Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
Analysis ID:	1510261
MD5:	45a5a443c01abd7618efef4827241312
SHA1:	5390d36a371f0598b86301961d5fdb329e368e7a
SHA256:	d7f98b8af8a3bfe9d93ce31558a62e4d5d0cd425bc30bbc0d517901e5b82bf46
Tags:	exe
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

System process connects to network (likely due to code injection or exploit)

Contains functionality to automate explorer (e.g. start an application)

Query firmware table information (likely to detect VMs)

Sigma detected: Explorer NOUACCHECK Flag

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (foreground window change detection)

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses taskkill to terminate processes

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe (PID: 2300 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe" MD5: 45A5A443C01ABD7618EFEF4827241312)

taskkill.exe (PID: 2848 cmdline: "C:\Windows\system32\taskkill.exe" /f /im explorer.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 5604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 1408 cmdline: "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4076 cmdline: "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 4552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

regsvr32.exe (PID: 4940 cmdline: "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

regsvr32.exe (PID: 5048 cmdline: "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

explorer.exe (PID: 1828 cmdline: "C:\Windows\explorer.exe" MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 2980 cmdline: C:\Windows\explorer.exe /NoUACCheck MD5: 662F4F92FDE3557E86D110526BB578D5)

cleanup

Sigma Signatures

System Summary

Sigma detected: Explorer NOUACCHECK Flag

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\explorer.exe /NoUACCheck, CommandLine: C:\Windows\explorer.exe /NoUACCheck, CommandLine|base64offset|contains: y, Image: C:\Windows\explorer.exe, NewProcessName: C:\Windows\explorer.exe, OriginalFileName: C:\Windows\explorer.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1068, ProcessCommandLine: C:\Windows\explorer.exe /NoUACCheck, ProcessId: 2980, ProcessName: explorer.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-12T18:31:25.080721+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49711	140.82.121.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Windows\explorer.exe

Code function: 10_2_00007FF8BEE4FE80 CreateFileW,GetLastError,GetFileSizeEx,GetLastError,CloseHandle,CloseHandle,CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,GetLastError,CryptDestroyHash,CryptReleaseContext,CloseHandle,

10_2_00007FF8BEE4FE80

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Directory created: C:\Program Files\ExplorerPatcher	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_setup.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Directory created: C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Directory created: C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_gui.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_dwm.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_weather_host.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Directory created: C:\Program Files\ExplorerPatcher\WebView2Loader.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher

Jump to behavior

Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.5:49718 version: TLS 1.2

Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\_work\e\src\out\Release_x64\WebView2Loader.dll.pdb source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2145293156.000001BF13B8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /download/symbols/twinui.pcshell.pdb/56A53B20B8D4F79E69038072C21547311/twinui.pcshell.pdb source: explorer.exe, 0000000B.00000003.2234944578.0000000002E7D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2332407476.0000000002E7D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: twinui.pcshell.pdb source: explorer.exe, 0000000A.00000003.2167375925.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2174577379.00000000023D5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2178744483.0000000002D5E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2176793588.00000000023D4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: http://msdl.microsoft.com/download/symbols/twinui.pcshell.pdb/56A53B20B8D4F79E69038072C21547311/twinui.pcshell.pdb source: explorer.exe, 0000000B.00000003.2198671395.0000000002ED7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2192876585.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235994933.0000000002F37000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2246571830.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2192876585.0000000002F48000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2193206748.0000000002EBD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2288267379.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2198671395.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2252874097.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235994933.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2204325725.0000000002F33000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2320144168.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2381212820.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2234944578.0000000002F37000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2234944578.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ExplorerPatcher.amd64.pdb source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2146053134.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_weather_host_stub.pdb source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2145109319.000001BF13BA7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2145084872.000001BF13B8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\WebView2Loader.dll.pdbOGP source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2145293156.000001BF13B8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: http://msdl.microsoft.com/download/symbols/twinui.pcshell.pdb/56A53B20B8D4F79E69038072C21547311/twinui.pcshell.pdby source: explorer.exe, 0000000B.00000003.2192876585.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2198671395.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_dwm.pdb source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144537598.000001BF13B8D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144601951.000001BF13BA9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: StartUI.pdb source: explorer.exe, 0000000A.00000003.2166635686.00000000027EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2175731585.00000000023D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pcshell.pdb source: explorer.exe, 0000000B.00000003.2235994933.0000000002F37000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2246571830.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2288267379.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2252874097.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2204325725.0000000002F33000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2320144168.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2381212820.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2234944578.0000000002F37000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: {"function" : "getkfmupsellstate", "args" : {}}.pdb source: explorer.exe, 0000000B.00000003.2377129178.000000000AF04000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: http://msdl.microsoft.com/download/symbols/twinui.pcshell.pdb/56A53B20B8D4F79E69038072C21547311/twinui.pcshell.pdbb source: explorer.exe, 0000000B.00000003.2198671395.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: http://msdl.microsoft.com/download/symbols/twinui.pcshell.pdb/56A53B20B8D4F79E69038072C21547311/twinui.pcshell.pdb! source: explorer.exe, 0000000B.00000003.2192876585.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2246571830.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2288267379.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2198671395.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2252874097.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235994933.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2320144168.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2234944578.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\ExplorerPatcher\twinui.pcshell.pdb{ source: explorer.exe, 0000000B.00000003.2377129178.000000000AF04000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\Win32\ExplorerPatcher.IA-32.pdb source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2143630593.000001BF13BB2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2143599851.000001BF13B8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_setup.pdb source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000002.2165080505.00007FF7F56F6000.00000002.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000000.2108533057.00007FF7F56F6000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\ExplorerPatcher\twinui.pcshell.pdb source: explorer.exe, 0000000B.00000003.2377129178.000000000AF04000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2383069605.0000000008B96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_gui.pdb source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_weather_host.pdb source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144908523.000001BF13B8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: http://msdl.microsoft.com/download/symbols/twinui.pcshell.pdb/56A53B20B8D4F79E69038072C21547311/twinui.pcshell.pdbO source: explorer.exe, 0000000B.00000003.2235994933.0000000002F37000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2246571830.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2288267379.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2252874097.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2204325725.0000000002F33000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2320144168.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2381212820.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2234944578.0000000002F37000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: StartUI.pdbH source: explorer.exe, 0000000A.00000003.2166635686.00000000027EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2175731585.00000000023D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: twinui.pcshell.pdbUGP source: explorer.exe, 0000000A.00000003.2167375925.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2174577379.00000000023D5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2178744483.0000000002D5E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2176793588.00000000023D4000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE2DB90 InitializeCriticalSection,CreateEventW,CreateEventW,CreateEventW,SetEvent,SetEvent,SetEvent,CreateThread,CloseHandle,SHGetFolderPathW,PathFileExistsW,CreateDirectoryW,CreateMutexExW,CreateEventW,CreateEventW,CreateThread,CreateThread,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleW,GetCurrentProcess,K32GetModuleInformation,GetModuleHandleW,GetProcAddress,IsOS,GetCurrentProcess,K32GetModuleInformation,LoadLibraryW,LoadLibraryW,GetProcAddress,CreateWindowExW,FreeLibraryAndExitThread,SetWindowLongPtrW,FreeLibraryAndExitThread,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,LoadLibraryExW,LoadLibraryExW,LoadLibraryExW,LoadLibraryExW,GetModuleHandleW,GetProcAddress,SHELL32_Create_IEnumUICommand,VirtualProtect,VirtualProtect,GetProcAddress,VirtualProtect,VirtualProtect,LoadLibraryW,GetProcAddress,LoadLibraryW,GetModuleHandleExW,GetCurrentProcess,K32GetModuleInformation,VirtualProtect,VirtualProtect,GetCurrentProcess,K32GetModuleInformation,LoadLibraryW,LoadLibraryW,GetProcAddress,LoadLibraryExW,IsOS,FreeLibraryAndExitThread,CreateThread,CreateThread,RegDeleteKeyValueW,RegDeleteKeyValueW,CreateThread,CreateThread,CreateWindowInBand,CreateThread,CreateThread,GetWindowsDirectoryW,FindFirstFileW,FindClose,LoadLibraryW,GetProcAddress,GetLastError,	10_2_00007FF8BEE2DB90
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE45CF0 RegCreateKeyExW,GetWindowsDirectoryW,RegQueryValueExA,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegDeleteTreeW,RegCreateKeyExW,GetSystemDirectoryW,RegQueryValueExA,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegCloseKey,RegDeleteTreeW,RegCreateKeyExW,GetWindowsDirectoryW,RegQueryValueExA,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegDeleteTreeW,RegCreateKeyExW,GetWindowsDirectoryW,FindFirstFileW,FindClose,GetWindowsDirectoryW,RegQueryValueExA,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegDeleteTreeW,RegCreateKeyExW,RegDeleteValueW,RegCloseKey,	10_2_00007FF8BEE45CF0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE1CE30 CreateFileA,CreateFileMappingW,CloseHandle,MapViewOfFile,CloseHandle,CloseHandle,UnmapViewOfFile,CloseHandle,CloseHandle,UnmapViewOfFile,CloseHandle,CloseHandle,UnmapViewOfFile,CloseHandle,CloseHandle,PathRemoveFileSpecA,UnmapViewOfFile,CloseHandle,CloseHandle,FindFirstFileA,FindClose,DeleteFileA,UnmapViewOfFile,CloseHandle,CloseHandle,	10_2_00007FF8BEE1CE30
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE73B58 FindFirstFileExW,	10_2_00007FF8BEE73B58
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE1D920 GetWindowsDirectoryW,FindFirstFileW,FindClose,GetWindowsDirectoryW,FindFirstFileW,	10_2_00007FF8BEE1D920
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE1DAC0 SHGetFolderPathW,FindFirstFileW,FindClose,	10_2_00007FF8BEE1DAC0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE452A0 RegCreateKeyExW,GetWindowsDirectoryW,FindFirstFileW,FindClose,GetWindowsDirectoryW,FindFirstFileW,FindClose,GetWindowsDirectoryA,RegCloseKey,RegSetValueExW,RegSetValueExA,RegSetValueExW,RegCloseKey,	10_2_00007FF8BEE452A0

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 140.82.121.3 443			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.199.108.133 443			Jump to behavior

Source: Joe Sandbox View	IP Address: 185.199.108.133 185.199.108.133
Source: Joe Sandbox View	IP Address: 140.82.121.3 140.82.121.3
Source: Joe Sandbox View	IP Address: 140.82.121.3 140.82.121.3

Source: Joe Sandbox View	ASN Name: FASTLYUS FASTLYUS
Source: Joe Sandbox View	ASN Name: GITHUBUS GITHUBUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49711 -> 140.82.121.3:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\explorer.exe

Code function: 10_2_00007FF8BEE50750 InternetOpenA,InternetOpenUrlA,InternetReadFile,SHGetFolderPathW,CreateDirectoryW,GetLastError,ShellExecuteExW,WaitForSingleObject,CloseHandle,Sleep,DeleteFileW,InternetCloseHandle,InternetCloseHandle,

10_2_00007FF8BEE50750

Source: global traffic	HTTP traffic detected: GET /valinet/ExplorerPatcher/releases/latest/download/ep_setup.exe HTTP/1.1User-Agent: ExplorerPatcherHost: github.com
Source: global traffic	HTTP traffic detected: GET /valinet/ExplorerPatcher/releases/download/22621.3880.66.5_5094108/ep_setup.exe HTTP/1.1User-Agent: ExplorerPatcherHost: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/394318710/d0ea7754-53d3-4f5a-b870-915f924fbb56?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240912%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240912T163119Z&X-Amz-Expires=300&X-Amz-Signature=ccbd5355f6cdf8d7af2b5fc3c342d46db9d98756c5381b9b25100712ee9e2190&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=394318710&response-content-disposition=attachment%3B%20filename%3Dep_setup.exe&response-content-type=application%2Foctet-stream HTTP/1.1User-Agent: ExplorerPatcherConnection: Keep-AliveHost: objects.githubusercontent.com

Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com

Source: explorer.exe, 0000000B.00000003.2235545227.00000000089C9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2259820542.00000000089CA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2221558741.00000000089AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 0000000B.00000003.2235545227.00000000089C9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2259820542.00000000089CA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2221558741.00000000089AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 0000000B.00000003.2235545227.00000000089C9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2259820542.00000000089CA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2221558741.00000000089AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 0000000B.00000003.2235545227.00000000089C9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2259820542.00000000089CA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2221558741.00000000089AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 0000000B.00000003.2381500814.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2319396261.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2311117328.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2377129178.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2317412632.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2378964916.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2388978276.000000000AE96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.micr
Source: explorer.exe, 0000000B.00000003.2381500814.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2319396261.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2311117328.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2377129178.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2317412632.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2378964916.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2388978276.000000000AE96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.co
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000000.2108533057.00007FF7F56F6000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2146053134.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, explorer.exe, 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://api.github.com/repos/valinet/ExplorerPatcher/releases?per_page=1
Source: explorer.exe, 0000000B.00000003.2246946920.0000000008B81000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2237543521.0000000008B85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2294706642.0000000008B81000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2383069605.0000000008B96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235377127.0000000008B81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 0000000A.00000003.2167375925.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2174577379.00000000023D5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2178744483.0000000002D5E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2176793588.00000000023D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?%08x%04x%04x%02x%02x%02x%02x%02x%02x%02x%02xFeedsCNhttps://
Source: explorer.exe, 0000000B.00000003.2221558741.00000000089AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 0000000B.00000003.2221710068.0000000008A2A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235545227.00000000089C9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2259820542.00000000089CA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2221558741.00000000089AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comO
Source: explorer.exe, 0000000B.00000003.2235377127.0000000008BF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235817392.0000000008BF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp	String found in binary or memory: https://github.com/valinet
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp	String found in binary or memory: https://github.com/valinet)
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher#donate
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/blob/master/CHANGELOG.md
Source: explorer.exe	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/discussions
Source: explorer.exe	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/discussions/1102
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/discussions/1679
Source: explorer.exe	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/issues
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2146053134.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/issueshttps://github.com/valinet/ExplorerPatcher/discussi
Source: explorer.exe	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/releases
Source: explorer.exe, 0000000B.00000003.2246884263.0000000008C45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/releases/download/22621.3880.66.5_5094108/ep_setup.exe
Source: explorer.exe, 0000000B.00000003.2259820542.00000000089CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/releases/download/22621.3880.66.5_5094108/ep_setup.exen
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2146053134.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, explorer.exe, 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/releases/latest
Source: explorer.exe, 0000000B.00000003.2235377127.0000000008BF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2259790641.0000000008C40000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2247710864.0000000008BB8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235968422.0000000008C52000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235545227.00000000089C9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235377127.0000000008BB8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235817392.0000000008BF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2247687864.0000000008C40000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2247710864.0000000008BF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2383069605.0000000008BF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2294706642.0000000008B81000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2259820542.00000000089CA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2383069605.0000000008B96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235817392.0000000008BB8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2237636676.0000000008C3D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235771046.0000000008C3D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2294706642.0000000008BF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235276763.0000000008C52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/releases/latest/download/ep_setup.exe
Source: explorer.exe, 0000000B.00000003.2247710864.0000000008BB8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235377127.0000000008BB8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2294706642.0000000008B81000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2383069605.0000000008B96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235817392.0000000008BB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/releases/latest/download/ep_setup.exe04w
Source: explorer.exe, 0000000B.00000003.2235377127.0000000008BF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2237636676.0000000008C3D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235771046.0000000008C3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/releases/latest/download/ep_setup.exeQ
Source: explorer.exe, 0000000B.00000003.2235377127.0000000008BF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235817392.0000000008BF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2247710864.0000000008BF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2383069605.0000000008BF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2294706642.0000000008BF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/releases/latest/download/ep_setup.exeut
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/About-advanced-settings
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/Configure-updates
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/ExplorerPatcher
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/Frequently-asked-questions
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/Settings-management
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/Simple-Window-Switcher
Source: explorer.exe, explorer.exe, 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmp, explorer.exe, 0000000A.00000002.2174380843.0000000000B9B000.00000004.00000010.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174887643.0000000002D7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174887643.0000000002D70000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2188541557.000000000273D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/Symbols
Source: explorer.exe, 0000000B.00000003.2188541557.0000000002740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/Symbols=
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2146053134.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/SymbolsMicrosoft.Windows.Explorer
Source: explorer.exe, 0000000A.00000002.2174887643.0000000002D7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/Symbolss
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/Using-ExplorerPatcher-as-shell-extension
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/Weather
Source: explorer.exe, 0000000A.00000003.2166635686.00000000027EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2175731585.00000000023D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msn.comError
Source: explorer.exe, 0000000B.00000003.2383069605.0000000008BF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2294706642.0000000008BF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://objects.githubusercontent.com/
Source: explorer.exe, 0000000B.00000003.2259820542.00000000089CA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2259633111.000000000ADA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://objects.githubusercontent.com/github-production-release-asset-2e65be/394318710/d0ea7754-53d3
Source: explorer.exe, 0000000B.00000003.2247710864.0000000008BB8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235377127.0000000008BB8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2221330728.0000000008BBA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235817392.0000000008BB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 0000000B.00000003.2234944578.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2246571830.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2237333080.0000000002E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.com
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2146053134.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, explorer.exe, 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://raw.githubusercontent.com/valinet/ep_make/master/ep_make_safe.ps1
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949438-4e0c0e0d-67bc-4c76-b75e-e0ffcead3f48.png
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949442-63f14d44-ec0e-40b2-aa1b-8e4a27ec10f5.png
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949443-062a0fa9-88c1-4e07-b6b1-8e52ff64f4f3.png
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949444-d3aea936-4c22-4f17-a201-02155396684d.png
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949445-60d12efa-a21d-40e0-b9a8-1b7a84e58944.png
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949447-a6658710-567e-4977-9316-a80007df3076.png
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949448-cd1b69af-4028-4153-8e40-288526577b58.png
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949449-9320c6f5-15ef-4c17-9e72-740708f4828c.png
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949450-7e03a3f5-580e-4414-aaeb-3a0898afd1da.png
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949451-269d02a3-08cb-4237-9789-f1e60fdc723d.png
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949452-f347fe27-5005-48f2-9c9a-899bb7b8825e.png
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949454-81d5d47d-1f33-4859-a112-5a64ceb549a1.png
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949456-04a4bdbd-ff3b-4484-bb30-8909baff8aa8.png
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949458-dc66775d-8bb9-4d04-838e-7f550d305c26.png
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949459-dfe70eba-6c2c-4b1c-b51b-27c13ce7c08c.png
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949460-7c132d89-efb7-457f-8810-9bf235f5737f.png
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949461-1f058cf3-6fdd-4aeb-80b7-68fa27b02845.png
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949462-f50c21dd-85dd-4d9c-a4eb-516e6cddfb1f.png
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949463-a427edfb-3d7f-4167-bd6f-f5019c482ea1.png
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949465-54dd31c6-7e3a-464a-8e64-8b54b6fb7a65.png
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156950233-ccaadb4a-2e9a-4934-b41c-acd36a7f0d9c.png
Source: explorer.exe, 0000000B.00000003.2221558741.00000000089AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vsblobprodscussu5shard39.blob.core.windows.net/)a
Source: explorer.exe, 0000000B.00000003.2221558741.00000000089AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vsblobprodscussu5shard39.blob.core.windows.net/1a
Source: explorer.exe, 0000000B.00000003.2235994933.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2234944578.0000000002E7D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2320144168.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2288267379.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2304015552.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2246571830.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2332407476.0000000002E7D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2252874097.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vsblobprodscussu5shard39.blob.core.windows.net/b-4712e0edc5a240eabf23330d7df68e77/39B7A82995
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144908523.000001BF13B8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?hl=%s&q=weather%s%s%s%s%s%s%s%spCoreWebView2ExecuteScriptCompletedHand
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp	String found in binary or memory: https://www.valinet.ro
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp	String found in binary or memory: https://www.valinet.ro)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.5:49718 version: TLS 1.2

Source: C:\Windows\explorer.exe

Code function: 10_2_00007FF8BEE31870 GetModuleFileNameW,PathStripPathW,GetCurrentProcessId,OpenProcess,QueryFullProcessImageNameW,CloseHandle,GetSystemDirectoryW,GetWindowsDirectoryW,GetWindowsDirectoryW,GetWindowsDirectoryW,GetSystemDirectoryW,LoadLibraryExW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetSystemMetrics,RegGetValueW,RegGetValueW,FindWindowExW,FindWindowExW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,RegSetKeyValueW,SHCreateThread,RegSetKeyValueW,SHCreateThread,LoadLibraryW,RegOpenKeyW,RegCloseKey,LoadLibraryW,LoadLibraryW,GetModuleHandleExW,

10_2_00007FF8BEE31870

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	File created: C:\Windows\dxgi.dll			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll			Jump to behavior

Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE4FE80	10_2_00007FF8BEE4FE80
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE2DB90	10_2_00007FF8BEE2DB90
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE26B70	10_2_00007FF8BEE26B70
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE45CF0	10_2_00007FF8BEE45CF0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE26900	10_2_00007FF8BEE26900
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE31870	10_2_00007FF8BEE31870
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE28800	10_2_00007FF8BEE28800
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE1E500	10_2_00007FF8BEE1E500
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE45620	10_2_00007FF8BEE45620
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE3A350	10_2_00007FF8BEE3A350
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE4F250	10_2_00007FF8BEE4F250
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE22FD0	10_2_00007FF8BEE22FD0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE47FB0	10_2_00007FF8BEE47FB0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE1BFA0	10_2_00007FF8BEE1BFA0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE1EF90	10_2_00007FF8BEE1EF90
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE12F60	10_2_00007FF8BEE12F60
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE4DF40	10_2_00007FF8BEE4DF40
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE16F20	10_2_00007FF8BEE16F20
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE6EF24	10_2_00007FF8BEE6EF24
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE5EF08	10_2_00007FF8BEE5EF08
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE44F10	10_2_00007FF8BEE44F10
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE4BF10	10_2_00007FF8BEE4BF10
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE120D0	10_2_00007FF8BEE120D0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE64094	10_2_00007FF8BEE64094
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE30070	10_2_00007FF8BEE30070
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE6105C	10_2_00007FF8BEE6105C
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE5F014	10_2_00007FF8BEE5F014
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE47010	10_2_00007FF8BEE47010
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE6CDBC	10_2_00007FF8BEE6CDBC
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE64D94	10_2_00007FF8BEE64D94
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE30D10	10_2_00007FF8BEE30D10
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE13EF0	10_2_00007FF8BEE13EF0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE2CEC0	10_2_00007FF8BEE2CEC0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE75E9C	10_2_00007FF8BEE75E9C
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE6AE7C	10_2_00007FF8BEE6AE7C
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE60E58	10_2_00007FF8BEE60E58
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE5EDFC	10_2_00007FF8BEE5EDFC
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE1FBE0	10_2_00007FF8BEE1FBE0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE73B58	10_2_00007FF8BEE73B58
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE17B50	10_2_00007FF8BEE17B50
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE25B40	10_2_00007FF8BEE25B40
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE11B20	10_2_00007FF8BEE11B20
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE5ECF0	10_2_00007FF8BEE5ECF0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE79CA8	10_2_00007FF8BEE79CA8
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE60C24	10_2_00007FF8BEE60C24
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE22C20	10_2_00007FF8BEE22C20
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE62908	10_2_00007FF8BEE62908
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE1CAC0	10_2_00007FF8BEE1CAC0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE19AA0	10_2_00007FF8BEE19AA0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE6EA90	10_2_00007FF8BEE6EA90
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE50A50	10_2_00007FF8BEE50A50
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE48A50	10_2_00007FF8BEE48A50
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE60A18	10_2_00007FF8BEE60A18
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE44A00	10_2_00007FF8BEE44A00
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE75A00	10_2_00007FF8BEE75A00
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE2C7A0	10_2_00007FF8BEE2C7A0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE50750	10_2_00007FF8BEE50750
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE56740	10_2_00007FF8BEE56740
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE648D0	10_2_00007FF8BEE648D0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE23880	10_2_00007FF8BEE23880
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE4E830	10_2_00007FF8BEE4E830
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE60814	10_2_00007FF8BEE60814
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE2F810	10_2_00007FF8BEE2F810
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE605E0	10_2_00007FF8BEE605E0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE6F5A4	10_2_00007FF8BEE6F5A4
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE305A0	10_2_00007FF8BEE305A0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE62584	10_2_00007FF8BEE62584
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE5F54C	10_2_00007FF8BEE5F54C
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE6B518	10_2_00007FF8BEE6B518
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE4E520	10_2_00007FF8BEE4E520
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE5F658	10_2_00007FF8BEE5F658
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE44650	10_2_00007FF8BEE44650
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE353F0	10_2_00007FF8BEE353F0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE603D4	10_2_00007FF8BEE603D4
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE483C0	10_2_00007FF8BEE483C0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE15380	10_2_00007FF8BEE15380
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE26350	10_2_00007FF8BEE26350
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE23350	10_2_00007FF8BEE23350
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE5F334	10_2_00007FF8BEE5F334
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE1A4E0	10_2_00007FF8BEE1A4E0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE644CC	10_2_00007FF8BEE644CC
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE5F440	10_2_00007FF8BEE5F440
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE621EC	10_2_00007FF8BEE621EC
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE601D0	10_2_00007FF8BEE601D0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE201B0	10_2_00007FF8BEE201B0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE2D190	10_2_00007FF8BEE2D190
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE1B150	10_2_00007FF8BEE1B150
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE5F120	10_2_00007FF8BEE5F120
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE1E100	10_2_00007FF8BEE1E100
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE122F0	10_2_00007FF8BEE122F0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE452A0	10_2_00007FF8BEE452A0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE4E280	10_2_00007FF8BEE4E280
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE61268	10_2_00007FF8BEE61268
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE24270	10_2_00007FF8BEE24270
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE5F22C	10_2_00007FF8BEE5F22C
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE1E230	10_2_00007FF8BEE1E230
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE651F8	10_2_00007FF8BEE651F8
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE1C200	10_2_00007FF8BEE1C200

