E4
Part of subcall function 00007FF7C40512C0: SetLastError.KERNEL32 ref: 00007FF7C405136F

GetLocaleInfoW.KERNEL32(?,?,?,00007FF7C405858D), ref: 00007FF7C405881F

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: 9184ed228a4ee769309b4505e3af879f3f28d84536c3c316c91a83640034886d
Instruction ID: a1c119eef3776a8ad86ce6eb36ae2460e3611ec44f92462a946e03a0a7dd3125
Opcode Fuzzy Hash: 9184ed228a4ee769309b4505e3af879f3f28d84536c3c316c91a83640034886d
Instruction Fuzzy Hash: 2D113A33E5CA5282E7647F13D080679A2A0FB407B8F954171EF29476C4DE39D8E08754

Function 00007FF7C40582F8 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7C40512C0: GetLastError.KERNEL32 ref: 00007FF7C40512CF
Part of subcall function 00007FF7C40512C0: FlsGetValue.KERNEL32 ref: 00007FF7C40512E4
Part of subcall function 00007FF7C40512C0: SetLastError.KERNEL32 ref: 00007FF7C405136F

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF7C40589D3,?,00000000,00000092,?,?,00000000,?,00007FF7C4048841), ref: 00007FF7C4058376

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 76ec7a8b0537e3056620b15473c057ccbb618670a7280db60b74ee404279d856
Instruction ID: b07f7743e5f413b4b7e9f2f3ebdc2584224b03126fdac1ef2f7d58a8b9af5493
Opcode Fuzzy Hash: 76ec7a8b0537e3056620b15473c057ccbb618670a7280db60b74ee404279d856
Instruction Fuzzy Hash: F301F573F086418AE7106F17E4807BDB2E1FB40BB8F869271DA68472C4DF6894D0C714

Function 00007FF7C42B4600 Relevance: .7, Instructions: 668COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15598170c4e219c1fed1d8407dff443a20c6cac9f33d97d193ea03927027a2aa
Instruction ID: 76e14a18b7bb5fc5eb3841627b335086df994fc250e4e862736193b6db4cab1e
Opcode Fuzzy Hash: 15598170c4e219c1fed1d8407dff443a20c6cac9f33d97d193ea03927027a2aa
Instruction Fuzzy Hash: AC627A72A186518BD7649F2AC0C153C77B1F75DF6CB605236DF0A43789CA3AE891CBA0

Function 00007FF7C4048690 Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: 0c259e7e14965f61cf9cf02e0f74da2cec5e4e7e1a36e7b86064b225628a1674
Instruction ID: 8f6d9aa914ff46c2fe1b0877405687aae9ea85f6b59aa38c5c28a4854aa31fee
Opcode Fuzzy Hash: 0c259e7e14965f61cf9cf02e0f74da2cec5e4e7e1a36e7b86064b225628a1674
Instruction Fuzzy Hash: 86C1E52BA4868245FB60AF6398907BAA7A0FF947ACF815475DE4D47AC4DF3CD581C310

Function 00007FF7C4190154 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09f369739d1dc597dbf4e8c694f92dce2ed7aac6ab24d9d4fde7add358abfa13
Instruction ID: 45002f75296253c48a2a24f4d92779c2dda7a2f906cff76bf13398315c345b91
Opcode Fuzzy Hash: 09f369739d1dc597dbf4e8c694f92dce2ed7aac6ab24d9d4fde7add358abfa13
Instruction Fuzzy Hash: AAC1BF22608B8586EB64AF17F98416AAB72FB55FE8F841431DE9E47795CF3AD180C310

Function 00007FF7C4174120 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9ee84c17bfe5d2bae113dd60a057cb2c01c1fb846ca8572ecb6d5b05cfb7aff
Instruction ID: de8d9aa90750e076e55bbdbf28558d5cd1249229f864611f4ebfa57e40dc815a
Opcode Fuzzy Hash: d9ee84c17bfe5d2bae113dd60a057cb2c01c1fb846ca8572ecb6d5b05cfb7aff
Instruction Fuzzy Hash: 58C18A2660CF9582EA60EE17F184169A761FB49FE8F841531EEDE57795CF38E880C720

Function 00007FF7C42B8130 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e8dbf452419a69db4963a785c829d168b996700be1bd811c9d74d0bf4ac8606
Instruction ID: e4d34945820fa02e74419d4563cfac44ad085963ecf47d32bda2d391e67f7625
Opcode Fuzzy Hash: 0e8dbf452419a69db4963a785c829d168b996700be1bd811c9d74d0bf4ac8606
Instruction Fuzzy Hash: 76C14A63F08F828AF7118F6994425EDB371FB89798F515721EFC922A09EF399255C380