Source: C:\Windows\explorer.exe	Code function: String function: 00007FF8BEE342F0 appears 70 times
Source: C:\Windows\explorer.exe	Code function: String function: 00007FF8BEE1D290 appears 78 times
Source: C:\Windows\explorer.exe	Code function: String function: 00007FF8BEE68004 appears 42 times
Source: C:\Windows\explorer.exe	Code function: String function: 00007FF8BEE111B0 appears 172 times
Source: C:\Windows\explorer.exe	Code function: String function: 00007FF8BEE67E1C appears 61 times

Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Static PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: ep_setup.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: ep_gui.dll.0.dr	Static PE information: Resource name: RT_STRING type: COM executable for DOS

Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameep_gui.dll@ vs SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2143630593.000001BF13BB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExplorerPatcher.dll@ vs SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2143994460.000001BF13B8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExplorerPatcher.dll@ vs SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2146053134.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExplorerPatcher.dll@ vs SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2145395795.000001BF13BB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebView2Loader.dll~/ vs SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144537598.000001BF13B8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameep_dwm.exe@ vs SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameep_weather_host.exe@ vs SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144908523.000001BF13B8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameep_weather_host.exe@ vs SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144601951.000001BF13BA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameep_dwm.exe@ vs SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2143599851.000001BF13B8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExplorerPatcher.dll@ vs SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2145293156.000001BF13B8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebView2Loader.dll~/ vs SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Source: classification engine

Classification label: mal60.evad.winEXE@17/20@3/2

Source: C:\Windows\explorer.exe

Code function: 10_2_00007FF8BEE53030 VirtualAlloc,GetLastError,FormatMessageA,

10_2_00007FF8BEE53030

Source: C:\Windows\explorer.exe

Code function: 10_2_00007FF8BEE1DCF0 GetWindowsDirectoryW,CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,QueryFullProcessImageNameW,TerminateProcess,CloseHandle,Process32NextW,CloseHandle,

10_2_00007FF8BEE1DCF0

Source: C:\Windows\explorer.exe

Code function: 10_2_00007FF8BEE2A830 CoCreateInstance,CoCreateInstance,

10_2_00007FF8BEE2A830

Source: C:\Windows\explorer.exe

Code function: 10_2_00007FF8BEE30D10 LoadLibraryW,GetModuleHandleW,LoadLibraryW,LoadLibraryW,GetCurrentProcess,K32GetModuleInformation,LoadLibraryW,GetCurrentProcess,K32GetModuleInformation,FindResourceW,LoadResource,LockResource,SizeofResource,LoadLibraryW,GetModuleHandleW,CreateEventW,CreateThread,LoadLibraryW,GetProcAddress,FreeLibrary,FreeLibraryAndExitThread,FreeLibraryAndExitThread,FreeLibraryAndExitThread,FreeLibraryAndExitThread,

10_2_00007FF8BEE30D10

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

File created: C:\Program Files\ExplorerPatcher

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\ExplorerPatcher

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5604:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4552:120:WilError_03

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process created: C:\Windows\explorer.exe	Jump to behavior

Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "explorer.exe")

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: explorer.exe

String found in binary or memory: Could not modify already-installed funchook handle.

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /f /im explorer.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /NoUACCheck
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /f /im explorer.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: webview2loader.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.fileexplorer.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinui.pcshell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wincorlib.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: stobject.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wmiclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pnidui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sndvolsso.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: peopleband.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wpnapps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.fileexplorer.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinui.pcshell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wincorlib.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: stobject.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wmiclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pnidui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sndvolsso.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: peopleband.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wpnapps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.applicationmodel.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: usermgrproxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: appextension.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cldapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: tiledatarepository.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: staterepository.core.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepository.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.immersiveshell.serviceprovider.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: languageoverlayutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: photometadatahandler.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinui.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: applicationframe.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: holographicextensions.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: virtualmonitormanager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: abovelockapphost.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: npsm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.shell.bluelightreduction.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.web.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.signals.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositorybroker.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mfplat.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rtworkq.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: structuredquery.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.data.activities.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.security.authentication.web.core.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.ui.shell.windowtabmanager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.system.launcher.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: notificationcontrollerps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.devices.enumeration.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswb7.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: devdispitemprovider.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.core.textinput.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windowsudk.shellcommon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dictationmanager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pcshellcommonproxystub.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: shellcommoncommonproxystub.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptngc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cflapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: daxexec.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: container.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: capabilityaccessmanagerclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: batmeter.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: inputswitch.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: prnfldr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: workfoldersshell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: syncreg.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: actioncenter.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wscinterop.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wscapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: werconcpl.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: hcproviders.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: networkuxbroker.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ethernetmediamanager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dusmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wpnclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wpdshserviceobj.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: portabledevicetypes.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: portabledeviceapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cscobj.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ncsi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srchadmin.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.search.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: synccenter.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: imapi2.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fhcfg.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: efsutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.system.userprofile.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cloudexperiencehostbroker.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: credui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wdscore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bluetoothapis.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bluetoothapis.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: settingsync.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: settingsynccore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.xaml.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windowsinternal.composableshell.desktophosting.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uiamanager.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Properties (ExplorerPatcher).lnk.0.dr

LNK file: ..\..\..\..\..\..\Windows\System32\rundll32.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Directory created: C:\Program Files\ExplorerPatcher	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_setup.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Directory created: C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Directory created: C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_gui.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_dwm.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_weather_host.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Directory created: C:\Program Files\ExplorerPatcher\WebView2Loader.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher

Jump to behavior

Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Static file information: File size 10525696 > 1048576

Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x9d1a00

Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\_work\e\src\out\Release_x64\WebView2Loader.dll.pdb source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2145293156.000001BF13B8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /download/symbols/twinui.pcshell.pdb/56A53B20B8D4F79E69038072C21547311/twinui.pcshell.pdb source: explorer.exe, 0000000B.00000003.2234944578.0000000002E7D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2332407476.0000000002E7D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: twinui.pcshell.pdb source: explorer.exe, 0000000A.00000003.2167375925.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2174577379.00000000023D5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2178744483.0000000002D5E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2176793588.00000000023D4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: http://msdl.microsoft.com/download/symbols/twinui.pcshell.pdb/56A53B20B8D4F79E69038072C21547311/twinui.pcshell.pdb source: explorer.exe, 0000000B.00000003.2198671395.0000000002ED7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2192876585.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235994933.0000000002F37000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2246571830.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2192876585.0000000002F48000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2193206748.0000000002EBD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2288267379.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2198671395.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2252874097.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235994933.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2204325725.0000000002F33000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2320144168.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2381212820.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2234944578.0000000002F37000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2234944578.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ExplorerPatcher.amd64.pdb source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2146053134.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_weather_host_stub.pdb source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2145109319.000001BF13BA7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2145084872.000001BF13B8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\WebView2Loader.dll.pdbOGP source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2145293156.000001BF13B8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: http://msdl.microsoft.com/download/symbols/twinui.pcshell.pdb/56A53B20B8D4F79E69038072C21547311/twinui.pcshell.pdby source: explorer.exe, 0000000B.00000003.2192876585.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2198671395.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_dwm.pdb source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144537598.000001BF13B8D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144601951.000001BF13BA9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: StartUI.pdb source: explorer.exe, 0000000A.00000003.2166635686.00000000027EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2175731585.00000000023D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pcshell.pdb source: explorer.exe, 0000000B.00000003.2235994933.0000000002F37000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2246571830.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2288267379.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2252874097.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2204325725.0000000002F33000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2320144168.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2381212820.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2234944578.0000000002F37000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: {"function" : "getkfmupsellstate", "args" : {}}.pdb source: explorer.exe, 0000000B.00000003.2377129178.000000000AF04000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: http://msdl.microsoft.com/download/symbols/twinui.pcshell.pdb/56A53B20B8D4F79E69038072C21547311/twinui.pcshell.pdbb source: explorer.exe, 0000000B.00000003.2198671395.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: http://msdl.microsoft.com/download/symbols/twinui.pcshell.pdb/56A53B20B8D4F79E69038072C21547311/twinui.pcshell.pdb! source: explorer.exe, 0000000B.00000003.2192876585.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2246571830.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2288267379.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2198671395.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2252874097.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235994933.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2320144168.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2234944578.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\ExplorerPatcher\twinui.pcshell.pdb{ source: explorer.exe, 0000000B.00000003.2377129178.000000000AF04000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\Win32\ExplorerPatcher.IA-32.pdb source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2143630593.000001BF13BB2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2143599851.000001BF13B8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_setup.pdb source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000002.2165080505.00007FF7F56F6000.00000002.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000000.2108533057.00007FF7F56F6000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\ExplorerPatcher\twinui.pcshell.pdb source: explorer.exe, 0000000B.00000003.2377129178.000000000AF04000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2383069605.0000000008B96000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_gui.pdb source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_weather_host.pdb source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144908523.000001BF13B8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: http://msdl.microsoft.com/download/symbols/twinui.pcshell.pdb/56A53B20B8D4F79E69038072C21547311/twinui.pcshell.pdbO source: explorer.exe, 0000000B.00000003.2235994933.0000000002F37000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2246571830.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2288267379.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2252874097.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2204325725.0000000002F33000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2320144168.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2381212820.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2234944578.0000000002F37000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: StartUI.pdbH source: explorer.exe, 0000000A.00000003.2166635686.00000000027EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2175731585.00000000023D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: twinui.pcshell.pdbUGP source: explorer.exe, 0000000A.00000003.2167375925.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2174577379.00000000023D5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2178744483.0000000002D5E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2176793588.00000000023D4000.00000004.00000020.00020000.00000000.sdmp

Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\explorer.exe

Code function: 10_2_00007FF8BEE2DB90 InitializeCriticalSection,CreateEventW,CreateEventW,CreateEventW,SetEvent,SetEvent,SetEvent,CreateThread,CloseHandle,SHGetFolderPathW,PathFileExistsW,CreateDirectoryW,CreateMutexExW,CreateEventW,CreateEventW,CreateThread,CreateThread,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleW,GetCurrentProcess,K32GetModuleInformation,GetModuleHandleW,GetProcAddress,IsOS,GetCurrentProcess,K32GetModuleInformation,LoadLibraryW,LoadLibraryW,GetProcAddress,CreateWindowExW,FreeLibraryAndExitThread,SetWindowLongPtrW,FreeLibraryAndExitThread,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,LoadLibraryExW,LoadLibraryExW,LoadLibraryExW,LoadLibraryExW,GetModuleHandleW,GetProcAddress,SHELL32_Create_IEnumUICommand,VirtualProtect,VirtualProtect,GetProcAddress,VirtualProtect,VirtualProtect,LoadLibraryW,GetProcAddress,LoadLibraryW,GetModuleHandleExW,GetCurrentProcess,K32GetModuleInformation,VirtualProtect,VirtualProtect,GetCurrentProcess,K32GetModuleInformation,LoadLibraryW,LoadLibraryW,GetProcAddress,LoadLibraryExW,IsOS,FreeLibraryAndExitThread,CreateThread,CreateThread,RegDeleteKeyValueW,RegDeleteKeyValueW,CreateThread,CreateThread,CreateWindowInBand,CreateThread,CreateThread,GetWindowsDirectoryW,FindFirstFileW,FindClose,LoadLibraryW,GetProcAddress,GetLastError,

10_2_00007FF8BEE2DB90

Source: ep_weather_host_stub.dll.0.dr	Static PE information: section name: .orpc
Source: WebView2Loader.dll.0.dr	Static PE information: section name: .gxfg
Source: WebView2Loader.dll.0.dr	Static PE information: section name: .retplne
Source: WebView2Loader.dll.0.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	File created: C:\Windows\dxgi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	File created: C:\Program Files\ExplorerPatcher\ep_setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	File created: C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	File created: C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	File created: C:\Program Files\ExplorerPatcher\ep_gui.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	File created: C:\Program Files\ExplorerPatcher\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	File created: C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	File created: C:\Program Files\ExplorerPatcher\ep_weather_host.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	File created: C:\Program Files\ExplorerPatcher\ep_dwm.exe	Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	File created: C:\Windows\dxgi.dll			Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll			Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ExplorerPatcher			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ExplorerPatcher\Properties (ExplorerPatcher).lnk			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB

Source: C:\Windows\explorer.exe

10_2_00007FF8BEE2DB90

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\explorer.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\explorer.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Windows\explorer.exe

Code function: GetForegroundWindow,GetClassNameW,Sleep,GetForegroundWindow,GetClassNameW,GetForegroundWindow,GetClassNameW,Sleep,GetForegroundWindow,GetClassNameW,RegDeleteTreeW,Sleep,

10_2_00007FF8BEE1DEA0

Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 653			Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 633			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Dropped PE file which has not been started: C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Dropped PE file which has not been started: C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Dropped PE file which has not been started: C:\Program Files\ExplorerPatcher\ep_gui.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Dropped PE file which has not been started: C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Dropped PE file which has not been started: C:\Program Files\ExplorerPatcher\ep_weather_host.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Dropped PE file which has not been started: C:\Program Files\ExplorerPatcher\ep_dwm.exe	Jump to dropped file

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\explorer.exe

Code function: 10_2_00007FF8BEE17B50 GetSystemTimeAsFileTime followed by cmp: cmp r15, 02h and CTI: jne 00007FF8BEE18362h

10_2_00007FF8BEE17B50

Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE2DB90 InitializeCriticalSection,CreateEventW,CreateEventW,CreateEventW,SetEvent,SetEvent,SetEvent,CreateThread,CloseHandle,SHGetFolderPathW,PathFileExistsW,CreateDirectoryW,CreateMutexExW,CreateEventW,CreateEventW,CreateThread,CreateThread,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleW,GetCurrentProcess,K32GetModuleInformation,GetModuleHandleW,GetProcAddress,IsOS,GetCurrentProcess,K32GetModuleInformation,LoadLibraryW,LoadLibraryW,GetProcAddress,CreateWindowExW,FreeLibraryAndExitThread,SetWindowLongPtrW,FreeLibraryAndExitThread,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,LoadLibraryExW,LoadLibraryExW,LoadLibraryExW,LoadLibraryExW,GetModuleHandleW,GetProcAddress,SHELL32_Create_IEnumUICommand,VirtualProtect,VirtualProtect,GetProcAddress,VirtualProtect,VirtualProtect,LoadLibraryW,GetProcAddress,LoadLibraryW,GetModuleHandleExW,GetCurrentProcess,K32GetModuleInformation,VirtualProtect,VirtualProtect,GetCurrentProcess,K32GetModuleInformation,LoadLibraryW,LoadLibraryW,GetProcAddress,LoadLibraryExW,IsOS,FreeLibraryAndExitThread,CreateThread,CreateThread,RegDeleteKeyValueW,RegDeleteKeyValueW,CreateThread,CreateThread,CreateWindowInBand,CreateThread,CreateThread,GetWindowsDirectoryW,FindFirstFileW,FindClose,LoadLibraryW,GetProcAddress,GetLastError,	10_2_00007FF8BEE2DB90
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE45CF0 RegCreateKeyExW,GetWindowsDirectoryW,RegQueryValueExA,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegDeleteTreeW,RegCreateKeyExW,GetSystemDirectoryW,RegQueryValueExA,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegCloseKey,RegDeleteTreeW,RegCreateKeyExW,GetWindowsDirectoryW,RegQueryValueExA,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegDeleteTreeW,RegCreateKeyExW,GetWindowsDirectoryW,FindFirstFileW,FindClose,GetWindowsDirectoryW,RegQueryValueExA,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegDeleteTreeW,RegCreateKeyExW,RegDeleteValueW,RegCloseKey,	10_2_00007FF8BEE45CF0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE1CE30 CreateFileA,CreateFileMappingW,CloseHandle,MapViewOfFile,CloseHandle,CloseHandle,UnmapViewOfFile,CloseHandle,CloseHandle,UnmapViewOfFile,CloseHandle,CloseHandle,UnmapViewOfFile,CloseHandle,CloseHandle,PathRemoveFileSpecA,UnmapViewOfFile,CloseHandle,CloseHandle,FindFirstFileA,FindClose,DeleteFileA,UnmapViewOfFile,CloseHandle,CloseHandle,	10_2_00007FF8BEE1CE30
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE73B58 FindFirstFileExW,	10_2_00007FF8BEE73B58
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE1D920 GetWindowsDirectoryW,FindFirstFileW,FindClose,GetWindowsDirectoryW,FindFirstFileW,	10_2_00007FF8BEE1D920
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE1DAC0 SHGetFolderPathW,FindFirstFileW,FindClose,	10_2_00007FF8BEE1DAC0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE452A0 RegCreateKeyExW,GetWindowsDirectoryW,FindFirstFileW,FindClose,GetWindowsDirectoryW,FindFirstFileW,FindClose,GetWindowsDirectoryA,RegCloseKey,RegSetValueExW,RegSetValueExA,RegSetValueExW,RegCloseKey,	10_2_00007FF8BEE452A0

Source: C:\Windows\explorer.exe

Code function: 10_2_00007FF8BEE52FA0 GetSystemInfo,VirtualAlloc,

10_2_00007FF8BEE52FA0

Source: explorer.exe, 0000000B.00000003.2317412632.000000000AE96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_
Source: explorer.exe, 0000000B.00000003.2304015552.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l\\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}5
Source: explorer.exe, 0000000B.00000003.2198671395.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000B.00000003.2192742798.00000000088D7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2198157372.00000000088D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW24%SystemRoot%\system32\mswsock.dll0B33D0DB0C2}
Source: explorer.exe, 0000000B.00000003.2381212820.0000000002E18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: explorer.exe, 0000000B.00000003.2377129178.000000000AF04000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000^
Source: explorer.exe, 0000000B.00000003.2221558741.0000000008921000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2202258071.000000000892C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2204359487.000000000891E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2200453807.000000000892C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 0000000B.00000003.2294706642.0000000008BF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000e
Source: explorer.exe, 0000000B.00000003.2304015552.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l\\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000B.00000003.2198671395.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}
Source: explorer.exe, 0000000B.00000003.2304015552.0000000002F00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l\\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}H
Source: explorer.exe, 0000000B.00000003.2221558741.00000000089AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2VMware Virtual USB MouseJC:\Windows\System32\DDORes.dll,-2212
Source: explorer.exe, 0000000B.00000003.2301615292.000000000AE96000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:Yr
Source: explorer.exe, 0000000B.00000003.2381212820.0000000002E18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963M
Source: explorer.exe, 0000000B.00000003.2378964916.000000000AF04000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000B.00000003.2198671395.0000000002F1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\

Source: C:\Windows\explorer.exe

Code function: 10_2_00007FF8BEE33F20 GetCurrentThreadId,IsDebuggerPresent,OutputDebugStringW,

10_2_00007FF8BEE33F20

Source: C:\Windows\explorer.exe

10_2_00007FF8BEE2DB90

Source: C:\Windows\explorer.exe

Code function: 10_2_00007FF8BEE3AFA0 GetProcessHeap,HeapFree,

10_2_00007FF8BEE3AFA0

Source: C:\Windows\System32\taskkill.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE510D0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00007FF8BEE510D0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE51DC0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00007FF8BEE51DC0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE6BC98 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00007FF8BEE6BC98

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 140.82.121.3 443			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.199.108.133 443			Jump to behavior

Contains functionality to automate explorer (e.g. start an application)

Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE23DA0 FindWindowExW,FindWindowExW,FindWindowExW,SendMessageW,	10_2_00007FF8BEE23DA0
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE23880 GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,FindWindowExW,FindWindowExW,FindWindowW,FindWindowExW,FindWindowExW,GetCursorPos,GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,MonitorFromPoint,GetMonitorInfoW,FindWindowExW,MonitorFromWindow,GetMonitorInfoW,GetWindowRect,SetCursorPos,SetCursorPos,FindWindowW,PostMessageW,PostMessageW,FindWindowExW,FindWindowW,GetCursorPos,GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,MonitorFromPoint,GetMonitorInfoW,FindWindowExW,MonitorFromWindow,GetMonitorInfoW,GetWindowRect,SetCursorPos,FindWindowExW,PostMessageW,GetWindowLongPtrW,GetWindowLongPtrW,SendMessageCallbackW,PostMessageW,	10_2_00007FF8BEE23880
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE23880 GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,FindWindowExW,FindWindowExW,FindWindowW,FindWindowExW,FindWindowExW,GetCursorPos,GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,MonitorFromPoint,GetMonitorInfoW,FindWindowExW,MonitorFromWindow,GetMonitorInfoW,GetWindowRect,SetCursorPos,SetCursorPos,FindWindowW,PostMessageW,PostMessageW,FindWindowExW,FindWindowW,GetCursorPos,GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,MonitorFromPoint,GetMonitorInfoW,FindWindowExW,MonitorFromWindow,GetMonitorInfoW,GetWindowRect,SetCursorPos,FindWindowExW,PostMessageW,GetWindowLongPtrW,GetWindowLongPtrW,SendMessageCallbackW,PostMessageW,	10_2_00007FF8BEE23880
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE23880 GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,FindWindowExW,FindWindowExW,FindWindowW,FindWindowExW,FindWindowExW,GetCursorPos,GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,MonitorFromPoint,GetMonitorInfoW,FindWindowExW,MonitorFromWindow,GetMonitorInfoW,GetWindowRect,SetCursorPos,SetCursorPos,FindWindowW,PostMessageW,PostMessageW,FindWindowExW,FindWindowW,GetCursorPos,GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,MonitorFromPoint,GetMonitorInfoW,FindWindowExW,MonitorFromWindow,GetMonitorInfoW,GetWindowRect,SetCursorPos,FindWindowExW,PostMessageW,GetWindowLongPtrW,GetWindowLongPtrW,SendMessageCallbackW,PostMessageW,	10_2_00007FF8BEE23880
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE23880 GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,FindWindowExW,FindWindowExW,FindWindowW,FindWindowExW,FindWindowExW,GetCursorPos,GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,MonitorFromPoint,GetMonitorInfoW,FindWindowExW,MonitorFromWindow,GetMonitorInfoW,GetWindowRect,SetCursorPos,SetCursorPos,FindWindowW,PostMessageW,PostMessageW,FindWindowExW,FindWindowW,GetCursorPos,GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,MonitorFromPoint,GetMonitorInfoW,FindWindowExW,MonitorFromWindow,GetMonitorInfoW,GetWindowRect,SetCursorPos,FindWindowExW,PostMessageW,GetWindowLongPtrW,GetWindowLongPtrW,SendMessageCallbackW,PostMessageW,	10_2_00007FF8BEE23880
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE23880 GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,FindWindowExW,FindWindowExW,FindWindowW,FindWindowExW,FindWindowExW,GetCursorPos,GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,MonitorFromPoint,GetMonitorInfoW,FindWindowExW,MonitorFromWindow,GetMonitorInfoW,GetWindowRect,SetCursorPos,SetCursorPos,FindWindowW,PostMessageW,PostMessageW,FindWindowExW,FindWindowW,GetCursorPos,GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,MonitorFromPoint,GetMonitorInfoW,FindWindowExW,MonitorFromWindow,GetMonitorInfoW,GetWindowRect,SetCursorPos,FindWindowExW,PostMessageW,GetWindowLongPtrW,GetWindowLongPtrW,SendMessageCallbackW,PostMessageW,	10_2_00007FF8BEE23880
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE1F4C0 FindWindowW,SendMessageTimeoutW,	10_2_00007FF8BEE1F4C0

Source: C:\Windows\explorer.exe	Code function: GetModuleFileNameW,PathStripPathW,GetCurrentProcessId,OpenProcess,QueryFullProcessImageNameW,CloseHandle,GetSystemDirectoryW,GetWindowsDirectoryW,GetWindowsDirectoryW,GetWindowsDirectoryW,GetSystemDirectoryW,LoadLibraryExW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetSystemMetrics,RegGetValueW,RegGetValueW,FindWindowExW,FindWindowExW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,RegSetKeyValueW,SHCreateThread,RegSetKeyValueW,SHCreateThread,LoadLibraryW,RegOpenKeyW,RegCloseKey,LoadLibraryW,LoadLibraryW,GetModuleHandleExW, \explorer.exe		10_2_00007FF8BEE31870
Source: C:\Windows\explorer.exe	Code function: Sleep,GetWindowsDirectoryW,CreateProcessW,FreeConsole,GetCurrentProcessId,OpenProcess,TerminateProcess, \explorer.exe		10_2_00007FF8BEE4FCC0

Source: C:\Windows\explorer.exe

Code function: 10_2_00007FF8BEE305A0 SetProcessDpiAwarenessContext,GetModuleFileNameW,GetCurrentDirectoryW,GetModuleHandleW,ShellExecuteExW,GetLastError,LoadStringW,LoadStringW,MessageBoxW,GetModuleFileNameW,GetLastError,RegCreateKeyExW,RegSetValueExW,RegSetValueExW,RegCloseKey,PathRemoveExtensionW,PathRemoveExtensionW,RegCreateKeyExW,RegSetValueExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,

10_2_00007FF8BEE305A0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /f /im explorer.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /f /im explorer.exe

Jump to behavior

Source: C:\Windows\explorer.exe

Code function: 10_2_00007FF8BEE1E860 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,GetLengthSid,CopySid,DeriveAppContainerSidFromAppContainerName,SetEntriesInAclW,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,LocalFree,CreateMutexW,FreeSid,

10_2_00007FF8BEE1E860

Source: C:\Windows\explorer.exe

Code function: 10_2_00007FF8BEE1D7C0 AllocateAndInitializeSid,CheckTokenMembership,GetLastError,FreeSid,

10_2_00007FF8BEE1D7C0

Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2146053134.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, explorer.exe, 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: Progman: %d
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2146053134.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, explorer.exe, 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: Progman hook: %d
Source: explorer.exe	Binary or memory string: Shell_TrayWnd
Source: explorer.exe	Binary or memory string: Progman
Source: explorer.exe, 0000000A.00000003.2167375925.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2174577379.00000000023D5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2178744483.0000000002D5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IsAutoHideEnabledShell_TrayWndUIA_WindowVisibilityOverriddenCortanaExperienceManager_OnViewPropertiesChangingq
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp	Binary or memory string: eptmpw+Unknown exceptionbad array new lengthSoftware\ExplorerPatcherLanguageen-USvector too long\Shell_TrayWnd
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2143599851.000001BF13B8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ntdll.dllRtlGetVersion\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersionUBRShell_TrayWnd\explorer.exe\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI.dll\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dllep_taskbar.0.dllep_taskbar.1.dllep_taskbar.2.dllep_taskbar.3.dllep_taskbar.4.dllep_taskbar.5.dll\ExplorerPatcher\ImmersiveContextMenuArray[ROD]: Level %d Position %d/%d Status %d
Source: explorer.exe	Binary or memory string: Progman: %d
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000002.2165080505.00007FF7F56F6000.00000002.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000000.2108533057.00007FF7F56F6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: runasExplorerPatcherntdll.dllRtlGetVersion\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersionUBRShell_TrayWnd\explorer.exeopenep_taskbar.0.dllep_taskbar.1.dllep_taskbar.2.dllep_taskbar.3.dllep_taskbar.4.dllep_taskbar.5.dll\ExplorerFrame.dll (ExplorerPatcher).lnk\shell32.dllSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcherUninstallStringDisplayNameVALINET Solutions SRLPublisherNoModifyNoRepair\ExplorerPatcher.amd64.dll%d.%d.%d.%dDisplayVersionVersionMajorVersionMinorDisplayIcon\ExplorerPatcher\cleanup_.tmp.preven-USmuipriep_taskbar.0.dllep_taskbar.2.dllep_taskbar.3.dllep_taskbar.4.dllep_taskbar.5.dll\*.../extractIsWow64Process2kernel32.dllx64ARM64/uninstall/uninstall_silentep_uninstall.exe/update_silentUndockingDisabledSOFTWARE\Microsoft\Windows\CurrentVersion\Shell\Update\PackagesGlobal\ep_setup_D17F1E1A-5919-4427-8F89-A1A8503CA3EB/f /im explorer.exeGlobal\ep_dwm_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EBExplorerPatcher_GUI_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}Software\ExplorerPatcherOpenPropertiesAtNextStartep_setup.exeSOFTWARE\Classes\CLSID\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}\InProcServer32\ExplorerPatcher\ExplorerPatcher.amd64.dll"\regsvr32.exeExplorerPatcher.IA-32.dllExplorerPatcher.IA-32.dllExplorerPatcher.amd64.dllExplorerPatcher.amd64.dllep_gui.dllep_gui.dllep_dwm.exeep_dwm.exeep_weather_host.dllep_weather_host.dllep_weather_host_stub.dllep_weather_host_stub.dllWebView2Loader.dllWebView2Loader.dllar-SAbg-BGca-EScs-CZda-DKde-DEel-GRen-GBes-ESes-MXet-EEeu-ESfi-FIfr-CAfr-FRgl-EShe-ILhr-HRhu-HUid-IDit-ITja-JPko-KRlt-LTlv-LVnb-NOnl-NLpl-PLpt-BRpt-PTro-ROru-RUsk-SKsl-SIsr-Latn-RSsv-SEth-THtr-TRuk-UAvi-VNzh-CNzh-TWprisStartUIWindows.UI.ShellCommon.pripnidui/Windows.UI.ShellCommon/pnidui.dllpnidui/pnidui.dllSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{C2796011-81BA-4148-8FCA-C6643245113F}AutoStartdxgi.dll\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewywincorlib.dllep_startmenu.dllwincorlib_orig.dll\wincorlib.dll\wincorlib_orig.dllStartUI_.dllStartUI/StartUI.dllAppResolverLegacy.dllStartTileDataLegacy.dll\en-USStartTileDataLegacy.dll.mui\pris2Windows.UI.ShellCommon.en-US.pri\SystemApps\ShellExperienceHost_cw5n1h2txyewy\rundll32.exe "\ExplorerPatcher\ep_gui.dll",ZZGUI\ExplorerPatcher\ep_setup.exe" /uninstallstart ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EBdelete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB\ExplorerPatcher\ep_weather_host.dll"\ExplorerPatcher\ep_weather_host_stub.dll"SOFTWARE\Policies\Microsoft\Windows\ExplorerSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\cleanupSOFTWARE\Microsoft\Windows\CurrentVersion\RunOncecmd /c rmdir /s /q ""ExplorerPatcherCleanupIsUpdatePendingrbr+bwb1.3.1.1-motley unzip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll@
Source: explorer.exe	Binary or memory string: Progman hook: %d
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2146053134.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: Microsoft-Symbol-Server/10.0.10036.206msdl.microsoft.comabcdefghijklmnopqrstuvwxyzProgmanProxy Desktop\explorer.exeopenInputSwitch.dllxx??x??xxx????xxD8t
Source: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2146053134.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: Shlwapi.dllSHRegGetValueFromHKCUHKLMShell_TrayWndntdll.dllRtlGetVersion\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersionUBRMicrosoft.Windows.ShellManagedWindowAsNormalWindowShell_SecondaryTrayWndvalinet.ExplorerPatcher.ShellManagedWindowExplorerFrame.dllDesktopSHELLDLL_DefViewWorkerWComctl32.dllLoadIconWithScaleDownwin32u.dllNtUserBuildHwndListuser32.dllHungWindowFromGhostWindowGhostWindowFromHungWindowSetWindowCompositionAttributeCreateWindowInBandGetWindowBandSetWindowBandIsTopLevelWindowInternalGetWindowTextInternalGetWindowIconuxtheme.dllshcore.dll

Source: C:\Windows\explorer.exe

Code function: 10_2_00007FF8BEE79AF0 cpuid

10_2_00007FF8BEE79AF0

Source: C:\Windows\explorer.exe	Code function: RegCreateKeyExW,RegQueryValueExW,GetLocaleInfoW,GetLocaleInfoW,SetThreadPreferredUILanguages,RegCloseKey,		10_2_00007FF8BEE350C0
Source: C:\Windows\explorer.exe	Code function: CoCreateInstance,IUnknown_QueryService,FindWindowW,GetPropW,GetThreadUILanguage,GetLocaleInfoW,		10_2_00007FF8BEE49620

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Code function: 0_2_00007FF7F56D8E2C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7F56D8E2C

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE50A50 SHParseDisplayName,SHBindToParent,CreatePopupMenu,TrackPopupMenuEx,RegQueryValueW,RegGetValueW,GetMenuItemInfoW,RegQueryValueW,RegGetValueW,GetMenuItemInfoW,InsertMenuItemW,InsertMenuItemW,InsertMenuItemW,GetMenuItemInfoW,DestroyMenu,CoTaskMemFree,		10_2_00007FF8BEE50A50
Source: C:\Windows\explorer.exe	Code function: 10_2_00007FF8BEE2A710 SHBindToObject,		10_2_00007FF8BEE2A710

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	11 Input Capture	11 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	2 Windows Service	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	11 Input Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	2 Windows Service	1 Obfuscated Files or Information	Security Account Manager	35 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Service Execution	Login Hook	122 Process Injection	1 DLL Side-Loading	NTDS	141 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	23 Masquerading	LSA Secrets	11 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Virtualization/Sandbox Evasion	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	122 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Regsvr32	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner
C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll	0%	ReversingLabs
C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll	0%	ReversingLabs
C:\Program Files\ExplorerPatcher\WebView2Loader.dll	0%	ReversingLabs
C:\Program Files\ExplorerPatcher\ep_dwm.exe	0%	ReversingLabs
C:\Program Files\ExplorerPatcher\ep_gui.dll	0%	ReversingLabs
C:\Program Files\ExplorerPatcher\ep_setup.exe	5%	ReversingLabs
C:\Program Files\ExplorerPatcher\ep_weather_host.dll	0%	ReversingLabs
C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll	3%	ReversingLabs
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://www.valinet.ro)	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/6503598/156949459-dfe70eba-6c2c-4b1c-b51b-27c13ce7c08c.png	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/6503598/156949442-63f14d44-ec0e-40b2-aa1b-8e4a27ec10f5.png	0%	Avira URL Cloud	safe
https://github.com/valinet	0%	Avira URL Cloud	safe
https://api.msn.com/v1/News/Feed/Windows?%08x%04x%04x%02x%02x%02x%02x%02x%02x%02x%02xFeedsCNhttps://	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/6503598/156949445-60d12efa-a21d-40e0-b9a8-1b7a84e58944.png	0%	Avira URL Cloud	safe
https://powerpoint.office.com	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/6503598/156949465-54dd31c6-7e3a-464a-8e64-8b54b6fb7a65.png	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/6503598/156949451-269d02a3-08cb-4237-9789-f1e60fdc723d.png	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/6503598/156949452-f347fe27-5005-48f2-9c9a-899bb7b8825e.png	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/6503598/156949438-4e0c0e0d-67bc-4c76-b75e-e0ffcead3f48.png	0%	Avira URL Cloud	safe
http://schemas.micr	0%	Avira URL Cloud	safe
https://objects.githubusercontent.com/github-production-release-asset-2e65be/394318710/d0ea7754-53d3	0%	Avira URL Cloud	safe
https://outlook.com	0%	Avira URL Cloud	safe
https://www.google.com/search?hl=%s&q=weather%s%s%s%s%s%s%s%spCoreWebView2ExecuteScriptCompletedHand	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/6503598/156949444-d3aea936-4c22-4f17-a201-02155396684d.png	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/valinet/ep_make/master/ep_make_safe.ps1	0%	Avira URL Cloud	safe
https://github.com/	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/6503598/156949461-1f058cf3-6fdd-4aeb-80b7-68fa27b02845.png	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/6503598/156949443-062a0fa9-88c1-4e07-b6b1-8e52ff64f4f3.png	0%	Avira URL Cloud	safe
https://www.valinet.ro	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/6503598/156949449-9320c6f5-15ef-4c17-9e72-740708f4828c.png	0%	Avira URL Cloud	safe
https://objects.githubusercontent.com/	0%	Avira URL Cloud	safe
https://github.com/valinet)	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/6503598/156949462-f50c21dd-85dd-4d9c-a4eb-516e6cddfb1f.png	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/6503598/156949448-cd1b69af-4028-4153-8e40-288526577b58.png	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/6503598/156949458-dc66775d-8bb9-4d04-838e-7f550d305c26.png	0%	Avira URL Cloud	safe
http://www.winimage.com/zLibDll	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/6503598/156949456-04a4bdbd-ff3b-4484-bb30-8909baff8aa8.png	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/6503598/156949450-7e03a3f5-580e-4414-aaeb-3a0898afd1da.png	0%	Avira URL Cloud	safe
https://api.msn.com/	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/6503598/156949447-a6658710-567e-4977-9316-a80007df3076.png	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/6503598/156949460-7c132d89-efb7-457f-8810-9bf235f5737f.png	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/6503598/156949463-a427edfb-3d7f-4167-bd6f-f5019c482ea1.png	0%	Avira URL Cloud	safe
https://msn.comError	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/6503598/156949454-81d5d47d-1f33-4859-a112-5a64ceb549a1.png	0%	Avira URL Cloud	safe
http://schemas.microsoft.co	0%	Avira URL Cloud	safe
https://user-images.githubusercontent.com/6503598/156950233-ccaadb4a-2e9a-4934-b41c-acd36a7f0d9c.png	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
github.com	140.82.121.3	true	true	unknown
objects.githubusercontent.com	185.199.108.133	true	true	unknown
api.msn.com	unknown	unknown	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://user-images.githubusercontent.com/6503598/156949459-dfe70eba-6c2c-4b1c-b51b-27c13ce7c08c.png	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.valinet.ro)	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/6503598/156949442-63f14d44-ec0e-40b2-aa1b-8e4a27ec10f5.png	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/valinet	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/6503598/156949445-60d12efa-a21d-40e0-b9a8-1b7a84e58944.png	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/6503598/156949452-f347fe27-5005-48f2-9c9a-899bb7b8825e.png	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/v1/News/Feed/Windows?%08x%04x%04x%02x%02x%02x%02x%02x%02x%02x%02xFeedsCNhttps://	explorer.exe, 0000000A.00000003.2167375925.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2174577379.00000000023D5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2178744483.0000000002D5E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2176793588.00000000023D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/6503598/156949451-269d02a3-08cb-4237-9789-f1e60fdc723d.png	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/6503598/156949465-54dd31c6-7e3a-464a-8e64-8b54b6fb7a65.png	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://powerpoint.office.com	explorer.exe, 0000000B.00000003.2234944578.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2246571830.0000000002E18000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2237333080.0000000002E18000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.micr	explorer.exe, 0000000B.00000003.2381500814.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2319396261.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2311117328.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2377129178.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2317412632.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2378964916.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2388978276.000000000AE96000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.com	explorer.exe, 0000000B.00000003.2247710864.0000000008BB8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235377127.0000000008BB8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2221330728.0000000008BBA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235817392.0000000008BB8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/6503598/156949438-4e0c0e0d-67bc-4c76-b75e-e0ffcead3f48.png	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/valinet/ep_make/master/ep_make_safe.ps1	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2146053134.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, explorer.exe, 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/search?hl=%s&q=weather%s%s%s%s%s%s%s%spCoreWebView2ExecuteScriptCompletedHand	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144908523.000001BF13B8D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/6503598/156949444-d3aea936-4c22-4f17-a201-02155396684d.png	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://objects.githubusercontent.com/github-production-release-asset-2e65be/394318710/d0ea7754-53d3	explorer.exe, 0000000B.00000003.2259820542.00000000089CA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2259633111.000000000ADA7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/	explorer.exe, 0000000B.00000003.2235377127.0000000008BF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235817392.0000000008BF9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/6503598/156949443-062a0fa9-88c1-4e07-b6b1-8e52ff64f4f3.png	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/6503598/156949461-1f058cf3-6fdd-4aeb-80b7-68fa27b02845.png	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.valinet.ro	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/6503598/156949449-9320c6f5-15ef-4c17-9e72-740708f4828c.png	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/valinet)	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144271915.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.2174585427.0000000002880000.00000002.00000001.00040000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
https://objects.githubusercontent.com/	explorer.exe, 0000000B.00000003.2383069605.0000000008BF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2294706642.0000000008BF9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/6503598/156949458-dc66775d-8bb9-4d04-838e-7f550d305c26.png	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/6503598/156949462-f50c21dd-85dd-4d9c-a4eb-516e6cddfb1f.png	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/6503598/156949448-cd1b69af-4028-4153-8e40-288526577b58.png	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000000.2108533057.00007FF7F56F6000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/6503598/156949450-7e03a3f5-580e-4414-aaeb-3a0898afd1da.png	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/6503598/156949456-04a4bdbd-ff3b-4484-bb30-8909baff8aa8.png	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/	explorer.exe, 0000000B.00000003.2246946920.0000000008B81000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2237543521.0000000008B85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2294706642.0000000008B81000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2383069605.0000000008B96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2235377127.0000000008B81000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/6503598/156949460-7c132d89-efb7-457f-8810-9bf235f5737f.png	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/6503598/156949447-a6658710-567e-4977-9316-a80007df3076.png	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/6503598/156949463-a427edfb-3d7f-4167-bd6f-f5019c482ea1.png	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/6503598/156950233-ccaadb4a-2e9a-4934-b41c-acd36a7f0d9c.png	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://user-images.githubusercontent.com/6503598/156949454-81d5d47d-1f33-4859-a112-5a64ceb549a1.png	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, 00000000.00000003.2144774735.000001BF162C1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.microsoft.co	explorer.exe, 0000000B.00000003.2381500814.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2319396261.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2311117328.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2377129178.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2317412632.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2378964916.000000000AE96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2388978276.000000000AE96000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://msn.comError	explorer.exe, 0000000A.00000003.2166635686.00000000027EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000B.00000003.2175731585.00000000023D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.199.108.133	objects.githubusercontent.com	Netherlands		54113	FASTLYUS	true
140.82.121.3	github.com	United States		36459	GITHUBUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1510261
Start date and time:	2024-09-12 18:30:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
Detection:	MAL
Classification:	mal60.evad.winEXE@17/20@3/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 70% Number of executed functions: 47 Number of non-executed functions: 214
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, UserOOBEBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe, StartMenuExperienceHost.exe, mobsync.exe, SearchApp.exe
Excluded IPs from analysis (whitelisted): 204.79.197.219, 20.150.79.68, 20.150.38.228, 20.150.70.36, 204.79.197.203
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, blob.sat09prdstrz08a.trafficmanager.net, slscr.update.microsoft.com, msdl-microsoft-com.a-0016.a-msedge.net, a-0003.a-msedge.net, ctldl.windowsupdate.com, vsblobprodscussu5shard6.blob.core.windows.net, msdl.microsoft.com, fe3cr.delivery.mp.microsoft.com, vsblobprodscussu5shard39.blob.core.windows.net, ocsp.digicert.com, a-0016.a-msedge.net, login.live.com, blob.sat09prdstrz08a.store.core.windows.net, r.bing.com, msdl.microsoft.akadns.net, api-msn-com.a-0003.a-msedge.net
Execution Graph export aborted for target SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, PID 2300 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Simulations

Behavior and APIs

Time	Type	Description
12:31:16	API Interceptor	969x Sleep call for process: explorer.exe modified
18:31:17	Task Scheduler	Run new task: CreateExplorerShellUnelevatedTask path: C:\Windows\explorer.exe s>/NoUACCheck

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.199.108.133	vm AUDIO_QzOXYQIfIQZ VOICE September 11th, 2024 attachment.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	https://www.google.com/url?q=//www.google.com.br/amp/s/iKL5afRe0S6hy3p0slRKsXiNT5VzWqeGhx.desarrollodigitales.com/xiwitytevd/sotutybgetd/qoguhtunh/I6Gu0C/cWEtc3FpQHF2Y2pwLmNvbQ==	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	M 1votFC.eml	Get hash	malicious	Unknown	Browse
	https://www.tiktok.com/link/v2?aid=1988&lang=enFSmPWg&scene=bio_url&target=google.com.////amp/s/%E2%80%8Bce%C2%ADsme%C2%ADdia%E2%80%8B.%C2%ADv%C2%ADn/.dev/tfbft0yf/ZGlhbmUuY3JhaWdAZ3JhY2VoZWFsdGhtaS5vcmc==$%E3%80%82	Get hash	malicious	Tycoon2FA	Browse
	https://www.tiktok.com/////link/v2?aid=1988&lang=enFSmPWg&scene=bio_url&target=google.com////amp/s/jbmagneticos.com.br/.dev/VGCU2YC1/c211bGxpbmdzQHRtaGNjLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse
	https://www.tiktok.com/////link/v2?aid=1988&lang=enFSmPWg&scene=bio_url&target=google.com.////amp/s/%E2%80%8Bc%C2%ADt%C2%ADh%E2%80%8B.%C2%ADv%C2%ADn/.dev/JCE6X4BH/cnVzc2VsbEBhZGtjcmVkaXR1bmlvbi5jb20==$%E3%80%82	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	https://www.tiktok.com/////link/v2?aid=1988&lang=enFSmPWg&scene=bio_url&target=google.com.////amp/s/cth.vn/.dev/JCE6X4BH/cnVzc2VsbEBhZGtjcmVkaXR1bmlvbi5jb20==$%E3%80%82	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	http://xcelenergy.zonaclimber.com/json/activeBC/justin.l.billeter@xcelenergy.com	Get hash	malicious	HTMLPhisher	Browse
	https://e4x.heraybay.com/ze6t/#Dben.rigor@eclipsebank.com	Get hash	malicious	HTMLPhisher	Browse
	https://www.tiktok.com/////link/v2?aid=1988&lang=enpihd7s&scene=bio_url&target=google.com.////amp/s/skycom.com.sg/.access/47279/YmFja2VybWFuQHN1cGVybnVzLmNvbQ0=$%E3%80%82	Get hash	malicious	HTMLPhisher	Browse
140.82.121.3	6glRBXzk6i.exe	Get hash	malicious	RedLine	Browse	github.com/dyrka314/Balumba/releases/download/ver2/encrypted_ImpulseCrypt_5527713376.2.exe
	firefox.lnk	Get hash	malicious	CobaltStrike	Browse	github.com/john-xor/temp/blob/main/index.html?raw=true
	0XzeMRyE1e.exe	Get hash	malicious	Amadey, Vidar	Browse	github.com/neiqops/ajajaj/raw/main/file_22613.exe
	MzRn1YNrbz.exe	Get hash	malicious	Vidar	Browse	github.com/AdobeInstal/Adobe-After-Effects-CC-2022-1.4/releases/download/123/Software.exe
	RfORrHIRNe.doc	Get hash	malicious	Unknown	Browse	github.com/ssbb36/stv/raw/main/5.mp3