Function 00007FF7C404C1AC Relevance: .2, Instructions: 244COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed021cad9cdc4207a736d9a1c8dbfb8eb28145466836173afe80b3e92b19b51
Instruction ID: b1e8f03f697c5c2776fb13c6dff44523e8271541d83ee4add9b371ce24fda22b
Opcode Fuzzy Hash: 7ed021cad9cdc4207a736d9a1c8dbfb8eb28145466836173afe80b3e92b19b51
Instruction Fuzzy Hash: 74B17E73A4C75585E764AF3A818023CBBA0E745B6CFAB2179CA4E07399CF39D481C764

Function 00007FF7C42B81B0 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17e70c536852cf1c99ba6510785e92bebb3166d3b4351d28670b2176a3f42db9
Instruction ID: dc6d22a6eb1a6874aeefd6c88e4cfdba29d1aca0fddbe914b72b3e593be865e4
Opcode Fuzzy Hash: 17e70c536852cf1c99ba6510785e92bebb3166d3b4351d28670b2176a3f42db9
Instruction Fuzzy Hash: D6719FB37301749BEB648B2E9514AA93390F36A34DFC56115EB8947B81CE3EB921CF50

Function 00007FF7C42B8850 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbdc1a3f118d3b8b859566733d9e33d3283d4ffa3789efa3bcfdd3670eea43d7
Instruction ID: a99dc27186e6dfcf416fec6631f43dbe44c346173d2565457c2688690a7e2928
Opcode Fuzzy Hash: dbdc1a3f118d3b8b859566733d9e33d3283d4ffa3789efa3bcfdd3670eea43d7
Instruction Fuzzy Hash: 5A1163DBC1EF9906EA037B3F9883551A710AFE34E8E50E762EDF030271EB1975185224

Function 00007FF7C419C344 Relevance: 40.7, APIs: 13, Strings: 10, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C419C911
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C419C917
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C419C91D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C419C923
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C419C929
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C419C92F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C419C935
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C419C93B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C419C941
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C419C947
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C419C94D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C419C953
_Mtx_unlock.LIBCPMT ref: 00007FF7C419C98F

Strings

unmetered, xrefs: 00007FF7C419C477
restricted, xrefs: 00007FF7C419C647
roaming, xrefs: 00007FF7C419C6BE
charging, xrefs: 00007FF7C419C88C
high, xrefs: 00007FF7C419C5D6
any, xrefs: 00007FF7C419C389, 00007FF7C419C72F
unknown, xrefs: 00007FF7C419C406, 00007FF7C419C7A7
low, xrefs: 00007FF7C419C4EE
battery, xrefs: 00007FF7C419C818
metered, xrefs: 00007FF7C419C55F

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Mtx_unlock
String ID: any$battery$charging$high$low$metered$restricted$roaming$unknown$unmetered
API String ID: 3867719841-4065239879
Opcode ID: d183e2ec0e6e08642421b63d5d253ebf0944c1f0d9bb727fc0970d525b91d77a
Instruction ID: 73091646e3cf29f0b83daf7d2d1f6bc78a22a824be1a6e4525b801281c50d05a
Opcode Fuzzy Hash: d183e2ec0e6e08642421b63d5d253ebf0944c1f0d9bb727fc0970d525b91d77a
Instruction Fuzzy Hash: 3902A662F1474685FF00AF6AD8850AC6771BB94BBCF905635CEAC227D5EE38D185C320

Function 00007FF7C4194144 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 301libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C4194090: RegGetValueA.ADVAPI32 ref: 00007FF7C4194102

GetModuleHandleW.KERNEL32 ref: 00007FF7C4194195
GetProcAddress.KERNEL32 ref: 00007FF7C41941AA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C41945E8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C41945EE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C41945F4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C41945FA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4194600
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4194606
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C419460C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4194612
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4194618
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C419461E

Strings

ntdll.dll, xrefs: 00007FF7C419418E
RtlGetVersion, xrefs: 00007FF7C41941A0

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$AddressHandleModuleProcValue
String ID: RtlGetVersion$ntdll.dll
API String ID: 141191560-1489217083
Opcode ID: 134a1a10571099d73d65468c9fb3fcc99357a9d57261c7da29bb03641f954fe4
Instruction ID: 26e802cfd895f3234cd575a23852e34793ed439617d7f19671c0a4ad5d267d9c
Opcode Fuzzy Hash: 134a1a10571099d73d65468c9fb3fcc99357a9d57261c7da29bb03641f954fe4
Instruction Fuzzy Hash: 70C19652A196C246EE10AF7BD8853EDA352FB95BBCF805731D96C467D6EE2CE140C310