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
github.com	vm AUDIO_QzOXYQIfIQZ VOICE September 11th, 2024 attachment.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
	https://github.com/valinet/ExplorerPatcher/releases/latest/download/ep_setup.exe	Get hash	malicious	Unknown	Browse	140.82.121.3
	Remittance AdviceNote c6b2e2a43485b7b75999a5332e86646f	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
	https://www.google.com/url?q=//www.google.com.br/amp/s/iKL5afRe0S6hy3p0slRKsXiNT5VzWqeGhx.desarrollodigitales.com/xiwitytevd/sotutybgetd/qoguhtunh/I6Gu0C/cWEtc3FpQHF2Y2pwLmNvbQ==	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
	M 1votFC.eml	Get hash	malicious	Unknown	Browse	140.82.121.4
	https://www.tiktok.com/link/v2?aid=1988&lang=enFSmPWg&scene=bio_url&target=google.com.////amp/s/%74%72%61%6E%63%61%73%2E%63%6C/.dev/0958DTU/LWVpUSQT/YXNobGV5QG9tbmlzdXJlLmNvbQ==$%E3%80%82	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	https://www.tiktok.com/link/v2?aid=1988&lang=enFSmPWg&scene=bio_url&target=google.com.////amp/s/%E2%80%8Bce%C2%ADsme%C2%ADdia%E2%80%8B.%C2%ADv%C2%ADn/.dev/tfbft0yf/ZGlhbmUuY3JhaWdAZ3JhY2VoZWFsdGhtaS5vcmc==$%E3%80%82	Get hash	malicious	Tycoon2FA	Browse	140.82.121.4
	https://www.tiktok.com/////link/v2?aid=1988&lang=enFSmPWg&scene=bio_url&target=google.com.////amp/s/%E2%80%8Bc%C2%ADt%C2%ADh%E2%80%8B.%C2%ADv%C2%ADn/.dev/b5EVLXJp/dGVyZXNhLmhhcnBlckBzb3V0aHNpZGUuY29t=$%E3%80%82	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.3
	https://www.tiktok.com/////link/v2?aid=1988&lang=enFSmPWg&scene=bio_url&target=google.com.////amp/s/%E2%80%8Bc%C2%ADt%C2%ADh%E2%80%8B.%C2%ADv%C2%ADn/.dev/JCE6X4BH/cnVzc2VsbEBhZGtjcmVkaXR1bmlvbi5jb20==$%E3%80%82	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.3
	https://www.tiktok.com/////link/v2?aid=1988&lang=enFSmPWg&scene=bio_url&target=google.com.////amp/s/cth.vn/.dev/JCE6X4BH/cnVzc2VsbEBhZGtjcmVkaXR1bmlvbi5jb20==$%E3%80%82	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
objects.githubusercontent.com	vm AUDIO_QzOXYQIfIQZ VOICE September 11th, 2024 attachment.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	185.199.110.133
	https://github.com/valinet/ExplorerPatcher/releases/latest/download/ep_setup.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	Remittance AdviceNote c6b2e2a43485b7b75999a5332e86646f	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	185.199.109.133
	https://www.google.com/url?q=//www.google.com.br/amp/s/iKL5afRe0S6hy3p0slRKsXiNT5VzWqeGhx.desarrollodigitales.com/xiwitytevd/sotutybgetd/qoguhtunh/I6Gu0C/cWEtc3FpQHF2Y2pwLmNvbQ==	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	185.199.109.133
	M 1votFC.eml	Get hash	malicious	Unknown	Browse	185.199.108.133
	https://www.tiktok.com/link/v2?aid=1988&lang=enFSmPWg&scene=bio_url&target=google.com.////amp/s/%74%72%61%6E%63%61%73%2E%63%6C/.dev/0958DTU/LWVpUSQT/YXNobGV5QG9tbmlzdXJlLmNvbQ==$%E3%80%82	Get hash	malicious	HTMLPhisher	Browse	185.199.109.133
	https://www.tiktok.com/link/v2?aid=1988&lang=enFSmPWg&scene=bio_url&target=google.com.////amp/s/%E2%80%8Bce%C2%ADsme%C2%ADdia%E2%80%8B.%C2%ADv%C2%ADn/.dev/tfbft0yf/ZGlhbmUuY3JhaWdAZ3JhY2VoZWFsdGhtaS5vcmc==$%E3%80%82	Get hash	malicious	Tycoon2FA	Browse	185.199.108.133
	https://www.tiktok.com/////link/v2?aid=1988&lang=enFSmPWg&scene=bio_url&target=google.com.////amp/s/%E2%80%8Bc%C2%ADt%C2%ADh%E2%80%8B.%C2%ADv%C2%ADn/.dev/b5EVLXJp/dGVyZXNhLmhhcnBlckBzb3V0aHNpZGUuY29t=$%E3%80%82	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	185.199.109.133
	https://www.tiktok.com/////link/v2?aid=1988&lang=enFSmPWg&scene=bio_url&target=google.com.////amp/s/%E2%80%8Bc%C2%ADt%C2%ADh%E2%80%8B.%C2%ADv%C2%ADn/.dev/JCE6X4BH/cnVzc2VsbEBhZGtjcmVkaXR1bmlvbi5jb20==$%E3%80%82	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	185.199.110.133
	https://www.tiktok.com/////link/v2?aid=1988&lang=enFSmPWg&scene=bio_url&target=google.com.////amp/s/cth.vn/.dev/JCE6X4BH/cnVzc2VsbEBhZGtjcmVkaXR1bmlvbi5jb20==$%E3%80%82	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	185.199.109.133

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GITHUBUS	vm AUDIO_QzOXYQIfIQZ VOICE September 11th, 2024 attachment.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
	https://github.com/valinet/ExplorerPatcher/releases/latest/download/ep_setup.exe	Get hash	malicious	Unknown	Browse	140.82.121.3
	Remittance AdviceNote c6b2e2a43485b7b75999a5332e86646f	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
	https://www.google.com/url?q=//www.google.com.br/amp/s/iKL5afRe0S6hy3p0slRKsXiNT5VzWqeGhx.desarrollodigitales.com/xiwitytevd/sotutybgetd/qoguhtunh/I6Gu0C/cWEtc3FpQHF2Y2pwLmNvbQ==	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
	M 1votFC.eml	Get hash	malicious	Unknown	Browse	140.82.121.4
	https://www.tiktok.com/link/v2?aid=1988&lang=enFSmPWg&scene=bio_url&target=google.com.////amp/s/%74%72%61%6E%63%61%73%2E%63%6C/.dev/0958DTU/LWVpUSQT/YXNobGV5QG9tbmlzdXJlLmNvbQ==$%E3%80%82	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	https://www.tiktok.com/link/v2?aid=1988&lang=enFSmPWg&scene=bio_url&target=google.com.////amp/s/%E2%80%8Bce%C2%ADsme%C2%ADdia%E2%80%8B.%C2%ADv%C2%ADn/.dev/tfbft0yf/ZGlhbmUuY3JhaWdAZ3JhY2VoZWFsdGhtaS5vcmc==$%E3%80%82	Get hash	malicious	Tycoon2FA	Browse	140.82.121.4
	https://www.tiktok.com/////link/v2?aid=1988&lang=enFSmPWg&scene=bio_url&target=google.com.////amp/s/%E2%80%8Bc%C2%ADt%C2%ADh%E2%80%8B.%C2%ADv%C2%ADn/.dev/b5EVLXJp/dGVyZXNhLmhhcnBlckBzb3V0aHNpZGUuY29t=$%E3%80%82	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.3
	https://www.tiktok.com/////link/v2?aid=1988&lang=enFSmPWg&scene=bio_url&target=google.com.////amp/s/%E2%80%8Bc%C2%ADt%C2%ADh%E2%80%8B.%C2%ADv%C2%ADn/.dev/JCE6X4BH/cnVzc2VsbEBhZGtjcmVkaXR1bmlvbi5jb20==$%E3%80%82	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.3
	https://www.tiktok.com/////link/v2?aid=1988&lang=enFSmPWg&scene=bio_url&target=google.com.////amp/s/cth.vn/.dev/JCE6X4BH/cnVzc2VsbEBhZGtjcmVkaXR1bmlvbi5jb20==$%E3%80%82	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
FASTLYUS	https://nmgovdot-my.sharepoint.com/:f:/g/personal/brian_filip_nmgov_co/EopUqBu8fqpOvw_R7W8qXnEBWw032PoWoE-pjka6mBLMVw?e=G3klTx	Get hash	malicious	HtmlDropper	Browse	151.101.66.137
	vm AUDIO_QzOXYQIfIQZ VOICE September 11th, 2024 attachment.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	151.101.2.137
	https://sesworld.com.au:443/it/mount/	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://oakvillemdcsignin.softr.app/	Get hash	malicious	Unknown	Browse	151.101.65.229
	https://gdzrdzrgysetgragfvasrtgfsarjk.bukuyass.com/XTutbHeMDeSMGoeITGUIniHvuWseZB&4ARJKwSLsix&135229/372/menwhssrzn.home.php?sq=1726-248&lk=267587-14&page=048	Get hash	malicious	Phisher	Browse	151.101.129.44
	https://bit.ly/4dU5cz3#CIgedJLuqmncgJYdTfeyaCNmWsrQtR&4sWlQeNzELg&135070/182/fldptionns.home.php?sq=1726-248&lk=267585-14&page=362	Get hash	malicious	Phisher	Browse	151.101.65.44
	http://tplshare.com/iVX5CrQ	Get hash	malicious	Unknown	Browse	199.232.192.134
	https://url.uk.m.mimecastprotect.com/s/mPYbC6R8kf47GAUxtNC5T-0g?domain=tplshare.com	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://www.dropbox.com/scl/fo/dypnewy032frqiop6d7gh/AGQRgoJcNqKPbhsYQheP8nM?rlkey=t6ozmhhbporfamqnz8ddx2in0&st=r8w1wv0v&dl=0	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://www.dropbox.com/scl/fo/dypnewy032frqiop6d7gh/AGQRgoJcNqKPbhsYQheP8nM?rlkey=t6ozmhhbporfamqnz8ddx2in0&st=r8w1wv0v&dl=0	Get hash	malicious	Unknown	Browse	151.101.194.137

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	185.199.108.133 140.82.121.3
	file.dll	Get hash	malicious	Matanbuchus	Browse	185.199.108.133 140.82.121.3
	file.dll	Get hash	malicious	Matanbuchus	Browse	185.199.108.133 140.82.121.3
	file.dll	Get hash	malicious	Matanbuchus	Browse	185.199.108.133 140.82.121.3
	SecuriteInfo.com.Win32.SuspectCrc.25896.32261.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	185.199.108.133 140.82.121.3
	rfq_last_quater_product_purchase_order_import_list_12_06_2024_000000120924.bat	Get hash	malicious	GuLoader, Remcos	Browse	185.199.108.133 140.82.121.3
	KeB00e9poi.msi	Get hash	malicious	Unknown	Browse	185.199.108.133 140.82.121.3
	4TLr2kKeuX.exe	Get hash	malicious	Unknown	Browse	185.199.108.133 140.82.121.3
	X6jV3f2RXz.msi	Get hash	malicious	Unknown	Browse	185.199.108.133 140.82.121.3
	p0DLT5dJg2.msi	Get hash	malicious	Unknown	Browse	185.199.108.133 140.82.121.3

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	156160
Entropy (8bit):	6.375266888011147
Encrypted:	false
SSDEEP:	3072:0lIcmRRbHdf9AwLCwsOOU5/1uR9AsRAiwaCG27eMwtN:0lB2wwLCwsq5/URuaw4rN
MD5:	5D1F22A4A8CB76C337FEC809463092E1
SHA1:	B4F216C118FBF93C0B2FC9CFCD1D7BC981A2572F
SHA-256:	6AFD7333E956C125C9D4D3E6F88C2ED27CC41E0AA9A4E0656BA17B87C655A306
SHA-512:	B5FB3CFA44955DDA982AEF231C93F5F6D64CAE85325C616A54270B6E4E434CC3E3805AB8B5CD291310B3FE99137EFD5782D34EC3A0997A752FC4F2E75FF8304A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S...2..2..2...J..2...J...2...J..2....2....2....2...J..2..2..>2.....2.....2...;.2..2S.2.....2..Rich.2..................PE..L..._..f...........!...).z...........J....................................................@.............................x...h........P...0..............................p........................... ...@...............H............................text....x.......z.................. ..`.rdata...............~..............@..@.data........0......................@....rsrc....0...P...2..................@..@.reloc...............L..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	716800
Entropy (8bit):	6.219577157189828
Encrypted:	false
SSDEEP:	12288:3patAdcuir6DuAstdFwBgHaaRRZbv4XqTC6Ri3JRFrt6rd6F1tuuuuuuYGpK7bA+:Zat2cuir6K7tdFJlbv2qTD0bFrBFbuuD
MD5:	57999FF1631929462DE24BA18F61AE1C
SHA1:	2AAAE073E752D32C6FD08DAC578C040924FE4B59
SHA-256:	B21C0ED7224784B642647A8EFAD45C634BF88646638823215818B25143FEE86E
SHA-512:	0AD42CBE76CA39353FBFBDD95411DF7ED830C960ACF5D1B943ECC424972FB326B2C69CCE680EFD9003D9650D0E791120A91AC8F2BE1AF09404F3D1EC6C4553E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........y...............`.......`.......................`4.......Z..............................`.......`................................X.......0.............Rich....................PE..d......f.........." ...).....N......\|........................................P............`......................................... V..H...hZ...........0.......I...........@.......\|..p...............................@...............p............................text.............................. ..`.rdata..............................@..@.data...H...........................@....pdata...I.......J...f..............@..@.rsrc....0.......2..................@..@.reloc.......@......................@..B................................................................................................................................................................................................

C:\Program Files\ExplorerPatcher\WebView2Loader.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	165336
Entropy (8bit):	6.238659206665009
Encrypted:	false
SSDEEP:	3072:7evoTTlTRTyiuPThTNTKm81SbbMYSPLNsknZiZ2HZ5AaliiT88FEtJ57dXSvlCW:HTlTRTyiuPThTNTKmFQdhsknZiMHfEti
MD5:	C5F0C46E91F354C58ECEC864614157D7
SHA1:	CB6F85C0B716B4FC3810DEB3EB9053BEB07E803C
SHA-256:	465A7DDFB3A0DA4C3965DAF2AD6AC7548513F42329B58AEBC337311C10EA0A6F
SHA-512:	287756078AA08130907BD8601B957E9E006CEF9F5C6765DF25CFAA64DDD0FFF7D92FFA11F10A00A4028687F3220EFDA8C64008DBCF205BEDAE5DA296E3896E91
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....sgf.........." .....\..........@F....................................................`A........................................Y...0.......(............P.......^...'..............T...................P...(....q..@...........h...........`....................text...][.......\.................. ..`.rdata..\|....p.......`..............@..@.data...D....0......................@....pdata.......P......."..............@..@.gxfg...p....p.......8..............@..@.retplne.............J...................tls.................L..............@..._RDATA...............N..............@..@.rsrc................P..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

C:\Program Files\ExplorerPatcher\ep_dwm.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	118272
Entropy (8bit):	5.883056677379098
Encrypted:	false
SSDEEP:	3072:ZmxpiUI+RrEAqTZLO1bLBbbmRYOalQIO:Z+iD+TqTZyhvlQ
MD5:	85FFBD19F247F682DF7CB348429BF563
SHA1:	A3534A2C41B46EF253ABE52D4F00F98EEDE00020
SHA-256:	770379D1A2DFF974D3A0D1D282B2BFD69E1C25CC2BB161C4DFB9B208330FBCB3
SHA-512:	DD78C6D09CA5831D9E5E5146AF6F5537142EE4B5DFCC40AB34271B81FACBA1C1F285EAB84FCBB8180460408FF888588BAEB3DA95D385A167EF0828B37367E1B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m.Lk..Lk..Lk......Ik.......k......Fk..\...Ek..\...\k..\...dk......Gk..Lk..4k......Mk......Mk..Lk..Mk......Mk..RichLk..........PE..d...r..f.........."....).............'.........@..........................................`....................................................x...............................h...0...p...............................@...............`............................text...`........................... ..`.rdata..Z...........................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................................

C:\Program Files\ExplorerPatcher\ep_gui.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	721408
Entropy (8bit):	5.53410489167774
Encrypted:	false
SSDEEP:	6144:czq5NAtIjhy7rsdQiwH94aG0b3Ssy23643TWlIksV+G:qqPA2jhyPdpt
MD5:	C83153FFC63411AAF525CAA6C50C1FFC
SHA1:	76EE60BBEE697882FE5390D0F50A9F521F281BDA
SHA-256:	422D9784435C893B810DC8D02B8EAA713A030ECDDE0C29AE5A588C889CE6A7DF
SHA-512:	363F259AA9FF47FE9D8F65A308EB3732581ECB703B827A773DD2C9AAA61BD90F89BFD1F8B1A1C5CAA86F213799FC4487053182425676ABAAA3A301453C4E8A0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?...{\|..{\|..{\|..0...}\|..0....\|..r.=.y\|..k...r\|..k...k\|..k...X\|..0...t\|..0...z\|..0...f\|..{\|.._}..3...s\|..3...z\|..3.Q.z\|..{\|9.j\|..3...z\|..Rich{\|..........PE..d......f.........." ...).....P......x........................................`............`.................................................<...,....P.......0...............P.........p...............................@............................................text... ........................... ..`.rdata..,...........................@..@.data...0#..........................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................

C:\Program Files\ExplorerPatcher\ep_setup.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10525696
Entropy (8bit):	7.989219365061286
Encrypted:	false
SSDEEP:	196608:aZN5gB3uI0Bn+2N8cL0yiao2ItCC2bO+WxNtTYneFC5YbMvr5GM6BZ2r34:QzgN4Bz7ieTCIKNtUniYYAvE
MD5:	45A5A443C01ABD7618EFEF4827241312
SHA1:	5390D36A371F0598B86301961D5FDB329E368E7A
SHA-256:	D7F98B8AF8A3BFE9D93CE31558A62E4D5D0CD425BC30BBC0D517901E5B82BF46
SHA-512:	0DF6330A020CE3B52320F087F56023DB069B56D4579B43A9827B8158BE430585B88FB43D98004EAE4E7A05F85086F5762DA17F51AF95FDB302669AE1C581F734
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!22622.3880.66.6.57999ff163192946S mode....$........^uOY?..Y?..Y?...G..\?...G...?......_?..I...P?..I...I?..I...q?...G..V?...G..X?...G..L?..Y?...?......]?......X?..Y?..H?......X?..RichY?..................PE..d......f.........."....).P...\................@.........................................`..................................................K..........p...........................p(..p...........................0'..@............`...............................text...0O.......P.................. ..`.rdata.. ....`.......T..............@..@.data...T....`.......R..............@....pdata...............^..............@..@.rsrc...p............z..............@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Program Files\ExplorerPatcher\ep_setup.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\ExplorerPatcher\ep_weather_host.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	244224
Entropy (8bit):	5.982282823910593
Encrypted:	false
SSDEEP:	3072:AjW86bHWeRLwF/ov4P3dUXqu/FYu9L33+C+TS9eEXB9aosuWoU6P:AEbHWK0gv4GXZ/rpjWoh
MD5:	F2920695EA15CC80E479D79F536437F1
SHA1:	3B65E31BD40D371303FB8C82A712BC8E3CBDD451
SHA-256:	350535396C011ED00753F6CD2D30FA1D38FD0F48077B1F9D461CB3DF1B1CF39D
SHA-512:	16FBF89D7B14F1FE6F1A2BF80838BBB28B9DB9D79255EB194A0952097D63B29438B5D95B2E64B49293828E1932BF73F47780E90F06502EB32A9386E9A23DE407
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.6vb.X%b.X%b.X%).[$g.X%).]$..X%ry[$k.X%ry\$m.X%ry]$B.X%).\$l.X%).Y$v.X%b.X%a.X%b.Y%..X%xP$a.X%xX$c.X%x.%c.X%b..%c.X%xZ$c.X%Richb.X%........PE..d...y..f.........." ...).............e....................................................`..........................................~......,.......................................@^..p............................]..@...............@............................text...0........................... ..`.rdata.............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	111616
Entropy (8bit):	5.926324663614139
Encrypted:	false
SSDEEP:	1536:/w+B6bvTxS8Si7ixJSHQ8YmpqvA9uf+UfKzwzsW7dJ9dlPbUremU:I3TxMpxJuQ8bpwouf+f07hJcemU
MD5:	AB6AA536FCAE0D915FC6856F66FF693C
SHA1:	9B20EB39735C80A2EC5974F477CDDDF72796D0FA
SHA-256:	0578867D07DF70F0080E5EB864F77C7356745347B1D9CDDD568F68E10FA8AA50
SHA-512:	E9BC6F57120F484C8E64A86F623E6B029E32F14BA49B70146AD6C16A84740C12A954F78B564F5619F55908AF200CA2FAC21E9E5DC35B6219A0FE7A6590B66524
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l.z.(...(...(...c...-...c.......c..."...8...!...8...&...8.......c.../...(...]...`...+...`...)...`..)...`...)...Rich(...........................PE..d...t..f.........." ...)............p.....................................................`.................................................X...P...............................x.......p...........................P...@...............8............................text... ........................... ..`.orpc...,........................... ..`.rdata.............................@..@.data...h...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..x...........................@..B........................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ExplorerPatcher\Properties (ExplorerPatcher).lnk

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=39, Archive, ctime=Thu Sep 8 02:06:01 2022, mtime=Thu Sep 12 15:31:11 2024, atime=Thu Sep 8 02:06:01 2022, length=71680, window=hide
Category:	modified
Size (bytes):	1960
Entropy (8bit):	3.2987134080978855
Encrypted:	false
SSDEEP:	24:80dnWsqSUlTyAoeiUHh+/Clo+sd/UW+fwT4o02QnzJ6f6Fqygm:86tUlt5iAlo7d/9fMoeoicyg
MD5:	AE38E966FFCF7909E0509B3BA238A489
SHA1:	A42F0C6DA9A13142BBBE13D338750DB6BC96A57F
SHA-256:	A90CD3AF9EB56238A66E3B2FB36727FF8B1862DDC3DC1051CEC5026C8DD6C8A7
SHA-512:	2628444B13A9671494625D50C0221C6F5F3DD40D57F00B846501B59C9A319E6B3CB00D1E88DAF8FDEFB4DC6A43289A2558F3846BC089CA28237B8D3490ECD3C2
Malicious:	false
Preview:	L..................F.@.. .....S./......-1.....S./.......'...................E....P.O. .:i.....+00.../C:\...................V.1.....DW!r..Windows.@......OwH,Y.....3........................W.i.n.d.o.w.s.....Z.1.....,Y...System32..B......OwH,Y............................w..S.y.s.t.e.m.3.2.....f.2.....(U.. .rundll32.exe..J......(U..,Y..........................b...r.u.n.d.l.l.3.2...e.x.e.......O...............-.......N.............Vl.....C:\Windows\System32\rundll32.exe....E.x.p.l.o.r.e.r.P.a.t.c.h.e.r./.....\.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.\.r.u.n.d.l.l.3.2...e.x.e...C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.3.".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.E.x.p.l.o.r.e.r.P.a.t.c.h.e.r.\.e.p._.g.u.i...d.l.l.".,.Z.Z.G.U.I...C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.........%SystemRoot%\system32\shell32.dll.............................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	109000
Entropy (8bit):	3.996240578535048
Encrypted:	false
SSDEEP:	768:alVCkDGeopQ1jk0ybncysAEN3Lxwm0jDfttPoelMPR1vPItSJ5bmLSypQg03pcf6:tk1oxncysAQHuxfhMi/GfnpAiFeKXWY
MD5:	C04464A08F8E460A469442A3A4C6EAA9
SHA1:	DE92FF8AD38DCEE3E26BDC11588F4383B3CD3479
SHA-256:	59C84C1748C38191052691A0E2DF32128B4E0D849D7DE8C039D56DEE8CE4A161
SHA-512:	9BCBE1FF514A18E9E951BCDE8F3B49CC8C1C23B4D37A0902A1BB60226CA57B5D288D25BC160CDB8356F80B01C25F84ECE5780F8D8A11E07C27B358C13FF0E807
Malicious:	false
Preview:	....h... ......x.......P...........x...Y......^...(...............X...W.......e.n.-.C.H.;.e.n.-.G.B...............H..............P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................a.l.f.o.n.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000014.db