Function 00007FF7C4038250 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF7C4038266
GetModuleHandleW.KERNEL32 ref: 00007FF7C4038273
GetModuleHandleW.KERNEL32 ref: 00007FF7C4038288
GetProcAddress.KERNEL32 ref: 00007FF7C40382A0
GetProcAddress.KERNEL32 ref: 00007FF7C40382B3
CreateEventW.KERNEL32 ref: 00007FF7C40382DF
DeleteCriticalSection.KERNEL32 ref: 00007FF7C403832B
CloseHandle.KERNEL32 ref: 00007FF7C403833D

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF7C403826C
SleepConditionVariableCS, xrefs: 00007FF7C4038296
WakeAllConditionVariable, xrefs: 00007FF7C40382A6
kernel32.dll, xrefs: 00007FF7C4038281

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 7934b5ba7122d8acefc61b9f8ca4447883364d440483a89aa90a2f1bb12528f8
Instruction ID: 70e9f6378e28ca160412488f453968c9b1012699f400ff116445394542b90533
Opcode Fuzzy Hash: 7934b5ba7122d8acefc61b9f8ca4447883364d440483a89aa90a2f1bb12528f8
Instruction Fuzzy Hash: 30215C21E59A0381FE55FF22E9D55B4AAE0BF847A9FC500B5C90E027A0EE2DF585C224

Function 00007FF7C4034560 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4034595
_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4034679
CompareFileTime.KERNEL32 ref: 00007FF7C4034762

Strings

StandaloneUpdaterCustomerPromises::GetUpdateFailedReason, xrefs: 00007FF7C40345DE, 00007FF7C40346C2
HKLM, xrefs: 00007FF7C403476F
D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdaterCustomerPromises.cpp, xrefs: 00007FF7C4034602, 00007FF7C40346E6
exists, xrefs: 00007FF7C40345EF, 00007FF7C40346D3
HKCU, xrefs: 00007FF7C4034780
c#VC, xrefs: 00007FF7C4034610

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource$CompareFileTime
String ID: D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdaterCustomerPromises.cpp$HKCU$HKLM$StandaloneUpdaterCustomerPromises::GetUpdateFailedReason$c#VC$exists
API String ID: 3974154690-2352077611
Opcode ID: 9598d16ede45ebcd11af43290055f66013bddbb2d6d496c5389fdc4f0f6551aa
Instruction ID: 33f68e4ff5e1570d424040d3aed4b438cfe0610be8b47146510b631f34811fbb
Opcode Fuzzy Hash: 9598d16ede45ebcd11af43290055f66013bddbb2d6d496c5389fdc4f0f6551aa
Instruction Fuzzy Hash: E8715C36B08A0299EB10EF62D8816ACB764FB887ACF810136DE4D537A8CF7DD145C754

Function 00007FF7C411427C Relevance: 15.1, APIs: 10, Instructions: 135COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C4116868), ref: 00007FF7C41142AE
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C4116868), ref: 00007FF7C41142BE
GetTokenInformation.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C4116868), ref: 00007FF7C41142EE
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C4116868), ref: 00007FF7C41142F8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C4116868), ref: 00007FF7C4114308
GetTokenInformation.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C4116868), ref: 00007FF7C411434B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C4116868), ref: 00007FF7C4114355
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C4116868), ref: 00007FF7C4114394
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C4116868), ref: 00007FF7C4114419
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7C4116868), ref: 00007FF7C411442C

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ErrorLast$Token$Information$CloseFreeHandleLocalOpenProcess
String ID:
API String ID: 1214604485-0
Opcode ID: 4d1671f3988bdea75c5ac188db1e51470793b67e48a794a91f1382d0997262a5
Instruction ID: f753c1f990a89bce410c9487b9444127ee63f00e30830111bde81c23e7633367
Opcode Fuzzy Hash: 4d1671f3988bdea75c5ac188db1e51470793b67e48a794a91f1382d0997262a5
Instruction Fuzzy Hash: 82514162F14B5286F710AFA7E8C11BDA3B0BF44B6DB804536CE8D63655DF3CE5458220

Function 00007FF7C40B02E0 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 185COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C40B03EC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C40B0594
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C40B059A

Strings

TRANSMIT_IMMEDIATE, xrefs: 00007FF7C40B0559
OD_CUSTOM_PROFILE, xrefs: 00007FF7C40B041B
LoggingTelemetrySession::UpdateTelemetryTransmissionProfile, xrefs: 00007FF7C40B051F, 00007FF7C40B0539, 00007FF7C40B056A
#, xrefs: 00007FF7C40B0346
d:\dbs\sh\odct\0223_153807_0\cmd\o\client\onedrive\Product\Logging\LoggingTelemetrySession.cpp, xrefs: 00007FF7C40B052B, 00007FF7C40B0545, 00007FF7C40B0576

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: #$LoggingTelemetrySession::UpdateTelemetryTransmissionProfile$OD_CUSTOM_PROFILE$TRANSMIT_IMMEDIATE$d:\dbs\sh\odct\0223_153807_0\cmd\o\client\onedrive\Product\Logging\LoggingTelemetrySession.cpp
API String ID: 3668304517-581840345
Opcode ID: 0e0725cf11d324ebdb768aad1b3a11227ce35e813cbfbe78fe0725463b4a1041
Instruction ID: 2844ba22ae2ad0a47e2faf204d6560fe94cebe44e7c8e4cd8885f1ef95e10e30
Opcode Fuzzy Hash: 0e0725cf11d324ebdb768aad1b3a11227ce35e813cbfbe78fe0725463b4a1041
Instruction Fuzzy Hash: A671AE62B58B4685FB10AF66D4843ADA371AB44BBCF854271DE1C06AE5DF2DE480C328

Function 00007FF7C40FC834 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 354COMMON

Download Yara Rule

Strings

ECSConfigurationParser::GetSettingsFromJsonObject, xrefs: 00007FF7C40FC87B, 00007FF7C40FCBF4, 00007FF7C40FCCEE
-NodeType:, xrefs: 00007FF7C40FC9CD
d:\dbs\sh\odct\0223_153807_0\cmd\1k\client\onedrive\Product\UpdateRingSettings\ECSConfigurationParser.cpp, xrefs: 00007FF7C40FC885, 00007FF7C40FCBFB, 00007FF7C40FCCFA
-NodeType:NullNode, xrefs: 00007FF7C40FCBC0

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID:
String ID: -NodeType:$-NodeType:NullNode$ECSConfigurationParser::GetSettingsFromJsonObject$d:\dbs\sh\odct\0223_153807_0\cmd\1k\client\onedrive\Product\UpdateRingSettings\ECSConfigurationParser.cpp
API String ID: 0-1770375861
Opcode ID: cfd949ca7c23218a35a796e3d5740a6968ce0b9e841efda83714a66632ed68d5
Instruction ID: 6f6dc3b8b5d67de477ad2b31d3001b9fd43104ef327074e2412f55ceead3c153
Opcode Fuzzy Hash: cfd949ca7c23218a35a796e3d5740a6968ce0b9e841efda83714a66632ed68d5
Instruction Fuzzy Hash: ABE1C222B58A8185FB00EF66D4C12ADA7B1FB85BACF814136DA0D176D5DF3CE581C350

Function 00007FF7C41B45C0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 180COMMON

Download Yara Rule

APIs

_Mtx_unlock.LIBCPMT ref: 00007FF7C41B46D1

Part of subcall function 00007FF7C4079480: std::ios_base::failure::failure.LIBCPMT ref: 00007FF7C40796D1

std::runtime_error::runtime_error.LIBCPMT ref: 00007FF7C41B477C

Part of subcall function 00007FF7C41B4128: __std_exception_copy.LIBVCRUNTIME ref: 00007FF7C41B4164

Part of subcall function 00007FF7C403A478: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C401B651,?,?,?,?,00007FF7C40016C7), ref: 00007FF7C403A4BC
Part of subcall function 00007FF7C403A478: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C401B651,?,?,?,?,00007FF7C40016C7), ref: 00007FF7C403A502

shared_ptr.LIBCPMT ref: 00007FF7C41B4805
_Mtx_unlock.LIBCPMT ref: 00007FF7C41B481F

Strings

' is already registered, xrefs: 00007FF7C41B4759
Viewer: ', xrefs: 00007FF7C41B473B
nullptr passed for data viewer, xrefs: 00007FF7C41B4793