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	104712
Entropy (8bit):	4.0227245661996065
Encrypted:	false
SSDEEP:	768:9Pl1+kKGURcstjk0WB5CWDB6NMLnBLjJ8AUPZ45yR1v9VKrQnmzypI3vI4Gs5haG:9OkwRS5CWDBN9haitG4n90Ff4KZyVG96
MD5:	BD04D9EF9CCC005C9501B4569D639F81
SHA1:	691AAB90A268EC6355C9D12FAD48F43D3F020FAA
SHA-256:	A2AF8A0626CF0C169AD0D3A57F5C5A27B20BB6A463D27EB1D241152897065EBF
SHA-512:	CF4A9F92CCDEFE24C0838366DD44DA3618C9DA7764F21FD3DA93BB13FB663484D6854A3CC9234A5B4FD9B64C072B5F790EE469F5F9C41C093C5F50012F905ADB
Malicious:	false
Preview:	....h... ..............P..............Y...0...^...h...................W.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................a.l.f.o.n.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000015.db

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	109000
Entropy (8bit):	3.997031879927255
Encrypted:	false
SSDEEP:	768:clVIkBGeopQ1jk0ybncysAEN3Lxwm0jDfttPoelMPR1vPItSJ5bmLSypQg03pcfK:RkPoxncysAQHuxfhMi/GfnpWiFeKXUY
MD5:	692608673A5557C444E35E612670A105
SHA1:	7692626337CBA3D8F8CD4565D2F2367FE65F7C14
SHA-256:	CF21D81106F4DB5594D2D6FF85C16196216A69FE68F4C411A59B57EC4AA73B69
SHA-512:	022410D6A0D9BDF890C1F19169878F5CACF6F6674D29815E064D1A806D9F5EA4D6F9B0763981D6850390D03C91AA588B219ADDEE5FFD81223841199BDEF06AD8
Malicious:	false
Preview:	....h... ......x.......P...........x...Y......^...(...............X...W.......e.n.-.C.H.;.e.n.-.G.B...............H..............P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................a.l.f.o.n.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\C0866EA3E544525B84B4BD79EA00F871272358DC594A98F105A217AFB95AD63000[1].blob

Download File

Process:	C:\Windows\explorer.exe
File Type:	MSVC program database ver 7.00, 4096*9067 bytes
Category:	dropped
Size (bytes):	37138432
Entropy (8bit):	5.6992441330393016
Encrypted:	false
SSDEEP:	196608:QU+lpXOVPmAUg3kCksUni4PqhapsuG/qMNP9T4frVOlnzToSgGoCgsqwq06kUQ4E:TVQu
MD5:	6EC8937793ABCA33686E941850AC379C
SHA1:	C33459B6BBAB2E5D0051557E0AA6E35266145CA1
SHA-256:	05E269FF0DD07EBF0B82857327B060CD5AF27870B88219C9257510E0AF312B52
SHA-512:	6FF4CBBA814245A5E3269191BB63E7A82DC40D7D7F862C17F6651F28CDB640023143057CAB4E54DCA20C77C5C515EA0EAC05883CE50CD4F1FB84F2DFB2B7CF51
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........k#..$.......j#..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\39B7A829951E377CD5C4AA3BD72155D9808470F724602420910673D8D0CC60C600[1].blob

Download File

Process:	C:\Windows\explorer.exe
File Type:	MSVC program database ver 7.00, 1024*18363 bytes
Category:	dropped
Size (bytes):	18803712
Entropy (8bit):	5.737102497890461
Encrypted:	false
SSDEEP:	49152:oOA4SzAnbR+FIRUS+XHaGMXy9jI7S7Ok4bYBBhUoNWSBjj3hIrHfwP6cYR+9JXZR:7Al/MgnOAGBJF+ZYautg
MD5:	C84AE6411BAC88E3A562ECC3F5F80A1B
SHA1:	22C2554E1143DF454DC48D055EB6F470603DBFB7
SHA-256:	766ADFB1144334B173FB47BA0CEFD7358F6B9D14FA656A92842849207A290A36
SHA-512:	7706D7BC50BF175267CF48CADA9C37132AED1F7FBC6E6C156A73391124C2E8E86E4D24348603655853A14195FE8DDD426A82CA773C49F15F076D302ADEE30737
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS............G...".......G..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Windows[2].json

Download File

Process:	C:\Windows\explorer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	746
Entropy (8bit):	5.114709545056856
Encrypted:	false
SSDEEP:	12:YWgc2TMM+FBuH+gM+FBKVwEHVctmXwH+2yrZMAdrKC8K/y8kEhq1HLxycXNNZ/T8:Yzc2TeuHnK2SVwHt0drc6hE14
MD5:	2736C0056996F53C05451AD555995ECE
SHA1:	C9E9E797C1DAEE4138DE775CD434F0C50E2D3DD6
SHA-256:	50EB0F78E4A9617CEA7D9EF801B4FA33530D00AA14059FF959FE5F63983E63D3
SHA-512:	B2C8781101BF48E07170B78B4ECD9CA9B0FD732165F47E72540E238147FA05660CBA3730176FDF1668EE8BDBA6171F4E71F738E45B84D3F4C10D5FB78976C8AD
Malicious:	false
Preview:	{"serviceContext":{"serviceActivityId":"66e3175a-b7ea-4478-a075-b60acbb051ec","responseCreationDateTime":"0001-01-01T00:00:00","debugId":"66e3175a-b7ea-4478-a075-b60acbb051ec\|2024-09-12T16:31:22.7740720Z\|fabric_msn\|ESU\|News_84"},"expirationDateTime":"0001-01-01T00:00:00","showBadge":false,"settings":{"refreshIntervalMinutes":0,"feedEnabled":true,"evolvedNotificationLifecycleEnabled":false,"showBadgeOnRotationsForEvolvedNotificationLifecycle":false,"webView2Enabled":false,"webView2EnabledV1":false,"windowsSuppressClientRace":false,"flyoutV2EndpointEnabled":false,"showAnimation":false,"useTallerFlyoutSize":false,"useDynamicHeight":false,"useWiderFlyoutSize":false,"reclaimEnabled":false,"isPreviewDurationsEnabled":false},"isPartial":false}

C:\Users\user\AppData\Roaming\ExplorerPatcher\StartUI.pdb

Download File

Process:	C:\Windows\explorer.exe
File Type:	MSVC program database ver 7.00, 4096*9067 bytes
Category:	dropped
Size (bytes):	37138432
Entropy (8bit):	5.6992441330393016
Encrypted:	false
SSDEEP:	196608:QU+lpXOVPmAUg3kCksUni4PqhapsuG/qMNP9T4frVOlnzToSgGoCgsqwq06kUQ4E:TVQu
MD5:	6EC8937793ABCA33686E941850AC379C
SHA1:	C33459B6BBAB2E5D0051557E0AA6E35266145CA1
SHA-256:	05E269FF0DD07EBF0B82857327B060CD5AF27870B88219C9257510E0AF312B52
SHA-512:	6FF4CBBA814245A5E3269191BB63E7A82DC40D7D7F862C17F6651F28CDB640023143057CAB4E54DCA20C77C5C515EA0EAC05883CE50CD4F1FB84F2DFB2B7CF51
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........k#..$.......j#..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ExplorerPatcher\twinui.pcshell.pdb

Download File

Process:	C:\Windows\explorer.exe
File Type:	MSVC program database ver 7.00, 1024*18363 bytes
Category:	dropped
Size (bytes):	18803712
Entropy (8bit):	5.737102497890461
Encrypted:	false
SSDEEP:	49152:oOA4SzAnbR+FIRUS+XHaGMXy9jI7S7Ok4bYBBhUoNWSBjj3hIrHfwP6cYR+9JXZR:7Al/MgnOAGBJF+ZYautg
MD5:	C84AE6411BAC88E3A562ECC3F5F80A1B
SHA1:	22C2554E1143DF454DC48D055EB6F470603DBFB7
SHA-256:	766ADFB1144334B173FB47BA0CEFD7358F6B9D14FA656A92842849207A290A36
SHA-512:	7706D7BC50BF175267CF48CADA9C37132AED1F7FBC6E6C156A73391124C2E8E86E4D24348603655853A14195FE8DDD426A82CA773C49F15F076D302ADEE30737
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS............G...".......G..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	716800
Entropy (8bit):	6.219577157189828
Encrypted:	false
SSDEEP:	12288:3patAdcuir6DuAstdFwBgHaaRRZbv4XqTC6Ri3JRFrt6rd6F1tuuuuuuYGpK7bA+:Zat2cuir6K7tdFJlbv2qTD0bFrBFbuuD
MD5:	57999FF1631929462DE24BA18F61AE1C
SHA1:	2AAAE073E752D32C6FD08DAC578C040924FE4B59
SHA-256:	B21C0ED7224784B642647A8EFAD45C634BF88646638823215818B25143FEE86E
SHA-512:	0AD42CBE76CA39353FBFBDD95411DF7ED830C960ACF5D1B943ECC424972FB326B2C69CCE680EFD9003D9650D0E791120A91AC8F2BE1AF09404F3D1EC6C4553E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........y...............`.......`.......................`4.......Z..............................`.......`................................X.......0.............Rich....................PE..d......f.........." ...).....N......\|........................................P............`......................................... V..H...hZ...........0.......I...........@.......\|..p...............................@...............p............................text.............................. ..`.rdata..............................@..@.data...H...........................@....pdata...I.......J...f..............@..@.rsrc....0.......2..................@..@.reloc.......@......................@..B................................................................................................................................................................................................

C:\Windows\dxgi.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	716800
Entropy (8bit):	6.219649477306373
Encrypted:	false
SSDEEP:	12288:PpatAdcuir6DuAstdFwBgHaaRRZbv4XqTC6Ri3JRFrt6rd6F1tuuuuuuYGpK7bA+:Bat2cuir6K7tdFJlbv2qTD0bFrBFbuuD
MD5:	A3F150CEC06C4434460EF680417AF1AC
SHA1:	A32958417D97509BE368CC48BAB8D9A1C8A9050D
SHA-256:	F0D8FA3DB3127ABCDED89ABBF13F8D3C0071169618A0340570AA9B389034F176
SHA-512:	B7354B772DBC6C137D35ACA2E9094E013D05A624A1A71F4B169EDFB07E4212369EF9FD78F23D996EC2C2B3A1E4A4FD158B5E60E347A9CCBA35E07CBA97E64C80
Malicious:	false
Preview:	MZ......................@...................................0...........!..L.!22622.3880.66.6.57999ff163192946S mode....$........y...............`.......`.......................`4.......Z..............................`.......`................................X.......0.............Rich....................PE..d......f.........." ...).....N......\|........................................P............`......................................... V..H...hZ...........0.......I...........@.......\|..p...............................@...............p............................text.............................. ..`.rdata..............................@..@.data...H...........................@....pdata...I.......J...f..............@..@.rsrc....0.......2..................@..@.reloc.......@......................@..B................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.989219365061286
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
File size:	10'525'696 bytes
MD5:	45a5a443c01abd7618efef4827241312
SHA1:	5390d36a371f0598b86301961d5fdb329e368e7a
SHA256:	d7f98b8af8a3bfe9d93ce31558a62e4d5d0cd425bc30bbc0d517901e5b82bf46
SHA512:	0df6330a020ce3b52320f087f56023db069b56d4579b43a9827b8158be430585b88fb43d98004eae4e7a05f85086f5762da17f51af95fdb302669ae1c581f734
SSDEEP:	196608:aZN5gB3uI0Bn+2N8cL0yiao2ItCC2bO+WxNtTYneFC5YbMvr5GM6BZ2r34:QzgN4Bz7ieTCIKNtUniYYAvE
TLSH:	5AB63328B7E109CAF577D338C4B7584B52D97D0A1A30C87E9B60059E4D23BE1DA3877A
File Content Preview:	MZ......................@...............................................!..L.!22622.3880.66.6.57999ff163192946S mode....$........^uOY?..Y?..Y?...G..\?...G...?......_?..I...P?..I...I?..I...q?...G..V?...G..X?...G..L?..Y?...?......]?......X?..Y?..H?......X?.

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140008bd8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66E2DBAB [Thu Sep 12 12:16:43 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	f1499aa854493f33c80eb31e0ab8ae92

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F3730B79C30h
dec eax
add esp, 28h
jmp 00007F3730B7985Fh
int3
int3
dec eax
sub esp, 28h
call 00007F3730B7A2C8h
test eax, eax
je 00007F3730B79A03h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F3730B799E7h
dec eax
cmp ecx, eax
je 00007F3730B799F6h
xor eax, eax
dec eax
cmpxchg dword ptr [0002E460h], ecx
jne 00007F3730B799D0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F3730B799D9h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F3730B799E9h
mov byte ptr [0002E449h], 00000001h
call 00007F3730B79FB5h
call 00007F3730B7D640h
test al, al
jne 00007F3730B799E6h
xor al, al
jmp 00007F3730B799F6h
call 00007F3730B88E1Fh
test al, al
jne 00007F3730B799EBh
xor ecx, ecx
call 00007F3730B7D650h
jmp 00007F3730B799CCh
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0002E410h], 00000000h
mov ebx, ecx
jne 00007F3730B79A49h
cmp ecx, 01h
jnbe 00007F3730B79A4Ch
call 00007F3730B7A23Eh
test eax, eax
je 00007F3730B79A0Ah
test ebx, ebx
jne 00007F3730B79A06h
dec eax
lea ecx, dword ptr [0002E3FAh]
call 00007F3730B88C3Eh
test eax, eax
jne 00007F3730B799F2h
dec eax
lea ecx, dword ptr [0002E402h]
call 00007F3730B79A2Eh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x34bfc	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3a000	0x9d1870	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x38000	0x1aac	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa0c000	0x6a4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x32870	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x32730	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x26000	0x508	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x24f30	0x25000	173e7f97391bc8314dd470c483309938	False	0.5402040223817568	data	6.4691102710132915	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x26000	0xfd20	0xfe00	9e2d4b48d9fe068301a1f9d10650bbc7	False	0.48297551673228345	data	5.364699069479192	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x36000	0x1f54	0xc00	70729d2ec4f7f720830ce88e7a8defb2	False	0.138671875	data	1.9570761316523926	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x38000	0x1aac	0x1c00	f7c2ea792d907b5dce52bcd41206cef3	False	0.4693080357142857	PEX Binary Archive	5.278111274874002	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x3a000	0x9d1870	0x9d1a00	608280b907541a797dcf705572785f4e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa0c000	0x6a4	0x800	ed65753989fd21fecc4c316e3fbbc451	False	0.51025390625	data	5.001370553375213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_STRING	0xa0b238	0x13e	data	Chinese	Taiwan	0.7327044025157232
RT_STRING	0xa03d18	0x2ae	data	German	Germany	0.43731778425655976
RT_STRING	0xa03498	0x2a2	data	English	United States	0.4169139465875371
RT_STRING	0xa04788	0x2b8	data	French	France	0.43103448275862066
RT_STRING	0xa05118	0x280	data	Hungarian	Hungary	0.46875
RT_STRING	0xa06318	0x1b2	data	Japanese	Japan	0.6428571428571429
RT_STRING	0xa06870	0x170	data	Korean	North Korea	0.7010869565217391
RT_STRING	0xa06870	0x170	data	Korean	South Korea	0.7010869565217391
RT_STRING	0xa07660	0x294	data	Dutch	Netherlands	0.4393939393939394
RT_STRING	0xa07f98	0x2ac	data	Polish	Poland	0.4473684210526316
RT_STRING	0xa08920	0x294	data	Romanian	Romania	0.4348484848484849
RT_STRING	0xa092b0	0x2ac	data	Russian	Russia	0.4780701754385965
RT_STRING	0xa09b90	0x2c4	data	Turkish	Turkey	0.4477401129943503
RT_STRING	0xa05a40	0x292	data	Indonesian	Indonesia	0.4133738601823708
RT_STRING	0xa0a558	0x2d4	data	Ukrainian	Ukrain	0.47790055248618785
RT_STRING	0xa06d50	0x2c8	data	Lithuanian	Lithuania	0.45365168539325845
RT_STRING	0xa0aea8	0x132	data	Chinese	China	0.7320261437908496
RT_STRING	0xa0b378	0x272	data	Chinese	Taiwan	0.6597444089456869
RT_STRING	0xa03fc8	0x7bc	data	German	Germany	0.33636363636363636
RT_STRING	0xa03740	0x5d4	data	English	United States	0.36126005361930297
RT_STRING	0xa04a40	0x6d2	data	French	France	0.35051546391752575
RT_STRING	0xa05398	0x6a2	data	Hungarian	Hungary	0.37809187279151946
RT_STRING	0xa064d0	0x39c	data	Japanese	Japan	0.5703463203463204
RT_STRING	0xa069e0	0x36c	data	Korean	North Korea	0.5753424657534246
RT_STRING	0xa069e0	0x36c	data	Korean	South Korea	0.5753424657534246
RT_STRING	0xa078f8	0x69a	data	Dutch	Netherlands	0.3502958579881657
RT_STRING	0xa08248	0x6d2	data	Polish	Poland	0.3722794959908362
RT_STRING	0xa08bb8	0x6f8	data	Romanian	Romania	0.34697309417040356
RT_STRING	0xa09560	0x62e	data	Russian	Russia	0.3950695322376738
RT_STRING	0xa09e58	0x700	data	Turkish	Turkey	0.34933035714285715
RT_STRING	0xa05cd8	0x63c	data	Indonesian	Indonesia	0.3533834586466165
RT_STRING	0xa0a830	0x678	data	Ukrainian	Ukrain	0.39492753623188404
RT_STRING	0xa07018	0x648	data	Lithuanian	Lithuania	0.36691542288557216
RT_STRING	0xa0afe0	0x258	data	Chinese	China	0.66
RT_RCDATA	0x3a7b0	0x9c8ce4	Zip archive data, at least v2.0 to extract, compression method=deflate	English	United States	0.9992465972900391
RT_VERSION	0x3a430	0x380	data	English	United States	0.43526785714285715
RT_MANIFEST	0xa0b5f0	0x27e	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5517241379310345

Imports

DLL	Import
KERNEL32.dll	TerminateProcess, RemoveDirectoryW, GetModuleFileNameW, FindClose, K32GetProcessImageFileNameW, GetUserPreferredUILanguages, OpenProcess, MultiByteToWideChar, CreateThread, K32EnumProcesses, GetCurrentDirectoryW, GetProcAddress, GetCurrentProcessId, GetModuleHandleW, FreeLibrary, CopyFileW, CreateSymbolicLinkW, lstrcmpW, MoveFileW, GetProcessTimes, LoadLibraryExW, WriteConsoleW, SetEndOfFile, WriteFile, HeapSize, FlushFileBuffers, GetProcessHeap, GetStringTypeW, SetStdHandle, FreeEnvironmentStringsW, GetEnvironmentStringsW, WideCharToMultiByte, GetCommandLineW, GetCommandLineA, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, FindFirstFileExW, ReadConsoleW, SetFilePointerEx, GetConsoleMode, GetConsoleOutputCP, FindNextFileW, SetLastError, FindFirstFileW, GetExitCodeProcess, MapViewOfFile, CreateFileMappingW, LocalFree, GetWindowsDirectoryW, FindResourceW, LoadResource, CloseHandle, DeleteFileW, LockResource, GetLastError, Sleep, CreateEventW, FreeResource, UnmapViewOfFile, GetSystemDirectoryW, CreateFileW, LocalAlloc, WaitForSingleObject, GetCurrentProcess, GetFileSizeEx, SizeofResource, ReadFile, HeapReAlloc, CreateDirectoryW, LCMapStringW, FlsFree, FlsSetValue, FlsGetValue, FlsAlloc, GetFileType, HeapFree, HeapAlloc, GetStdHandle, GetModuleHandleExW, ExitProcess, RtlPcToFileHeader, RaiseException, EncodePointer, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, RtlUnwindEx, GetStartupInfoW, IsDebuggerPresent, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead
USER32.dll	ExitWindowsEx, GetWindowThreadProcessId, SetProcessDpiAwarenessContext, SendMessageTimeoutW, MessageBoxW, SendMessageW, LoadStringW, FindWindowW
ADVAPI32.dll	RevertToSelf, EqualSid, RegDeleteKeyW, AllocateAndInitializeSid, RegDeleteKeyValueW, RegCreateKeyExW, CreateProcessWithTokenW, ImpersonateLoggedOnUser, RegDeleteTreeW, RegSetValueExW, FreeSid, CheckTokenMembership, DuplicateTokenEx, RegOpenKeyW, RegQueryValueExW, GetTokenInformation, LookupPrivilegeValueW, AdjustTokenPrivileges, RegCloseKey, OpenProcessToken, RegOpenKeyExW, RegGetValueW
SHELL32.dll	SHGetFolderPathW, ShellExecuteW, SHFileOperationW, CommandLineToArgvW, ShellExecuteExW
ole32.dll	CoInitialize, CoUninitialize, CoCreateInstance
RstrtMgr.DLL	RmRegisterResources, RmGetList, RmStartSession, RmShutdown
VERSION.dll	VerQueryValueW
SHLWAPI.dll	PathRemoveExtensionW, PathRemoveFileSpecW, PathStripPathW, PathFileExistsW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan
German	Germany
English	United States
French	France
Hungarian	Hungary
Japanese	Japan
Korean	North Korea
Korean	South Korea
Dutch	Netherlands
Polish	Poland
Romanian	Romania
Russian	Russia
Turkish	Turkey
Indonesian	Indonesia
Ukrainian	Ukrain
Lithuanian	Lithuania
Chinese	China