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Mtx_unlock$ExceptionFileHeaderRaise__std_exception_copyshared_ptrstd::ios_base::failure::failurestd::runtime_error::runtime_error
String ID: ' is already registered$Viewer: '$nullptr passed for data viewer
API String ID: 725075926-3957438740
Opcode ID: 81cd5a1e18a72653ac46f2bee7b4f3ad58a1024eb5ff01dcde9e2c85243aee36
Instruction ID: 4c211a8abd3abb4266d0385f90b1f1afb05c6f66888d5cfdf63df24a072d5335
Opcode Fuzzy Hash: 81cd5a1e18a72653ac46f2bee7b4f3ad58a1024eb5ff01dcde9e2c85243aee36
Instruction Fuzzy Hash: AF717272A19A4182EB10AF27E4802BDA3A4FB85FA8F949132DE9D477A5DF3CD441C750

Function 00007FF7C40C07AC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187memoryCOMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 00007FF7C40C0801
SysAllocStringLen.OLEAUT32 ref: 00007FF7C40C083B
SysStringLen.OLEAUT32 ref: 00007FF7C40C0853
SysFreeString.OLEAUT32 ref: 00007FF7C40C08AC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C40C090A

Strings

OneDrive Standalone Update Task, xrefs: 00007FF7C40C09BD

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: String$AllocFree_invalid_parameter_noinfo
String ID: OneDrive Standalone Update Task
API String ID: 1379249218-1505381665
Opcode ID: 30fc1179a9369d8b959fe8951d99ce1d6ae0bb4536113bec9f75bae370621c77
Instruction ID: c421847dd232474cb78f457f0134b656d5eb9086cb74142e8115e61e367c61c4
Opcode Fuzzy Hash: 30fc1179a9369d8b959fe8951d99ce1d6ae0bb4536113bec9f75bae370621c77
Instruction Fuzzy Hash: B371C832B48746C6EB24AF579580279E2A0FF84BA8F858235DE4D43791DF3CE485C751

Function 00007FF7C419C154 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 112COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C419B2D4: _Mtx_unlock.LIBCPMT ref: 00007FF7C419B335

_Mtx_unlock.LIBCPMT ref: 00007FF7C419C321

Part of subcall function 00007FF7C4175CE4: GetSystemTime.KERNEL32 ref: 00007FF7C4175FC3
Part of subcall function 00007FF7C4175CE4: GetCurrentThreadId.KERNEL32 ref: 00007FF7C4175FD4
Part of subcall function 00007FF7C4175CE4: OutputDebugStringA.KERNEL32 ref: 00007FF7C41760B2

Strings

Profile %s rule %iz has no timers, xrefs: 00007FF7C419C2D8
Profile %s current rule %iz >= profile length %iz, xrefs: 00007FF7C419C27E
No active profile found, disabling all transmission timers., xrefs: 00007FF7C419C1D7
gfffffff, xrefs: 00007FF7C419C1F8
REAL_TIME, xrefs: 00007FF7C419C195

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Mtx_unlock$CurrentDebugOutputStringSystemThreadTime
String ID: No active profile found, disabling all transmission timers.$Profile %s current rule %iz >= profile length %iz$Profile %s rule %iz has no timers$REAL_TIME$gfffffff
API String ID: 2624072379-2916182173
Opcode ID: 697f153174fb6c1a49dd756f1ad09bd5a3c18d7f1987f6a7e231e06b48a90a4f
Instruction ID: 078067669f1d8fa44364658c1751a808f8ff1356e74af7359bb5a7e5d49afae3
Opcode Fuzzy Hash: 697f153174fb6c1a49dd756f1ad09bd5a3c18d7f1987f6a7e231e06b48a90a4f
Instruction Fuzzy Hash: B7517E71A0874282EA50BF27F9841A8A351EB94BF8F804336D9AD977E5DF3DE541C321

Function 00007FF7C4138644 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 201COMMON

Download Yara Rule

APIs

CompareStringOrdinal.KERNEL32 ref: 00007FF7C41388A4
CompareStringOrdinal.KERNEL32 ref: 00007FF7C41388E1

Strings

Personal, xrefs: 00007FF7C41387B8
{a52bba46-e9e1-435f-b3d9-28daa648c0f6}, xrefs: 00007FF7C413889A
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace, xrefs: 00007FF7C41386A1