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-12T18:31:25.080721+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49711	140.82.121.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 12, 2024 18:31:24.181301117 CEST	49711	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:24.181343079 CEST	443	49711	140.82.121.3	192.168.2.5
Sep 12, 2024 18:31:24.181402922 CEST	49711	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:24.181694031 CEST	49711	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:24.181708097 CEST	443	49711	140.82.121.3	192.168.2.5
Sep 12, 2024 18:31:24.816498995 CEST	443	49711	140.82.121.3	192.168.2.5
Sep 12, 2024 18:31:24.816601038 CEST	49711	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:24.827924013 CEST	49711	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:24.827958107 CEST	443	49711	140.82.121.3	192.168.2.5
Sep 12, 2024 18:31:24.828099966 CEST	49711	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:24.828108072 CEST	443	49711	140.82.121.3	192.168.2.5
Sep 12, 2024 18:31:24.828320980 CEST	443	49711	140.82.121.3	192.168.2.5
Sep 12, 2024 18:31:24.828391075 CEST	49711	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:25.080730915 CEST	443	49711	140.82.121.3	192.168.2.5
Sep 12, 2024 18:31:25.080828905 CEST	443	49711	140.82.121.3	192.168.2.5
Sep 12, 2024 18:31:25.080888987 CEST	49711	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:25.080907106 CEST	443	49711	140.82.121.3	192.168.2.5
Sep 12, 2024 18:31:25.081027985 CEST	443	49711	140.82.121.3	192.168.2.5
Sep 12, 2024 18:31:25.081082106 CEST	49711	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:25.084069014 CEST	49711	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:25.084079981 CEST	443	49711	140.82.121.3	192.168.2.5
Sep 12, 2024 18:31:25.084753990 CEST	49712	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:25.084785938 CEST	443	49712	140.82.121.3	192.168.2.5
Sep 12, 2024 18:31:25.085002899 CEST	49712	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:25.085277081 CEST	49712	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:25.085290909 CEST	443	49712	140.82.121.3	192.168.2.5
Sep 12, 2024 18:31:25.747603893 CEST	443	49712	140.82.121.3	192.168.2.5
Sep 12, 2024 18:31:25.747764111 CEST	49712	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:26.705178976 CEST	49712	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:26.705216885 CEST	443	49712	140.82.121.3	192.168.2.5
Sep 12, 2024 18:31:26.705580950 CEST	49712	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:26.705586910 CEST	443	49712	140.82.121.3	192.168.2.5
Sep 12, 2024 18:31:26.893964052 CEST	443	49712	140.82.121.3	192.168.2.5
Sep 12, 2024 18:31:26.894085884 CEST	49712	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:26.894469023 CEST	443	49712	140.82.121.3	192.168.2.5
Sep 12, 2024 18:31:26.894529104 CEST	443	49712	140.82.121.3	192.168.2.5
Sep 12, 2024 18:31:26.894537926 CEST	49712	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:26.894576073 CEST	49712	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:26.959115982 CEST	49712	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:26.959115982 CEST	49712	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:26.959148884 CEST	443	49712	140.82.121.3	192.168.2.5
Sep 12, 2024 18:31:26.959209919 CEST	49712	443	192.168.2.5	140.82.121.3
Sep 12, 2024 18:31:27.052664995 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.052719116 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.052792072 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.055124998 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.055141926 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.521555901 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.521923065 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.686562061 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.686598063 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.686654091 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.686661005 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.687612057 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.687690020 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.826867104 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.826939106 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.827013969 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.827205896 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.827253103 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.827253103 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.827284098 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.827349901 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.827363968 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.827438116 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.827450991 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.827512026 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.827523947 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.827569962 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.827584028 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.827636003 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.827660084 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.827683926 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.827730894 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.827763081 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.827792883 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.827847004 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.828190088 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.828248024 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.833906889 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.833988905 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.911892891 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.911952019 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.911979914 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.912017107 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.912024021 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.912055969 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.912061930 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.912072897 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.912092924 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.912151098 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.912250996 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.912301064 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.912307978 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.912343025 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.912343979 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.912352085 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.912374973 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.912400961 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.912947893 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.912995100 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.913047075 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.913116932 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.913155079 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.913165092 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.913202047 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.913829088 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.913866043 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.913876057 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.913913012 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.913918018 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.913954973 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.913960934 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.914022923 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.914668083 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.914716005 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.914724112 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.914762020 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.914768934 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.914815903 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.914853096 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.914859056 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.914891958 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.915494919 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.915540934 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.958498001 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.958549976 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.958583117 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.958643913 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.958650112 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.958884001 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.998409986 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.998477936 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.998492002 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.998522043 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.998539925 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.998549938 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.998553991 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.998589039 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.998622894 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.998630047 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.998668909 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.998689890 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.998694897 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.998714924 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.998739958 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:27.998744965 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:27.998775959 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.000415087 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.000422955 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.000456095 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.000509977 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.000529051 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.000555038 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.000576019 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.002119064 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.002136946 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.002197981 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.002207994 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.002242088 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.045892954 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.045913935 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.045989037 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.046020985 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.046041965 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.046066046 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.086139917 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.086163998 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.086308956 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.086350918 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.086913109 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.086935997 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.086976051 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.086983919 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.087007999 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.087054968 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.087922096 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.087938070 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.087994099 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.088001013 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.088022947 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.088044882 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.089096069 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.089112997 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.089186907 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.089196920 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.089792967 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.089811087 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.089857101 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.089864969 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.089888096 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.089907885 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.132361889 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.132384062 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.132550001 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.132579088 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.132944107 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.132962942 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.133013010 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.133028984 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.133081913 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.133081913 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.172548056 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.172573090 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.172738075 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.172775030 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.172815084 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.172837973 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.172871113 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.172878027 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.172910929 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.172929049 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.173546076 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.173577070 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.173604965 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.173609018 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.173631907 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.173645020 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.174180984 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.174197912 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.174226999 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.174231052 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.174257040 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.174276114 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.177122116 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.177144051 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.177208900 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.177217960 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.177423000 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.177443981 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.177479029 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.177484035 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.177499056 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.177529097 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.219300032 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.219330072 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.219466925 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.219499111 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.219717979 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.259141922 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.259205103 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.259332895 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.259332895 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.259371996 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.259454966 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.259512901 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.259520054 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.259546995 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.259598970 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.259604931 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.259639025 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.259704113 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.259723902 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.259773970 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.259780884 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.259912968 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.259931087 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.259957075 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.259963036 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.259984970 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.260006905 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.260308981 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.260329008 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.260370016 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.260376930 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.260711908 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.260729074 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.260760069 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.260767937 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.260788918 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.260812998 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.261106968 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.261127949 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.261169910 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.261177063 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.261244059 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.310622931 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.310678959 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.310755014 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.310790062 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.310811996 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.311469078 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.345999956 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.346050024 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.346087933 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.346124887 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.346144915 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.346159935 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.346355915 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.346398115 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.346419096 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.346426964 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.346450090 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.346467972 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.346719980 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.346772909 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.346777916 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.346834898 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.551414013 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.551493883 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:28.759433031 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:28.759608984 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:29.179404020 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:29.179558039 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:29.219444990 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:29.219455957 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:29.219465971 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:29.219535112 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:29.219541073 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:29.219551086 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:29.219610929 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:29.219616890 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:29.219631910 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:29.219641924 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:29.219728947 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:29.219749928 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:29.219769955 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:29.219789982 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:29.219795942 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:29.219883919 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:29.219892979 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:29.219937086 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:29.219944000 CEST	443	49718	185.199.108.133	192.168.2.5
Sep 12, 2024 18:31:29.219990969 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:29.220015049 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:29.220196962 CEST	49718	443	192.168.2.5	185.199.108.133
Sep 12, 2024 18:31:29.220395088 CEST	49718	443	192.168.2.5	185.199.108.133

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 12, 2024 18:31:22.091531992 CEST	53244	53	192.168.2.5	1.1.1.1
Sep 12, 2024 18:31:24.167186022 CEST	56437	53	192.168.2.5	1.1.1.1
Sep 12, 2024 18:31:24.176265955 CEST	53	56437	1.1.1.1	192.168.2.5
Sep 12, 2024 18:31:27.044583082 CEST	59283	53	192.168.2.5	1.1.1.1
Sep 12, 2024 18:31:27.051902056 CEST	53	59283	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 12, 2024 18:31:22.091531992 CEST	192.168.2.5	1.1.1.1	0xf6e5	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Sep 12, 2024 18:31:24.167186022 CEST	192.168.2.5	1.1.1.1	0xaac1	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Sep 12, 2024 18:31:27.044583082 CEST	192.168.2.5	1.1.1.1	0xcb28	Standard query (0)	objects.githubusercontent.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 12, 2024 18:31:22.098771095 CEST	1.1.1.1	192.168.2.5	0xf6e5	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 12, 2024 18:31:24.176265955 CEST	1.1.1.1	192.168.2.5	0xaac1	No error (0)	github.com		140.82.121.3	A (IP address)	IN (0x0001)	false
Sep 12, 2024 18:31:27.051902056 CEST	1.1.1.1	192.168.2.5	0xcb28	No error (0)	objects.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Sep 12, 2024 18:31:27.051902056 CEST	1.1.1.1	192.168.2.5	0xcb28	No error (0)	objects.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Sep 12, 2024 18:31:27.051902056 CEST	1.1.1.1	192.168.2.5	0xcb28	No error (0)	objects.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Sep 12, 2024 18:31:27.051902056 CEST	1.1.1.1	192.168.2.5	0xcb28	No error (0)	objects.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

github.com

objects.githubusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49711	140.82.121.3	443	2980	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-12 16:31:24 UTC	126	OUT	GET /valinet/ExplorerPatcher/releases/latest/download/ep_setup.exe HTTP/1.1 User-Agent: ExplorerPatcher Host: github.com
2024-09-12 16:31:25 UTC	547	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Thu, 12 Sep 2024 16:31:18 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Location: https://github.com/valinet/ExplorerPatcher/releases/download/22621.3880.66.5_5094108/ep_setup.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-09-12 16:31:25 UTC	3162	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co
2024-09-12 16:31:25 UTC	782	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 67 68 5f 73 65 73 73 3d 76 25 32 42 47 43 7a 25 32 42 44 67 38 68 78 46 68 61 4f 33 75 6a 6d 33 47 49 41 56 79 44 5a 59 72 42 63 48 30 6b 63 6d 45 63 57 4c 62 25 32 42 79 6f 68 6a 25 32 42 57 31 6e 6a 48 30 49 6b 57 62 55 55 47 4e 25 32 42 63 49 50 70 37 79 50 25 32 46 32 63 4c 4c 34 4a 5a 63 46 73 59 78 76 6a 54 4e 76 68 6b 35 67 41 46 76 6c 46 50 4c 54 79 41 73 45 33 47 39 42 55 32 7a 46 51 71 4c 33 6e 6b 4d 68 4f 38 6c 67 4f 33 4a 74 42 57 34 65 7a 47 57 32 6e 37 6f 50 4a 67 42 74 45 6d 51 6e 76 42 69 25 32 42 42 50 4c 62 36 57 36 43 57 65 36 6f 41 64 41 47 48 35 57 4a 58 25 32 46 75 50 70 53 51 46 42 58 25 32 42 35 47 70 66 5a 48 71 37 43 34 36 4b 51 59 6b 58 78 45 65 65 41 54 79 4f 37 34 4c 58 4e 25 32 46 68 62 Data Ascii: Set-Cookie: _gh_sess=v%2BGCz%2BDg8hxFhaO3ujm3GIAVyDZYrBcH0kcmEcWLb%2Byohj%2BW1njH0IkWbUUGN%2BcIPp7yP%2F2cLL4JZcFsYxvjTNvhk5gAFvlFPLTyAsE3G9BU2zFQqL3nkMhO8lgO3JtBW4ezGW2n7oPJgBtEmQnvBi%2BBPLb6W6CWe6oAdAGH5WJX%2FuPpSQFBX%2B5GpfZHq7C46KQYkXxEeeATyO74LXN%2Fhb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49712	140.82.121.3	443	2980	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-12 16:31:26 UTC	167	OUT	GET /valinet/ExplorerPatcher/releases/download/22621.3880.66.5_5094108/ep_setup.exe HTTP/1.1 User-Agent: ExplorerPatcher Host: github.com Connection: Keep-Alive
2024-09-12 16:31:26 UTC	997	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Thu, 12 Sep 2024 16:31:19 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/394318710/d0ea7754-53d3-4f5a-b870-915f924fbb56?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240912%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240912T163119Z&X-Amz-Expires=300&X-Amz-Signature=ccbd5355f6cdf8d7af2b5fc3c342d46db9d98756c5381b9b25100712ee9e2190&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=394318710&response-content-disposition=attachment%3B%20filename%3Dep_setup.exe&response-content-type=application%2Foctet-stream Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-09-12 16:31:26 UTC	3263	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49718	185.199.108.133	443	2980	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-12 16:31:27 UTC	617	OUT	GET /github-production-release-asset-2e65be/394318710/d0ea7754-53d3-4f5a-b870-915f924fbb56?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240912%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240912T163119Z&X-Amz-Expires=300&X-Amz-Signature=ccbd5355f6cdf8d7af2b5fc3c342d46db9d98756c5381b9b25100712ee9e2190&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=394318710&response-content-disposition=attachment%3B%20filename%3Dep_setup.exe&response-content-type=application%2Foctet-stream HTTP/1.1 User-Agent: ExplorerPatcher Connection: Keep-Alive Host: objects.githubusercontent.com
2024-09-12 16:31:27 UTC	800	IN	HTTP/1.1 200 OK Connection: close Content-Length: 10525184 Content-Type: application/octet-stream Last-Modified: Tue, 03 Sep 2024 02:49:02 GMT ETag: "0x8DCCBC2F824451F" Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 3218f093-301e-0031-6aab-fd0046000000 x-ms-version: 2020-10-02 x-ms-creation-time: Tue, 03 Sep 2024 02:49:02 GMT x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob Content-Disposition: attachment; filename=ep_setup.exe x-ms-server-encrypted: true Via: 1.1 varnish, 1.1 varnish Fastly-Restarts: 1 Accept-Ranges: bytes Date: Thu, 12 Sep 2024 16:31:27 GMT Age: 5257 X-Served-By: cache-iad-kcgs7200179-IAD, cache-ewr-kewr1740048-EWR X-Cache: HIT, HIT X-Cache-Hits: 4648, 1 X-Timer: S1726158688.737418,VS0,VE1
2024-09-12 16:31:27 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 32 32 36 32 32 2e 33 38 38 30 2e 36 36 2e 35 2e 33 32 30 63 34 62 62 36 66 38 38 36 65 63 61 62 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad a7 1e 97 e9 c6 70 c4 e9 c6 70 c4 e9 c6 70 c4 a2 be 73 c5 ec c6 70 c4 a2 be 75 c5 7e c6 70 c4 a1 43 74 c5 ef c6 70 c4 f9 42 73 c5 e0 c6 70 c4 f9 42 74 c5 fb c6 70 c4 f9 42 75 c5 c1 c6 70 c4 a2 be 74 c5 f9 c6 70 c4 a2 be 76 c5 e8 c6 70 c4 a2 be 71 c5 fc c6 70 c4 e9 c6 71 c4 33 c6 70 c4 a1 43 78 c5 ed c6 70 c4 a1 43 8f c4 e8 c6 70 c4 e9 c6 e7 c4 f8 c6 70 c4 a1 43 72 c5 e8 c6 70 Data Ascii: MZ@ !L!22622.3880.66.5.320c4bb6f886ecabS mode.$pppspu~pCtpBspBtpBuptpvpqpq3pCxpCppCrp
2024-09-12 16:31:27 UTC	1378	IN	Data Raw: 8b 7c 9c 60 3b 7c 24 30 75 6c 44 8b c7 33 d2 b9 10 04 00 00 ff 15 0c 61 02 00 48 8b f0 48 85 c0 74 54 41 b8 04 01 00 00 48 8d 94 24 60 20 00 00 48 8b c8 ff 15 0d 61 02 00 48 8d 44 24 40 48 8b ce 4c 8d 4c 24 48 48 89 44 24 20 4c 8d 44 24 50 48 8d 54 24 38 ff 15 0b 5f 02 00 48 8b 44 24 38 41 3b 46 04 73 07 41 89 3e 49 89 46 04 48 8b ce ff 15 80 60 02 00 48 ff c3 48 3b dd 7c 82 48 8b bc 24 98 22 00 00 48 8b b4 24 90 22 00 00 49 8b c6 48 8b 8c 24 70 22 00 00 48 33 cc e8 0d 77 00 00 4c 8d 9c 24 80 22 00 00 49 8b 5b 20 49 8b 6b 28 49 8b e3 41 5e c3 cc cc cc cc cc cc cc b8 48 2a 00 00 e8 56 3e 02 00 48 2b e0 48 8b 05 cc 5d 03 00 48 33 c4 48 89 84 24 30 2a 00 00 4c 8d 05 9a 7b 03 00 33 d2 48 8d 0d 25 68 03 00 ff 15 db 61 02 00 85 c0 0f 85 8f 00 00 00 48 8d 4c 24 Data Ascii: \|`;\|$0ulD3aHHtTAH$` HaHD$@HLL$HHD$ LD$PHT$8_HD$8A;FsA>IFH`HH;\|H$"H$"IH$p"H3wL$"I[ Ik(IA^HV>H+H]H3H$0L{3H%haHL$
2024-09-12 16:31:27 UTC	1378	IN	Data Raw: 00 00 00 33 c0 c3 cc cc cc cc cc cc 33 c0 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 40 53 48 81 ec a0 08 00 00 48 8b 05 10 59 03 00 48 33 c4 48 89 84 24 90 08 00 00 48 8b 02 4c 8d 84 24 80 00 00 00 48 8b da 45 33 c9 33 d2 48 8b cb ff 50 20 48 8b 03 48 8d 54 24 30 48 8b cb 48 c7 44 24 30 00 00 00 00 ff 50 28 48 8b 03 48 8d 54 24 40 0f 57 c0 48 8b cb 0f 11 44 24 40 0f 11 44 24 50 0f 11 44 24 60 0f 11 44 24 70 ff 50 18 48 8b 44 24 30 48 8d 0d 58 07 03 00 44 8b 8c 24 80 00 00 00 48 8d 15 4d 07 03 00 4c 8b 44 24 48 48 85 c0 48 0f 45 c8 48 8b 44 24 50 48 89 4c 24 28 41 ff c1 48 8d 8c 24 90 00 00 00 48 89 44 24 20 ff 15 09 5d 02 00 48 8b 4c 24 30 ff 15 6e 5c 02 00 48 8b 4c 24 48 ff 15 63 5c 02 00 48 8b 4c 24 50 ff 15 58 5c 02 00 48 8b 4c 24 58 ff 15 4d 5c 02 00 Data Ascii: 33@SHHYH3H$HL$HE33HP HHT$0HHD$0P(HHT$@WHD$@D$PD$`D$pPHD$0HXD$HMLD$HHHEHD$PHL$(AH$HD$ ]HL$0n\HL$Hc\HL$PX\HL$XM\
2024-09-12 16:31:27 UTC	1378	IN	Data Raw: 01 00 00 48 8d 8d 90 01 00 00 e8 df 36 01 00 33 c9 ff 15 cb 58 02 00 85 c0 0f 88 f5 00 00 00 48 8d 44 24 30 4c 89 7c 24 30 4c 8d 0d 9a 59 02 00 48 89 44 24 20 33 d2 48 8d 0d 9c 59 02 00 41 b8 03 00 00 00 ff 15 a0 58 02 00 85 c0 0f 88 bc 00 00 00 48 8b 4c 24 30 48 8b d6 48 8b 01 ff 90 a0 00 00 00 48 8b 4c 24 30 49 8b d6 48 8b 01 ff 50 58 48 8b 4c 24 30 48 8d 95 90 01 00 00 41 b8 27 00 00 00 48 8b 01 ff 90 88 00 00 00 48 8d 8d 90 01 00 00 ff 15 b9 57 02 00 48 8b 4c 24 30 48 8d 95 90 01 00 00 48 8b 01 ff 50 48 48 8b 4c 24 30 48 8d 15 13 02 03 00 48 8b 01 ff 50 38 48 8b 4c 24 30 4c 8d 44 24 38 4c 89 7c 24 38 48 8d 15 27 59 02 00 48 8b 01 ff 10 85 c0 78 27 48 8b 4c 24 38 48 8d 55 80 bf 01 00 00 00 44 8b c7 48 8b 01 ff 50 30 48 8b 4c 24 38 85 c0 0f 49 df 48 8b Data Ascii: H63XHD$0L\|$0LYHD$ 3HYAXHL$0HHHL$0IHPXHL$0HA'HHWHL$0HHPHHL$0HHP8HL$0LD$8L\|$8H'YHx'HL$8HUDHP0HL$8IH
2024-09-12 16:31:27 UTC	1378	IN	Data Raw: ff 15 b2 4e 02 00 8b d8 48 8b 4d cf ff 15 ee 4e 02 00 85 db 41 0f 94 c4 41 8b c4 48 8b 4d 2f 48 33 cc e8 61 67 00 00 48 81 c4 c8 00 00 00 41 5d 41 5c 5b 5d c3 cc cc cc 48 8b c1 c3 cc cc cc cc cc cc cc cc cc cc cc cc 48 89 74 24 10 57 48 83 ec 20 48 8b f2 41 8b f9 48 8b 52 10 4d 8b c8 48 8b 4e 08 48 8d 04 3a 48 3b c1 76 04 8b f9 2b fa 85 ff 74 1e 48 03 16 49 8b c9 48 89 5c 24 30 44 8b c7 8b df e8 cf 33 02 00 48 01 5e 10 48 8b 5c 24 30 48 8b 74 24 38 8b c7 48 83 c4 20 5f c3 cc cc cc cc cc cc cc cc cc 48 8b 42 10 c3 cc cc cc cc cc cc cc cc cc cc cc 45 85 c9 74 16 41 83 e9 01 74 0c 41 83 f9 01 75 10 4c 03 42 08 eb 04 4c 03 42 10 4c 3b 42 08 76 06 b8 ff ff ff ff c3 4c 89 42 10 33 c0 c3 cc cc 48 89 5c 24 08 48 89 6c 24 10 48 89 74 24 18 48 89 7c 24 20 41 56 48 Data Ascii: NHMNAAHM/H3agHA]A\[]HHt$WH HAHRMHNH:H;v+tHIH\$0D3H^H\$0Ht$8H _HBEtAtAuLBLBL;BvLB3H\$Hl$Ht$H\|$ AVH
2024-09-12 16:31:27 UTC	1378	IN	Data Raw: 00 00 8b f7 ff 15 44 4b 02 00 85 c0 0f 84 91 01 00 00 4c 8d 05 cd f2 02 00 ba 04 01 00 00 48 8d 8d f0 03 00 00 e8 00 2c 01 00 48 8d 95 f0 03 00 00 48 2b d3 66 90 0f b7 0b 0f b7 04 13 2b c8 75 08 48 83 c3 02 85 c0 75 ed 85 c9 0f 85 52 01 00 00 33 c9 ff 15 4d 4a 02 00 41 b8 04 01 00 00 48 8d 95 e0 01 00 00 48 8b c8 ff 15 a7 49 02 00 48 89 7c 24 30 48 8d 8d e0 01 00 00 c7 44 24 28 80 00 00 00 45 33 c9 ba 00 00 00 80 c7 44 24 20 03 00 00 00 41 b8 01 00 00 00 ff 15 2f 4b 02 00 48 8b d8 48 83 f8 ff 0f 84 b5 00 00 00 48 89 7c 24 28 45 33 c9 33 d2 89 7c 24 20 41 b8 02 00 00 00 48 8b c8 ff 15 05 49 02 00 48 8b f0 48 85 c0 75 0e 48 8b cb ff 15 94 4a 02 00 e9 82 00 00 00 45 33 c9 4c 89 ac 24 10 07 00 00 45 33 c0 48 89 7c 24 20 ba 04 00 00 00 48 8b ce ff 15 d6 48 02 Data Ascii: DKLH,HH+f+uHuR3MJAHHIH\|$0HD$(E3D$ A/KHHH\|$(E33\|$ AHIHHuHJE3L$E3H\|$ HH
2024-09-12 16:31:27 UTC	1378	IN	Data Raw: a0 37 01 00 85 c0 0f 85 86 02 00 00 48 8d 75 c0 ba 2f 00 00 00 49 03 f4 48 8b ce e8 20 9b 00 00 48 85 c0 ba 2e 00 00 00 48 8d 58 01 48 0f 44 de 48 8b cb e8 08 9b 00 00 48 85 c0 4c 8b f0 48 8d 48 01 b8 00 00 00 00 48 0f 44 c8 8b 85 70 05 00 00 83 f8 01 75 34 48 85 c9 0f 84 97 00 00 00 48 8d 15 52 f8 02 00 e8 f5 37 01 00 85 c0 0f 85 83 00 00 00 ba 2f 00 00 00 48 8b ce e8 44 9a 00 00 2b c6 48 8b d6 44 8b c0 eb 5a 83 f8 02 75 67 48 85 c9 74 62 48 8d 15 21 f8 02 00 e8 c0 37 01 00 85 c0 75 52 ba 2d 00 00 00 48 8b cb e8 13 9a 00 00 48 85 c0 74 40 33 c0 8b d0 49 8d 46 ff 48 3b c3 72 13 90 80 38 2e 74 0a 48 ff c8 48 3b c3 73 f3 eb 03 48 8b d0 49 3b d6 74 1b 48 ff c2 44 2b f2 45 8b c6 48 8b 4c 24 50 e8 f6 fc ff ff 85 c0 0f 84 8b 01 00 00 48 8b cf e8 56 56 00 00 85 Data Ascii: 7Hu/IH H.HXHDHHLHHHDpu4HHR7/HD+HDZugHtbH!7uR-HHt@3IFH;r8.tHH;sHI;tHD+EHL$PHVV
2024-09-12 16:31:27 UTC	1378	IN	Data Raw: 85 db 74 32 48 8b cf 66 66 66 0f 1f 84 00 00 00 00 00 0f b7 44 4b 02 66 3b 44 4a 02 75 18 48 83 c1 02 48 83 f9 11 0f 84 bc 00 00 00 0f b7 04 4b 66 3b 04 4a 74 dc 33 c9 48 89 54 24 28 4c 8d 0d 66 f3 02 00 49 8b d5 4c 89 74 24 20 4d 8b c7 e8 ee f6 ff ff 41 89 04 24 85 c0 74 5a 48 8d 0d 8f ef 02 00 85 ed 74 2b 48 85 db 74 26 66 0f 1f 44 00 00 0f b7 44 7b 02 66 3b 44 79 02 75 14 48 83 c7 02 48 83 ff 11 74 0c 0f b7 04 7b 66 3b 04 79 74 e0 33 f6 48 89 4c 24 28 4c 8d 0d 22 f3 02 00 8b ce 4c 89 74 24 20 4d 8b c7 49 8b d5 e8 90 f6 ff ff 41 89 04 24 48 8b 5c 24 60 48 8b 6c 24 68 48 8b 74 24 70 48 83 c4 30 41 5f 41 5e 41 5d 41 5c 5f c3 8b ce e9 22 fe ff ff 8b ce e9 8a fe ff ff 8b ce e9 e4 fe ff ff 8b ce e9 49 ff ff ff cc cc cc 48 89 74 24 18 57 48 81 ec a0 06 00 00 Data Ascii: t2HfffDKf;DJuHHKf;Jt3HT$(LfILt$ MA$tZHt+Ht&fDD{f;DyuHHt{f;yt3HL$(L"Lt$ MIA$H\$`Hl$hHt$pH0A_A^A]A\_"IHt$WH
2024-09-12 16:31:27 UTC	1378	IN	Data Raw: 01 00 c7 85 1c 01 00 00 01 00 00 00 85 c0 74 06 89 9d 1c 01 00 00 85 f6 75 5f 48 8b 0f 48 8d 15 c4 ee 02 00 e8 b3 29 01 00 85 c0 74 05 45 85 ff 74 47 41 b9 00 01 00 00 66 89 9d 30 01 00 00 4c 8d 85 30 01 00 00 ba 2e 01 00 00 49 8b cc ff 15 6c 3d 02 00 41 b9 24 01 00 00 4c 8d 05 7f e7 02 00 48 8d 95 30 01 00 00 33 c9 ff 15 60 3d 02 00 83 f8 07 0f 84 f7 23 00 00 48 8d 44 24 70 89 9d 00 01 00 00 48 89 44 24 50 48 8d 8d f8 00 00 00 89 5c 24 48 41 b9 20 02 00 00 89 5c 24 40 41 b8 20 00 00 00 89 5c 24 38 b2 02 89 5c 24 30 8b fb 89 5c 24 28 89 5c 24 20 48 89 5c 24 70 89 9d f8 00 00 00 66 c7 85 fc 00 00 00 00 05 ff 15 36 38 02 00 85 c0 74 18 48 8b 54 24 70 4c 8d 85 00 01 00 00 33 c9 ff 15 5e 38 02 00 85 c0 75 08 ff 15 6c 3a 02 00 8b f8 48 8b 4c 24 70 48 85 c9 74 Data Ascii: tu_HH)tEtGAf0L0.Il=A$LH03`=#HD$pHD$PH\$HA \$@A \$8\$0\$(\$ H\$pf68tHT$pL3^8ul:HL$pHt
2024-09-12 16:31:27 UTC	1378	IN	Data Raw: 40 48 89 5d 38 0f 11 45 50 48 89 5d 10 0f 11 45 60 48 89 5d 08 c7 45 30 02 00 00 00 ff 15 d4 37 02 00 85 c0 74 1e 48 8b 4d 68 48 85 c9 74 15 ba ff ff ff ff ff 15 1c 36 02 00 48 8b 4d 68 ff 15 a2 35 02 00 b9 f4 01 00 00 ff 15 b7 35 02 00 4c 8d 0d 08 eb 02 00 45 33 c0 33 d2 33 c9 ff 15 ab 35 02 00 4c 8b e0 48 85 c0 74 19 ff 15 8d 35 02 00 49 8b cc 8b f8 ff 15 6a 35 02 00 81 ff b7 00 00 00 eb 09 ff 15 74 35 02 00 83 f8 05 75 12 41 8b d6 e8 07 d6 ff ff ba 03 00 00 00 e8 fd d5 ff ff ba 04 01 00 00 48 8d 8d 70 11 00 00 ff 15 7b 35 02 00 4c 8d 05 54 dc 02 00 ba 04 01 00 00 48 8d 8d 70 11 00 00 e8 d7 15 01 00 0f 57 c0 48 8d 05 61 e1 02 00 0f 11 45 70 48 8d 4d 70 c7 45 70 70 00 00 00 0f 11 85 80 00 00 00 48 89 85 80 00 00 00 48 8d 85 70 11 00 00 0f 11 85 90 00 00 Data Ascii: @H]8EPH]E`H]E07tHMhHt6HMh55LE3335LHt5Ij5t5uAHp{5LTHpWHaEpHMpEppHHp