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CompareOrdinalString
String ID: Personal$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace${a52bba46-e9e1-435f-b3d9-28daa648c0f6}
API String ID: 2409332303-3553581249
Opcode ID: d2bde10a4d890579d0dec3a90e3179e81c8e16f90a02e7ea2804f89de69160fe
Instruction ID: 0d6c3fbd338957a58201629126fdae3183ee01bf909072d512d1f54256e6a863
Opcode Fuzzy Hash: d2bde10a4d890579d0dec3a90e3179e81c8e16f90a02e7ea2804f89de69160fe
Instruction Fuzzy Hash: 75816D32B48B0196EB10EF66E4801EDA7B1FB957ACF900136DE8D52A99DF3CE549C350

Function 00007FF7C40F4224 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 157COMMON

Download Yara Rule

APIs

std::ios_base::failure::failure.LIBCPMT ref: 00007FF7C40F4407
std::ios_base::failure::failure.LIBCPMT ref: 00007FF7C40F445B

Strings

ios_base::failbit set, xrefs: 00007FF7C40F43DB, 00007FF7C40F442F
ios_base::badbit set, xrefs: 00007FF7C40F43CF, 00007FF7C40F4423
ios_base::eofbit set, xrefs: 00007FF7C40F43E2, 00007FF7C40F4436

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: std::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2264918676-1866435925
Opcode ID: 3df389681227d844e12be39d85f0a25d6fb1667d63837fabcb923040ac3b4875
Instruction ID: 8bda3b0e894d7f4816fff11ebc66612c0dc02f2748a764a2691d08e024a6f11e
Opcode Fuzzy Hash: 3df389681227d844e12be39d85f0a25d6fb1667d63837fabcb923040ac3b4875
Instruction Fuzzy Hash: 1B617122648A4681EB54AF16D4D13BDA7A0FF90BACF868076CE4E437A5CF6CD485C364

Function 00007FF7C41B4850 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 126COMMON

Download Yara Rule

APIs

_Mtx_unlock.LIBCPMT ref: 00007FF7C41B4959

Part of subcall function 00007FF7C4079480: std::ios_base::failure::failure.LIBCPMT ref: 00007FF7C40796D1

std::runtime_error::runtime_error.LIBCPMT ref: 00007FF7C41B49E7

Part of subcall function 00007FF7C41B4128: __std_exception_copy.LIBVCRUNTIME ref: 00007FF7C41B4164

Part of subcall function 00007FF7C403A478: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C401B651,?,?,?,?,00007FF7C40016C7), ref: 00007FF7C403A4BC
Part of subcall function 00007FF7C403A478: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C401B651,?,?,?,?,00007FF7C40016C7), ref: 00007FF7C403A502

Strings

' is not currently registered, xrefs: 00007FF7C41B49C4
Viewer: ', xrefs: 00007FF7C41B49A4
nullptr passed for viewer name, xrefs: 00007FF7C41B49FE

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: ExceptionFileHeaderMtx_unlockRaise__std_exception_copystd::ios_base::failure::failurestd::runtime_error::runtime_error
String ID: ' is not currently registered$Viewer: '$nullptr passed for viewer name
API String ID: 195388382-4062399862
Opcode ID: 031faa4ea3df161d2d1336911bac14bc50a905cacf38a14d1c86a893344cf22e
Instruction ID: 844017e63c288753fa1f4d91b8e60c258756a4c25be38f4bc5a3918978808681
Opcode Fuzzy Hash: 031faa4ea3df161d2d1336911bac14bc50a905cacf38a14d1c86a893344cf22e
Instruction Fuzzy Hash: E0517672B45A4292EA10EF27E4812ADA360FB84BB8F849131DE9D476A5DF3CD545C710

Function 00007FF7C403C6E0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7C403C750
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7C403C79B

Strings

MOC, xrefs: 00007FF7C403C764
RCC, xrefs: 00007FF7C403C76C

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: d0ccb143cfec8bd3d3a8f4f3222803ec5a5273aaf7a0b38131afa4e5190723ed
Instruction ID: 88cf9148146deefc2bd8765b9edd4106fe650488e76aad2f541ced57b4f57991
Opcode Fuzzy Hash: d0ccb143cfec8bd3d3a8f4f3222803ec5a5273aaf7a0b38131afa4e5190723ed
Instruction Fuzzy Hash: 7991BF73A48B818AE710EF66E9803ADBBA0FB4479CF51412AEE8C57755DF38D195CB00

Function 00007FF7C4018830 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 176COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C4018873

Part of subcall function 00007FF7C4019AF8: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C4019BC6

Strings

D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdater.cpp, xrefs: 00007FF7C4018AA9
version, xrefs: 00007FF7C4018A45
StandaloneUpdater::SetMaxPerUserProductVersion, xrefs: 00007FF7C4018A9C

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resourceConcurrency::cancel_current_task
String ID: D:\dbs\sh\odct\0417_205450_0\cmd\1l\client\onedrive\Product\StandaloneUpdater\standaloneupdaterlib\StandaloneUpdater.cpp$StandaloneUpdater::SetMaxPerUserProductVersion$version
API String ID: 3100672956-1118071478
Opcode ID: 51fac543b52c855cd3328d4f98a497e93d6d9edf9451f8883ada97d8b0477e55
Instruction ID: b2801a1152ba2903e5d71c2efd9f27a8d01ab97a3842e07c8de71292e85340b3
Opcode Fuzzy Hash: 51fac543b52c855cd3328d4f98a497e93d6d9edf9451f8883ada97d8b0477e55
Instruction Fuzzy Hash: 82814732B44E429AEB10EF66D4C01EC7371FB947ACB810136EA4D27AA9EF38D555C354

Function 00007FF7C40C0594 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C402C9DC: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C402CA08

std::ios_base::failure::failure.LIBCPMT ref: 00007FF7C40C075D

Strings

ios_base::failbit set, xrefs: 00007FF7C40C0731
ios_base::badbit set, xrefs: 00007FF7C40C0725, 00007FF7C40C0780
ios_base::eofbit set, xrefs: 00007FF7C40C0738

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: LockitLockit::_std::_std::ios_base::failure::failure
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1478341485-1866435925
Opcode ID: 20557b6a8990bdc54b5e63833a755f472b752bea3fc15f9632e01408c05c3b14
Instruction ID: 034dc214fc192eab55d267f7fcd7b2c474f1dc678e067124ccbf515e4273f9da
Opcode Fuzzy Hash: 20557b6a8990bdc54b5e63833a755f472b752bea3fc15f9632e01408c05c3b14
Instruction Fuzzy Hash: DC519E72A48B8582EB10EF5AE4C03A9E760FBC4B98F858132DA8C47B65DF7DD485C710

Function 00007FF7C4184854 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C41849F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C41849F7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C41849FD

Strings

invalid_iterator, xrefs: 00007FF7C418489C

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: invalid_iterator
API String ID: 3668304517-2508626007
Opcode ID: 3e9db08025722f21c4f13ba2575d278146d25e97c37426ce44209fdb5791862b
Instruction ID: 20d20d815e719131a295e1e40158ae530ec66a3a0d8ac6bf1b327e16305d8e05
Opcode Fuzzy Hash: 3e9db08025722f21c4f13ba2575d278146d25e97c37426ce44209fdb5791862b
Instruction Fuzzy Hash: 1641A462F14A4545FB10EF6AE4853ACA361AB89BBCF815735DE6C176CAEE2CD1808350

Function 00007FF7C41982F8 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 235COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C4198470

Strings

gfffffff, xrefs: 00007FF7C41984A4

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: gfffffff
API String ID: 3668304517-1523873471
Opcode ID: 4926bbbb928c2598666776ecc0cbc4f6b87253b78e4f7ac3b77995c1c7563c4d
Instruction ID: 1aa21d1f30d404e61ea503d16c9a87b31ec34b35a329a3d82d125ab420861317
Opcode Fuzzy Hash: 4926bbbb928c2598666776ecc0cbc4f6b87253b78e4f7ac3b77995c1c7563c4d
Instruction Fuzzy Hash: C381F162B14A8542EE04AF17F9802A9A751FB58FD8F888435DF9D4BB55DF3CE1628301

Function 00007FF7C41B4220 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

_Mtx_unlock.LIBCPMT ref: 00007FF7C41B432D
_Mtx_unlock.LIBCPMT ref: 00007FF7C41B4343

Strings

nullptr passed for viewer name, xrefs: 00007FF7C41B436E

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Mtx_unlock
String ID: nullptr passed for viewer name
API String ID: 1418687624-3904132613
Opcode ID: 157a384f6c0c88933729d59f0ab06537c1c90a6ff182471720c7605449ad14bc
Instruction ID: cbe5b6119845b42c8d4fdf6c8bd8f08d5559b5ed612c6ad7d74fd9676eb82cec
Opcode Fuzzy Hash: 157a384f6c0c88933729d59f0ab06537c1c90a6ff182471720c7605449ad14bc
Instruction Fuzzy Hash: 3D515E72A08A5582EA64AF27F58127CA360FB84FB8F988231DE9D437A5DF3CD441C710