Target ID:	0
Start time:	12:31:10
Start date:	12/09/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe"
Imagebase:	0x7ff7f56d0000
File size:	10'525'696 bytes
MD5 hash:	45A5A443C01ABD7618EFEF4827241312
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:31:11
Start date:	12/09/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\taskkill.exe" /f /im explorer.exe
Imagebase:	0x7ff76cb00000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:31:11
Start date:	12/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:31:12
Start date:	12/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
Imagebase:	0x7ff7c9860000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:31:12
Start date:	12/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:31:14
Start date:	12/09/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
Imagebase:	0x7ff7c9860000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:31:14
Start date:	12/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:31:14
Start date:	12/09/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"
Imagebase:	0x7ff796d00000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:31:15
Start date:	12/09/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"
Imagebase:	0x7ff796d00000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:31:16
Start date:	12/09/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\explorer.exe"
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:31:17
Start date:	12/09/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe /NoUACCheck
Imagebase:	0x7ff674740000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Function 00007FF7F56D8E2C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7F56D8E58
GetCurrentThreadId.KERNEL32 ref: 00007FF7F56D8E66
GetCurrentProcessId.KERNEL32 ref: 00007FF7F56D8E72
QueryPerformanceCounter.KERNEL32 ref: 00007FF7F56D8E82

Memory Dump Source

Source File: 00000000.00000002.2165056193.00007FF7F56D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F56D0000, based on PE: true

Associated: 00000000.00000002.2165040970.00007FF7F56D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165080505.00007FF7F56F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165098986.00007FF7F5706000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2165115545.00007FF7F5708000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f56d0000_SecuriteInfo.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d490c774242d86a4b319619409adf73b8d724b4892db60fa64681951350df607
Instruction ID: 1b90974ba470c9610a11e7a2623eceff44e5d25190d1a404476a5dcb1d7db51c
Opcode Fuzzy Hash: d490c774242d86a4b319619409adf73b8d724b4892db60fa64681951350df607
Instruction Fuzzy Hash: 39112E22B14F018AEB00EF60E8552B973A4F719F58F841E31DA7D867A4EF78D1548390

Analysis Process: explorer.exePID: 1828, Parent PID: 2300COMMON

Executed Functions

Function 00007FF8BEE26B70 Relevance: 370.7, APIs: 121, Strings: 90, Instructions: 1468registrywindowCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNEL32 ref: 00007FF8BEE26BE4
RegQueryValueExW.KERNEL32 ref: 00007FF8BEE26C29
RegOpenKeyExW.KERNEL32 ref: 00007FF8BEE26C5C
RegSetValueExW.KERNEL32 ref: 00007FF8BEE26E72
RegQueryValueExW.KERNEL32 ref: 00007FF8BEE26EA5
RegQueryValueExW.KERNEL32 ref: 00007FF8BEE26ED9
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE26F0D
RegQueryValueExW.KERNEL32 ref: 00007FF8BEE26F41
RegQueryValueExW.KERNEL32 ref: 00007FF8BEE26F8B
RegCreateKeyExW.KERNEL32 ref: 00007FF8BEE28282
RegQueryValueExW.KERNEL32 ref: 00007FF8BEE282C7
RegCloseKey.ADVAPI32 ref: 00007FF8BEE282D1
RegCreateKeyExW.KERNEL32 ref: 00007FF8BEE2830B
RegQueryValueExW.KERNEL32 ref: 00007FF8BEE28350
RegQueryValueExW.KERNEL32 ref: 00007FF8BEE28383
RegCloseKey.ADVAPI32 ref: 00007FF8BEE2838D
RegCreateKeyExW.KERNEL32 ref: 00007FF8BEE283C7
RegCloseKey.ADVAPI32 ref: 00007FF8BEE283E3
RegCreateKeyExW.KERNEL32 ref: 00007FF8BEE2841D
RegCloseKey.ADVAPI32 ref: 00007FF8BEE28439
RegCreateKeyExW.KERNEL32 ref: 00007FF8BEE28473
RegCloseKey.ADVAPI32 ref: 00007FF8BEE2848F
RegCreateKeyExW.KERNEL32 ref: 00007FF8BEE284C9
RegCloseKey.ADVAPI32 ref: 00007FF8BEE284E5
RegCreateKeyExW.KERNEL32 ref: 00007FF8BEE2851F
RegCloseKey.ADVAPI32 ref: 00007FF8BEE2853B
RegCreateKeyExW.KERNEL32 ref: 00007FF8BEE28575
RegCloseKey.ADVAPI32 ref: 00007FF8BEE28591
SendNotifyMessageW.USER32 ref: 00007FF8BEE285D0
FindWindowW.USER32 ref: 00007FF8BEE285E5
InvalidateRect.USER32 ref: 00007FF8BEE285F3
InvalidateRect.USER32 ref: 00007FF8BEE2860E
RegGetValueW.ADVAPI32 ref: 00007FF8BEE28666
RegSetKeyValueW.ADVAPI32 ref: 00007FF8BEE286B7
SHFlushSFCache.SHELL32 ref: 00007FF8BEE286BD
SHChangeNotify.SHELL32 ref: 00007FF8BEE286D0

Strings

TaskbarGlomLevel, xrefs: 00007FF8BEE26D77, 00007FF8BEE26DC1, 00007FF8BEE28184
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF8BEE2844D
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage, xrefs: 00007FF8BEE282E5
WeatherTemperatureUnit, xrefs: 00007FF8BEE27B67
HideControlCenterButton, xrefs: 00007FF8BEE273E2
dwmapi.dll, xrefs: 00007FF8BEE27326
OpenPropertiesAtNextStart, xrefs: 00007FF8BEE26C87, 00007FF8BEE26D0A, 00007FF8BEE2780B
PropertiesInWinX, xrefs: 00007FF8BEE275A6
DoNotRedirectSystemToSettingsApp, xrefs: 00007FF8BEE2725C
HideIconAndTitleInExplorer, xrefs: 00007FF8BEE2733F
NoPropertiesInContextMenu, xrefs: 00007FF8BEE275D9
Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher, xrefs: 00007FF8BEE26C4E
SkinMenus, xrefs: 00007FF8BEE271E5
Memcheck, xrefs: 00007FF8BEE26EB8, 00007FF8BEE26EF4
SOFTWARE\Microsoft\TabletTip\1.7, xrefs: 00007FF8BEE2854F
DisableOfficeHotkeys, xrefs: 00007FF8BEE2791F
ReplaceNetwork, xrefs: 00007FF8BEE274AE
UndeadStartCorner, xrefs: 00007FF8BEE27B26
OrbStyle, xrefs: 00007FF8BEE27787
DoNotRedirectProgramsAndFeaturesToSettingsApp, xrefs: 00007FF8BEE2728F
WeatherToLeft, xrefs: 00007FF8BEE28073
IMEStyle, xrefs: 00007FF8BEE2763F
CONOUT$, xrefs: 00007FF8BEE27237
Software\ExplorerPatcher, xrefs: 00007FF8BEE26BA0
WeatherContentsMode, xrefs: 00007FF8BEE280C0
SkinIcons, xrefs: 00007FF8BEE2747B
DisableWinFHotkey, xrefs: 00007FF8BEE27952
AltTabSettings, xrefs: 00007FF8BEE282AE
MMTaskbarGlomLevel, xrefs: 00007FF8BEE26DEC, 00007FF8BEE26E2B, 00007FF8BEE281E2
PinnedItemsActAsQuickLaunch, xrefs: 00007FF8BEE27A8E
ClockFlyoutOnWinC, xrefs: 00007FF8BEE27514
CenterMenus, xrefs: 00007FF8BEE27448
WeatherIconPack, xrefs: 00007FF8BEE2800C
DoNotRedirectNotificationIconsToSettingsApp, xrefs: 00007FF8BEE278EC
HookStartMenu, xrefs: 00007FF8BEE27575
OpenAtLogon, xrefs: 00007FF8BEE28363
WeatherDevMode, xrefs: 00007FF8BEE27FA5
HideExplorerSearchBar, xrefs: 00007FF8BEE26FB4
Software\Classes\CLSID\{2cc5ca98-6485-489a-920e-b3e88a6ccce3}\ShellFolder, xrefs: 00007FF8BEE2864D, 00007FF8BEE28686
SnapAssistSettings, xrefs: 00007FF8BEE27886
WeatherLanguage, xrefs: 00007FF8BEE27D16
LegacyFileTransferDialog, xrefs: 00007FF8BEE2712F
NoMenuAccelerator, xrefs: 00007FF8BEE2760C
DwmExtendFrameIntoClientArea, xrefs: 00007FF8BEE2731F
UpdatePolicy, xrefs: 00007FF8BEE276BB
SpotlightDisableIcon, xrefs: 00007FF8BEE27985
MigratedFromOldSettings, xrefs: 00007FF8BEE26C13, 00007FF8BEE26E56
WeatherViewMode, xrefs: 00007FF8BEE27BEF
WeatherLocationType, xrefs: 00007FF8BEE27EE3
ToolbarSeparators, xrefs: 00007FF8BEE27721
MicaEffectOnTitlebar, xrefs: 00007FF8BEE272C2
Attributes, xrefs: 00007FF8BEE28636, 00007FF8BEE28670
FlyoutMenus, xrefs: 00007FF8BEE27415
UseClassicDriveGrouping, xrefs: 00007FF8BEE2701A
AllocConsole, xrefs: 00007FF8BEE26E85
RemoveExtraGapAroundPinnedItems, xrefs: 00007FF8BEE27ADE
SpotlightDesktopMenuMask, xrefs: 00007FF8BEE279D6
DisableImmersiveContextMenu, xrefs: 00007FF8BEE2717B, 00007FF8BEE27547
WeatherTheme, xrefs: 00007FF8BEE27E7C
ClassicThemeMitigations, xrefs: 00007FF8BEE27195
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\People, xrefs: 00007FF8BEE284F9
WeatherWindowCornerPreference, xrefs: 00007FF8BEE27F44
DisableAeroSnapQuadrants, xrefs: 00007FF8BEE27853
MonitorOverride, xrefs: 00007FF8BEE28337
MMOldTaskbarAl, xrefs: 00007FF8BEE26F6A
EnableSymbolDownload, xrefs: 00007FF8BEE277D8
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF8BEE26D8B, 00007FF8BEE26E02
TraySettings, xrefs: 00007FF8BEE285BC
en-US, xrefs: 00007FF8BEE27DE1
ExplorerPatcher_GUI_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FF8BEE285DE
DoNotRedirectDateAndTimeToSettingsApp, xrefs: 00007FF8BEE278B9
WeatherContentUpdateMode, xrefs: 00007FF8BEE27C3C
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer, xrefs: 00007FF8BEE2825C
OldTaskbarAl, xrefs: 00007FF8BEE26F20
ShrinkExplorerAddressBar, xrefs: 00007FF8BEE26FE7
SpotlightUpdateSchedule, xrefs: 00007FF8BEE27A09
WeatherFixedSize, xrefs: 00007FF8BEE27E2F
ArchiveMenu, xrefs: 00007FF8BEE274E1
FileExplorerCommandUI, xrefs: 00007FF8BEE2704D, 00007FF8BEE270E7
TaskbarAutohideOnDoubleClick, xrefs: 00007FF8BEE27754
OldTaskbar, xrefs: 00007FF8BEE2738A
StartDocked, xrefs: 00007FF8BEE26D54
uxtheme.dll, xrefs: 00007FF8BEE272F4
IsUpdatePending, xrefs: 00007FF8BEE26CBB, 00007FF8BEE26D35, 00007FF8BEE276EE
SOFTWARE\Microsoft\Windows\CurrentVersion\Search, xrefs: 00007FF8BEE284A3
Software\ExplorerPatcher\sws, xrefs: 00007FF8BEE283A1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MultitaskingView\AltTabViewHost, xrefs: 00007FF8BEE283F7
WeatherZoomFactor, xrefs: 00007FF8BEE2810D
SOFTWARE\Classes\CLSID\{d93ed569-3b3e-4bff-8355-3c44f6a52bb5}\InProcServer32, xrefs: 00007FF8BEE270BB
WeatherLocation, xrefs: 00007FF8BEE27C9A

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Value$Create$CloseQuery$InvalidateNotifyRect$CacheChangeFindFlushMessageOpenSendWindow
String ID: AllocConsole$AltTabSettings$ArchiveMenu$Attributes$CONOUT$$CenterMenus$ClassicThemeMitigations$ClockFlyoutOnWinC$DisableAeroSnapQuadrants$DisableImmersiveContextMenu$DisableOfficeHotkeys$DisableWinFHotkey$DoNotRedirectDateAndTimeToSettingsApp$DoNotRedirectNotificationIconsToSettingsApp$DoNotRedirectProgramsAndFeaturesToSettingsApp$DoNotRedirectSystemToSettingsApp$DwmExtendFrameIntoClientArea$EnableSymbolDownload$ExplorerPatcher_GUI_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}$FileExplorerCommandUI$FlyoutMenus$HideControlCenterButton$HideExplorerSearchBar$HideIconAndTitleInExplorer$HookStartMenu$IMEStyle$IsUpdatePending$LegacyFileTransferDialog$MMOldTaskbarAl$MMTaskbarGlomLevel$Memcheck$MicaEffectOnTitlebar$MigratedFromOldSettings$MonitorOverride$NoMenuAccelerator$NoPropertiesInContextMenu$OldTaskbar$OldTaskbarAl$OpenAtLogon$OpenPropertiesAtNextStart$OrbStyle$PinnedItemsActAsQuickLaunch$PropertiesInWinX$RemoveExtraGapAroundPinnedItems$ReplaceNetwork$SOFTWARE\Classes\CLSID\{d93ed569-3b3e-4bff-8355-3c44f6a52bb5}\InProcServer32$SOFTWARE\Microsoft\TabletTip\1.7$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\People$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MultitaskingView\AltTabViewHost$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage$SOFTWARE\Microsoft\Windows\CurrentVersion\Search$ShrinkExplorerAddressBar$SkinIcons$SkinMenus$SnapAssistSettings$Software\Classes\CLSID\{2cc5ca98-6485-489a-920e-b3e88a6ccce3}\ShellFolder$Software\ExplorerPatcher$Software\ExplorerPatcher\sws$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced$Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher$SpotlightDesktopMenuMask$SpotlightDisableIcon$SpotlightUpdateSchedule$StartDocked$TaskbarAutohideOnDoubleClick$TaskbarGlomLevel$ToolbarSeparators$TraySettings$UndeadStartCorner$UpdatePolicy$UseClassicDriveGrouping$WeatherContentUpdateMode$WeatherContentsMode$WeatherDevMode$WeatherFixedSize$WeatherIconPack$WeatherLanguage$WeatherLocation$WeatherLocationType$WeatherTemperatureUnit$WeatherTheme$WeatherToLeft$WeatherViewMode$WeatherWindowCornerPreference$WeatherZoomFactor$dwmapi.dll$en-US$uxtheme.dll
API String ID: 1717770317-297309502
Opcode ID: b0859b562d8a8e0df9ef140f90f2bffe2cf6c8f6902dfc79aa0bfecfd605e6c3
Instruction ID: 59216b94026a2e52ee0e97dee7b14fbc15e7edb627736acf5d60bf99e848e46f
Opcode Fuzzy Hash: b0859b562d8a8e0df9ef140f90f2bffe2cf6c8f6902dfc79aa0bfecfd605e6c3
Instruction Fuzzy Hash: CE030B76A19B528EEB208F68E880AAD37B5FB49398F405135DB4D13B68DFBCD105CB14

Function 00007FF8BEE2DB90 Relevance: 368.9, APIs: 86, Strings: 124, Instructions: 1437libraryloaderthreadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FF8BEE2DBD5

Part of subcall function 00007FF8BEE67EB8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE67EDE