Function 00007FF7C4018630 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

_Aligned_get_default_resource.LIBCPMT ref: 00007FF7C40186CC

Strings

Software\Microsoft\OneDrive, xrefs: 00007FF7C4018727
Version, xrefs: 00007FF7C40186FA

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: Aligned_get_default_resource
String ID: Software\Microsoft\OneDrive$Version
API String ID: 628915230-344254544
Opcode ID: 0698cf9696835d39b50fdb7c675b180e4a512da826b017931116504b780d21c4
Instruction ID: 33b6724a9e19562ed0e056bd63e83274fd360924d4bd5d3137ba39a5d98eb531
Opcode Fuzzy Hash: 0698cf9696835d39b50fdb7c675b180e4a512da826b017931116504b780d21c4
Instruction Fuzzy Hash: D2516D33B04A819AEB10EF66D4802ED6371FB84B9CF855136EA4D63B69EF38D650C354

Function 00007FF7C405C1AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_set_errno_from_matherr.LIBCMT ref: 00007FF7C405C200
_set_errno_from_matherr.LIBCMT ref: 00007FF7C405C26D

Strings

exp, xrefs: 00007FF7C405C1DB

Memory Dump Source

Source File: 00000000.00000002.2899553634.00007FF7C4001000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7C4000000, based on PE: true

Associated: 00000000.00000002.2899360126.00007FF7C4000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900140362.00007FF7C42E9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900415218.00007FF7C43BF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900445177.00007FF7C43C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900500105.00007FF7C43CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900527412.00007FF7C43CB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900560114.00007FF7C43DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C43E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2900692178.00007FF7C4401000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c4000000_OneDriveUpdater.jbxd

Similarity

API ID: _set_errno_from_matherr
String ID: exp
API String ID: 1187470696-113136155
Opcode ID: f6b7601b6d44efb385b7349c102ec396340d0876a401fade95c56295c57b4bc5
Instruction ID: 749f3d9fdb45731bee6cc2ffd06e1f0af37e3764447ba590e469ca2223de20a3
Opcode Fuzzy Hash: f6b7601b6d44efb385b7349c102ec396340d0876a401fade95c56295c57b4bc5
Instruction Fuzzy Hash: 98215E36F18A158EE740EF79D4806AC73F0FB49358F811536EA0D92B49DF38E4818B58

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report OneDriveUpdater.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\PreSignInSettingsConfig.json

C:\Users\user\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\Update.xml

C:\Users\user\AppData\Local\Microsoft\OneDrive\Update\Update.xml

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\DeviceHealthSummaryConfiguration.ini

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\StandaloneUpdater-2024-07-04.2340.7252.1.aodl

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\StandaloneUpdate_2024-07-04_234035_7252-7256.log

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
OneDriveUpdater.exe

Function 00007FF7C41317B8 Relevance: 73.3, APIs: 1, Strings: 40, Instructions: 1520
COMMON

Function 00007FF7C4026C30 Relevance: 51.6, APIs: 6, Strings: 23, Instructions: 868
COMMON

Function 00007FF7C4103E90 Relevance: 46.3, APIs: 9, Strings: 17, Instructions: 808
COMMON

Function 00007FF7C401D018 Relevance: 43.9, Strings: 34, Instructions: 1366
COMMON

Function 00007FF7C4014748 Relevance: 36.0, APIs: 7, Strings: 13, Instructions: 960
COMMON

Function 00007FF7C41129C0 Relevance: 32.0, APIs: 5, Strings: 13, Instructions: 529
COMMON

Function 00007FF7C40E1558 Relevance: 32.0, APIs: 2, Strings: 16, Instructions: 480
synchronizationCOMMON

Function 00007FF7C406521C Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 349
filetimeCOMMON

Function 00007FF7C4165224 Relevance: 27.5, APIs: 18, Instructions: 509
COMMON

Function 00007FF7C4120034 Relevance: 27.2, APIs: 18, Instructions: 233
encryptionCOMMON

Function 00007FF7C411BE6C Relevance: 26.6, APIs: 9, Strings: 6, Instructions: 348
COMMON

Function 00007FF7C4025280 Relevance: 25.0, APIs: 1, Strings: 13, Instructions: 493
COMMON

Function 00007FF7C4013820 Relevance: 33.9, APIs: 3, Strings: 16, Instructions: 621
COMMON

Function 00007FF7C4105CF0 Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 168
synchronizationCOMMON