CreateEventW.KERNEL32 ref: 00007FF8BEE2DC36
CreateEventW.KERNEL32 ref: 00007FF8BEE2DC4D
CreateEventW.KERNEL32 ref: 00007FF8BEE2DC9C
CreateThread.KERNEL32 ref: 00007FF8BEE2E057
CloseHandle.KERNEL32 ref: 00007FF8BEE2E06F
SHGetFolderPathW.SHELL32 ref: 00007FF8BEE2E163
PathFileExistsW.SHLWAPI ref: 00007FF8BEE2E188
CreateDirectoryW.KERNEL32 ref: 00007FF8BEE2E19B
CreateMutexExW.KERNEL32 ref: 00007FF8BEE2E28A
CreateEventW.KERNEL32 ref: 00007FF8BEE2E29A
CreateEventW.KERNEL32 ref: 00007FF8BEE2E2B1
CreateThread.KERNEL32 ref: 00007FF8BEE2E2D6
CreateThread.KERNEL32 ref: 00007FF8BEE2E371
LoadLibraryW.KERNEL32 ref: 00007FF8BEE2E37E
GetProcAddress.KERNEL32 ref: 00007FF8BEE2E391
GetProcAddress.KERNEL32 ref: 00007FF8BEE2E3A8
GetProcAddress.KERNEL32 ref: 00007FF8BEE2E3B8
GetProcAddress.KERNEL32 ref: 00007FF8BEE2E3C8
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE2E427
GetCurrentProcess.KERNEL32 ref: 00007FF8BEE2E430
K32GetModuleInformation.KERNEL32 ref: 00007FF8BEE2E447
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE2E4C5
GetProcAddress.KERNEL32 ref: 00007FF8BEE2E4D3
IsOS.SHLWAPI ref: 00007FF8BEE2E613
GetCurrentProcess.KERNEL32 ref: 00007FF8BEE2E715
K32GetModuleInformation.KERNEL32 ref: 00007FF8BEE2E72C
LoadLibraryW.KERNEL32 ref: 00007FF8BEE2E81B
LoadLibraryW.KERNEL32 ref: 00007FF8BEE2EA74
GetProcAddress.KERNEL32 ref: 00007FF8BEE2EA82
FreeLibraryAndExitThread.KERNEL32 ref: 00007FF8BEE2EAD0
FreeLibraryAndExitThread.KERNEL32 ref: 00007FF8BEE2EB0C
LoadLibraryW.KERNEL32 ref: 00007FF8BEE2EB1A
GetProcAddress.KERNEL32 ref: 00007FF8BEE2EB2B
GetProcAddress.KERNEL32 ref: 00007FF8BEE2EB39
GetProcAddress.KERNEL32 ref: 00007FF8BEE2EB47
GetProcAddress.KERNEL32 ref: 00007FF8BEE2EB55
GetProcAddress.KERNEL32 ref: 00007FF8BEE2EB6A
GetProcAddress.KERNEL32 ref: 00007FF8BEE2EB7F
GetProcAddress.KERNEL32 ref: 00007FF8BEE2EB94
GetProcAddress.KERNEL32 ref: 00007FF8BEE2EBA9
GetProcAddress.KERNEL32 ref: 00007FF8BEE2EBB7
GetProcAddress.KERNEL32 ref: 00007FF8BEE2EBC5
LoadLibraryW.KERNEL32 ref: 00007FF8BEE2EC61
LoadLibraryExW.KERNEL32 ref: 00007FF8BEE2ED35
LoadLibraryExW.KERNEL32 ref: 00007FF8BEE2EDBB
LoadLibraryExW.KERNEL32 ref: 00007FF8BEE2EEB3
LoadLibraryExW.KERNEL32 ref: 00007FF8BEE2EEF5
GetProcAddress.KERNEL32 ref: 00007FF8BEE2EF3E
SHELL32_Create_IEnumUICommand.SHELL32 ref: 00007FF8BEE2EF7A
VirtualProtect.KERNEL32 ref: 00007FF8BEE2EFFE
VirtualProtect.KERNEL32 ref: 00007FF8BEE2F03D
GetProcAddress.KERNEL32 ref: 00007FF8BEE2F05C
VirtualProtect.KERNEL32 ref: 00007FF8BEE2F0A7
VirtualProtect.KERNEL32 ref: 00007FF8BEE2F0D9
LoadLibraryW.KERNEL32 ref: 00007FF8BEE2F1D1
GetProcAddress.KERNEL32 ref: 00007FF8BEE2F1E8
LoadLibraryW.KERNEL32 ref: 00007FF8BEE2F255
GetModuleHandleExW.KERNEL32 ref: 00007FF8BEE2F27E
GetCurrentProcess.KERNEL32 ref: 00007FF8BEE2F290
K32GetModuleInformation.KERNEL32 ref: 00007FF8BEE2F2A9
VirtualProtect.KERNEL32 ref: 00007FF8BEE2F2F0
VirtualProtect.KERNEL32 ref: 00007FF8BEE2F314
GetCurrentProcess.KERNEL32 ref: 00007FF8BEE2F358
K32GetModuleInformation.KERNEL32 ref: 00007FF8BEE2F36F
LoadLibraryW.KERNEL32 ref: 00007FF8BEE2F3CA
LoadLibraryW.KERNEL32 ref: 00007FF8BEE2F3DF
GetProcAddress.KERNEL32 ref: 00007FF8BEE2F3F4
LoadLibraryExW.KERNEL32 ref: 00007FF8BEE2F42A
IsOS.SHLWAPI ref: 00007FF8BEE2F43D
FreeLibraryAndExitThread.KERNEL32 ref: 00007FF8BEE2F4A7
CreateThread.KERNEL32 ref: 00007FF8BEE2F506
CreateThread.KERNEL32 ref: 00007FF8BEE2F515
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE2EF20

Part of subcall function 00007FF8BEE12890: GetModuleHandleW.KERNEL32 ref: 00007FF8BEE128AF
Part of subcall function 00007FF8BEE12890: GetProcAddress.KERNEL32 ref: 00007FF8BEE128C8
Part of subcall function 00007FF8BEE12890: RegOpenKeyExW.KERNEL32 ref: 00007FF8BEE1293F
Part of subcall function 00007FF8BEE12890: RegQueryValueExW.KERNEL32 ref: 00007FF8BEE1296F

Part of subcall function 00007FF8BEE1D290: GetModuleHandleExW.KERNEL32 ref: 00007FF8BEE1D2C6
Part of subcall function 00007FF8BEE1D290: ImageDirectoryEntryToDataEx.DBGHELP ref: 00007FF8BEE1D2F9
Part of subcall function 00007FF8BEE1D290: FreeLibrary.KERNEL32 ref: 00007FF8BEE1D32F

Part of subcall function 00007FF8BEE1D290: FreeLibrary.KERNEL32 ref: 00007FF8BEE1D3B9
Part of subcall function 00007FF8BEE1D290: VirtualQuery.KERNEL32 ref: 00007FF8BEE1D3F8
Part of subcall function 00007FF8BEE1D290: VirtualProtect.KERNEL32 ref: 00007FF8BEE1D413
Part of subcall function 00007FF8BEE1D290: VirtualProtect.KERNEL32 ref: 00007FF8BEE1D43B
Part of subcall function 00007FF8BEE1D290: FreeLibrary.KERNEL32 ref: 00007FF8BEE1D446

RegDeleteKeyValueW.ADVAPI32 ref: 00007FF8BEE2F568
RegDeleteKeyValueW.ADVAPI32 ref: 00007FF8BEE2F583
CreateThread.KERNEL32 ref: 00007FF8BEE2F5A1
CreateThread.KERNEL32 ref: 00007FF8BEE2F5CB
CreateThread.KERNEL32 ref: 00007FF8BEE2F651
CreateThread.KERNEL32 ref: 00007FF8BEE2F672
GetWindowsDirectoryW.KERNEL32 ref: 00007FF8BEE2F684
FindFirstFileW.KERNEL32 ref: 00007FF8BEE2F6B5
FindClose.KERNEL32 ref: 00007FF8BEE2F6C4
LoadLibraryW.KERNEL32 ref: 00007FF8BEE2F6D1
GetProcAddress.KERNEL32 ref: 00007FF8BEE2F6F8
GetLastError.KERNEL32 ref: 00007FF8BEE2F722

Strings

TrackPopupMenuEx, xrefs: 00007FF8BEE2E6F8, 00007FF8BEE2EC44, 00007FF8BEE2EE49, 00007FF8BEE2EE6D, 00007FF8BEE2EEC0, 00007FF8BEE2F33B
Setup user32 functions done, xrefs: 00007FF8BEE2E419
TaskbarGlomLevel, xrefs: 00007FF8BEE2F553
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF8BEE2DE3D, 00007FF8BEE2DFC2
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage, xrefs: 00007FF8BEE2DD3E
twinui.dll, xrefs: 00007FF8BEE2ED2E
API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL, xrefs: 00007FF8BEE2E56E, 00007FF8BEE2E58B, 00007FF8BEE2E5A8, 00007FF8BEE2E6C6, 00007FF8BEE2F11A, 00007FF8BEE2F13B
CreateWindowExW, xrefs: 00007FF8BEE2E668
GetSystemMetrics, xrefs: 00007FF8BEE2E7F9, 00007FF8BEE2F1A4
SetRect, xrefs: 00007FF8BEE2E8EC
dwmapi.dll, xrefs: 00007FF8BEE2E939
user32.dll, xrefs: 00007FF8BEE2E377, 00007FF8BEE2E4BE
win32u.dll, xrefs: 00007FF8BEE2E40A
QISearch, xrefs: 00007FF8BEE2E5F8
CascadeWindows, xrefs: 00007FF8BEE2E6A2
RegSetValueExW, xrefs: 00007FF8BEE2E584, 00007FF8BEE2F134
InputSwitch.dll, xrefs: 00007FF8BEE2F24E, 00007FF8BEE2F275
[Extra] Found library: %p., xrefs: 00007FF8BEE2F6E2
Installed hooks., xrefs: 00007FF8BEE2F4AE
Setup twinui functions done, xrefs: 00007FF8BEE2EDA8
EP Service Window thread, xrefs: 00007FF8BEE2F5D8
SOFTWARE\Microsoft\TabletTip\1.7, xrefs: 00007FF8BEE2DF19
windowsudk.shellcommon.dll, xrefs: 00007FF8BEE2F3C3
SetWindowBand, xrefs: 00007FF8BEE2E3AE
ep_extra_EntryPoint, xrefs: 00007FF8BEE2F6EE
DeleteMenu, xrefs: 00007FF8BEE2E909, 00007FF8BEE2F155
combase.dll, xrefs: 00007FF8BEE2EC5A
user32.dll, xrefs: 00007FF8BEE2E4FA, 00007FF8BEE2E5E2, 00007FF8BEE2E68C, 00007FF8BEE2E6A9, 00007FF8BEE2E6FF, 00007FF8BEE2E8AC, 00007FF8BEE2E95F, 00007FF8BEE2EC2E, 00007FF8BEE2EC4B, 00007FF8BEE2ED73, 00007FF8BEE2ED99, 00007FF8BEE2EE27, 00007FF8BEE2EE50, 00007FF8BEE2EE74, 00007FF8BEE2EEC7, 00007FF8BEE2F15C, 00007FF8BEE2F1AB, 00007FF8BEE2F342, 00007FF8BEE2F5F2
StartTileData.dll, xrefs: 00007FF8BEE2E814
MMTaskbarGlomLevel, xrefs: 00007FF8BEE2F56E
DllGetClassObject, xrefs: 00007FF8BEE2F04E
DrawThemeTextEx, xrefs: 00007FF8BEE2E84E
SendMessageW, xrefs: 00007FF8BEE2E510
ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll, xrefs: 00007FF8BEE2E517, 00007FF8BEE2E66F, 00007FF8BEE2F744
\ExplorerPatcher, xrefs: 00007FF8BEE2E169
SHCORE.dll, xrefs: 00007FF8BEE2F782
API-MS-WIN-NTUSER-RECTANGLE-L1-1-0.DLL, xrefs: 00007FF8BEE2E8F3
windows.storage.dll, xrefs: 00007FF8BEE2F1CA
LoadLibraryExW, xrefs: 00007FF8BEE2ECBF, 00007FF8BEE2ED0C
api-ms-win-core-largeinteger-l1-1-0.dll, xrefs: 00007FF8BEE2F471
Running on Windows %d, OS Build %d.%d.%d.%d., xrefs: 00007FF8BEE2E13E
SetWindowCompositionAttribute, xrefs: 00007FF8BEE2E3BE, 00007FF8BEE2E8A5, 00007FF8BEE2E958
xx??x??xxx????xx, xrefs: 00007FF8BEE2F2B7
IsOS, xrefs: 00007FF8BEE2E624
bthprops.cpl, xrefs: 00007FF8BEE2EEAC
api-ms-win-core-shlwapi-obsolete-l1-1-0.dll, xrefs: 00007FF8BEE2E5FF
shcore.dll, xrefs: 00007FF8BEE2EA6D
SHLWAPI.dll, xrefs: 00007FF8BEE2F454
Global\EP_Weather_Killswitch_{A6EA9C2D-4982-4827-9204-0AC532959F6D}, xrefs: 00007FF8BEE2E244
GetThemeMargins, xrefs: 00007FF8BEE2E86B
LoadMenuW, xrefs: 00007FF8BEE2E5DB, 00007FF8BEE2EC27
DrawThemeBackground, xrefs: 00007FF8BEE2E798
ext-ms-win-shell-exports-internal-l1-1-0.dll, xrefs: 00007FF8BEE2F208
api-ms-win-ntuser-sysparams-l1-1-0.dll, xrefs: 00007FF8BEE2E800
CloseThemeData, xrefs: 00007FF8BEE2E7B5
Attempting to download symbol data; for now, the program may have limited functionality., xrefs: 00007FF8BEE2E332
API-MS-WIN-SHCORE-REGISTRY-L1-1-0.DLL, xrefs: 00007FF8BEE2E5C5
Setup bthprops functions done, xrefs: 00007FF8BEE2EED6
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer, xrefs: 00007FF8BEE2DF6F, 00007FF8BEE2E006
\ep_extra.dll, xrefs: 00007FF8BEE2F692
Open Start on monitor thread, xrefs: 00007FF8BEE2F5A7
Loaded symbols, xrefs: 00007FF8BEE2E31B
RegCreateKeyExW, xrefs: 00007FF8BEE2E5A1, 00007FF8BEE2F113
api-ms-win-core-com-l1-1-0.dll, xrefs: 00007FF8BEE2E8D6, 00007FF8BEE2EDEF
CreateWindowInBand, xrefs: 00007FF8BEE2E387
[IME] Context menu patch status: %d, xrefs: 00007FF8BEE2F31F
Setup uxtheme functions done, xrefs: 00007FF8BEE2EBF7
ITrayUIHost = %llX, xrefs: 00007FF8BEE2EA04
SOFTWARE\Microsoft\Windows\CurrentVersion\Search, xrefs: 00007FF8BEE2DE89
Setup explorer functions done, xrefs: 00007FF8BEE2EA8F
Setup inputswitch functions done, xrefs: 00007FF8BEE2F3B7
SHGetValueW, xrefs: 00007FF8BEE2E5BE
[TB] Unsupported build, xrefs: 00007FF8BEE2E492
PeopleBand.dll, xrefs: 00007FF8BEE2F423
TrackPopupMenu, xrefs: 00007FF8BEE2ED6C, 00007FF8BEE2EE20
Setup windows.storage functions done, xrefs: 00007FF8BEE2F217
TileWindows, xrefs: 00007FF8BEE2E685
ext-ms-win-security-slc-l1-1-0.dll, xrefs: 00007FF8BEE2F414
SHELL32_CanDisplayWin8CopyDialog, xrefs: 00007FF8BEE2F1DA, 00007FF8BEE2F201
RoGetActivationFactory, xrefs: 00007FF8BEE2E828
GetClientRect, xrefs: 00007FF8BEE2F73D, 00007FF8BEE2F75F
shell32.dll, xrefs: 00007FF8BEE2E534, 00007FF8BEE2E551, 00007FF8BEE2E6E2
api-ms-win-shcore-sysinfo-l1-1-0.dll, xrefs: 00007FF8BEE2E62B
shell32.dll, xrefs: 00007FF8BEE2EF19
GetThemeMetric, xrefs: 00007FF8BEE2E888
Setup shell32 functions done, xrefs: 00007FF8BEE2F1BE
Failed to install hooks. rv = %d, xrefs: 00007FF8BEE2E0A9
Software\ExplorerPatcher, xrefs: 00007FF8BEE2DCF6
ShellExecuteExW, xrefs: 00007FF8BEE2E54A
MulDiv, xrefs: 00007FF8BEE2F46A
api-ms-win-core-winrt-l1-1-0.dll, xrefs: 00007FF8BEE2E82F
RegGetValueW, xrefs: 00007FF8BEE2E567, 00007FF8BEE2EDCB
xxx????xxx????x????xx, xrefs: 00007FF8BEE2E98D
explorer.exe!TrayUI_CreateInstance() = %llX, xrefs: 00007FF8BEE2EA1F
api-ms-win-core-libraryloader-l1-2-0.dll, xrefs: 00007FF8BEE2ECC6, 00007FF8BEE2ED13
xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xxx????xxx, xrefs: 00007FF8BEE2E73A, 00007FF8BEE2F37D
stobject.dll, xrefs: 00007FF8BEE2EDB4
[Extra] Finished running entry point., xrefs: 00007FF8BEE2F714
pnidui.dll, xrefs: 00007FF8BEE2EEEE
[Extra] Running entry point..., xrefs: 00007FF8BEE2F706
Setup stobject functions done, xrefs: 00007FF8BEE2EEA0
USER32.dll, xrefs: 00007FF8BEE2F766
[Extra] LoadLibraryW failed with 0x%x., xrefs: 00007FF8BEE2F72A
OpenThemeDataForDpi, xrefs: 00007FF8BEE2E77B
RegisterHotKey, xrefs: 00007FF8BEE2ED92, 00007FF8BEE2F5EB
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\People, xrefs: 00007FF8BEE2DED1
api-ms-win-core-registry-l1-1-0.dll, xrefs: 00007FF8BEE2EDD2
Initialized taskbar centering module., xrefs: 00007FF8BEE2F791
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF8BEE2F55A, 00007FF8BEE2F575
USER32.DLL, xrefs: 00007FF8BEE2E910
SLGetWindowsInformationDWORD, xrefs: 00007FF8BEE2F3EA, 00007FF8BEE2F40D
slc.dll, xrefs: 00007FF8BEE2F3D8
CoCreateInstance, xrefs: 00007FF8BEE2E8CF, 00007FF8BEE2EDE8
DwmUpdateThumbnailProperties, xrefs: 00007FF8BEE2E932
Setup peopleband functions done, xrefs: 00007FF8BEE2F480
GetWindowBand, xrefs: 00007FF8BEE2E39E
uxtheme.dll, xrefs: 00007FF8BEE2EB13
Setup combase functions done, xrefs: 00007FF8BEE2ED22
ShellExecuteW, xrefs: 00007FF8BEE2E52D
NtUserFindWindowEx, xrefs: 00007FF8BEE2E403
Software\ExplorerPatcher\sws, xrefs: 00007FF8BEE2DD94
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MultitaskingView\AltTabViewHost, xrefs: 00007FF8BEE2DDEA
uxtheme.dll, xrefs: 00007FF8BEE2E782, 00007FF8BEE2E79F, 00007FF8BEE2E7BC, 00007FF8BEE2E855, 00007FF8BEE2E872, 00007FF8BEE2E88F, 00007FF8BEE2EBE8
RegOpenKeyExW, xrefs: 00007FF8BEE2E6BF

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: AddressProc$Library$Create$Load$Thread$Module$Virtual$Protect$Handle$Free$Event$CurrentInformationProcess$DirectoryExitValue$CloseDeleteFileFindPathQuery$CommandCreate_CriticalDataEntryEnumErrorExistsFirstFolderImageInitializeL32_LastMutexOpenSectionWindows_invalid_parameter_noinfo
String ID: API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL$API-MS-WIN-NTUSER-RECTANGLE-L1-1-0.DLL$API-MS-WIN-SHCORE-REGISTRY-L1-1-0.DLL$Attempting to download symbol data; for now, the program may have limited functionality.$CascadeWindows$CloseThemeData$CoCreateInstance$CreateWindowExW$CreateWindowInBand$DeleteMenu$DllGetClassObject$DrawThemeBackground$DrawThemeTextEx$DwmUpdateThumbnailProperties$EP Service Window thread$Failed to install hooks. rv = %d$GetClientRect$GetSystemMetrics$GetThemeMargins$GetThemeMetric$GetWindowBand$Global\EP_Weather_Killswitch_{A6EA9C2D-4982-4827-9204-0AC532959F6D}$ITrayUIHost = %llX$Initialized taskbar centering module.$InputSwitch.dll$Installed hooks.$IsOS$LoadLibraryExW$LoadMenuW$Loaded symbols$MMTaskbarGlomLevel$MulDiv$NtUserFindWindowEx$Open Start on monitor thread$OpenThemeDataForDpi$PeopleBand.dll$QISearch$RegCreateKeyExW$RegGetValueW$RegOpenKeyExW$RegSetValueExW$RegisterHotKey$RoGetActivationFactory$Running on Windows %d, OS Build %d.%d.%d.%d.$SHCORE.dll$SHELL32_CanDisplayWin8CopyDialog$SHGetValueW$SHLWAPI.dll$SLGetWindowsInformationDWORD$SOFTWARE\Microsoft\TabletTip\1.7$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\People$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MultitaskingView\AltTabViewHost$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage$SOFTWARE\Microsoft\Windows\CurrentVersion\Search$SendMessageW$SetRect$SetWindowBand$SetWindowCompositionAttribute$Setup bthprops functions done$Setup combase functions done$Setup explorer functions done$Setup inputswitch functions done$Setup peopleband functions done$Setup shell32 functions done$Setup stobject functions done$Setup twinui functions done$Setup user32 functions done$Setup uxtheme functions done$Setup windows.storage functions done$ShellExecuteExW$ShellExecuteW$Software\ExplorerPatcher$Software\ExplorerPatcher\sws$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced$StartTileData.dll$TaskbarGlomLevel$TileWindows$TrackPopupMenu$TrackPopupMenuEx$USER32.DLL$USER32.dll$[Extra] Finished running entry point.$[Extra] Found library: %p.$[Extra] LoadLibraryW failed with 0x%x.$[Extra] Running entry point...$[IME] Context menu patch status: %d$[TB] Unsupported build$\ExplorerPatcher$\ep_extra.dll$api-ms-win-core-com-l1-1-0.dll$api-ms-win-core-largeinteger-l1-1-0.dll$api-ms-win-core-libraryloader-l1-2-0.dll$api-ms-win-core-registry-l1-1-0.dll$api-ms-win-core-shlwapi-obsolete-l1-1-0.dll$api-ms-win-core-winrt-l1-1-0.dll$api-ms-win-ntuser-sysparams-l1-1-0.dll$api-ms-win-shcore-sysinfo-l1-1-0.dll$bthprops.cpl$combase.dll$dwmapi.dll$ep_extra_EntryPoint$explorer.exe!TrayUI_CreateInstance() = %llX$ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll$ext-ms-win-security-slc-l1-1-0.dll$ext-ms-win-shell-exports-internal-l1-1-0.dll$pnidui.dll$shcore.dll$shell32.dll$shell32.dll$slc.dll$stobject.dll$twinui.dll$user32.dll$user32.dll$uxtheme.dll$uxtheme.dll$win32u.dll$windows.storage.dll$windowsudk.shellcommon.dll$xx??x??xxx????xx$xxx????xxx????x????xx$xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xxx????xxx
API String ID: 4277971903-1527841907
Opcode ID: 561687ea2e422f9f9f42a53dd6bffec6658d988fac81d2d924c6c3c80d658436
Instruction ID: 9390b77d3532311801147a333f1227fa7b67d0c27b29474d6bb808bc3a73890d
Opcode Fuzzy Hash: 561687ea2e422f9f9f42a53dd6bffec6658d988fac81d2d924c6c3c80d658436
Instruction Fuzzy Hash: E7032371A09A4799EB50DFA8E8902F923A1FF857C4F804136DB0E066A5DFBDE589C341

Function 00007FF8BEE45CF0 Relevance: 159.8, APIs: 52, Strings: 39, Instructions: 591
registryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8BEE12890: GetModuleHandleW.KERNEL32 ref: 00007FF8BEE128AF
Part of subcall function 00007FF8BEE12890: GetProcAddress.KERNEL32 ref: 00007FF8BEE128C8
Part of subcall function 00007FF8BEE12890: RegOpenKeyExW.KERNEL32 ref: 00007FF8BEE1293F
Part of subcall function 00007FF8BEE12890: RegQueryValueExW.KERNEL32 ref: 00007FF8BEE1296F

RegCreateKeyExW.ADVAPI32 ref: 00007FF8BEE45DD0
GetWindowsDirectoryW.KERNEL32 ref: 00007FF8BEE45DF4
RegQueryValueExA.ADVAPI32 ref: 00007FF8BEE45E5D
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE45EB9
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE45F03
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE45F2E
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE45F59
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE45F84
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE45FAF
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE45FDA
RegCloseKey.ADVAPI32 ref: 00007FF8BEE46009
RegDeleteTreeW.ADVAPI32 ref: 00007FF8BEE46021
RegCreateKeyExW.KERNEL32 ref: 00007FF8BEE46061
GetSystemDirectoryW.KERNEL32 ref: 00007FF8BEE46085
RegQueryValueExA.KERNEL32 ref: 00007FF8BEE460F5
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE46151
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE4619F
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE461CA
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE461F5
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE46220
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE4624B
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE46276
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE462A1
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE462CC
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE462F7
RegCloseKey.ADVAPI32 ref: 00007FF8BEE46302
RegCreateKeyExW.ADVAPI32 ref: 00007FF8BEE463B7
GetWindowsDirectoryW.KERNEL32 ref: 00007FF8BEE463C9
RegQueryValueExA.ADVAPI32 ref: 00007FF8BEE46439
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE46495
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE464E3
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE4650E
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE46539
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE46564
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE4658F
RegCloseKey.ADVAPI32 ref: 00007FF8BEE465BD
RegDeleteTreeW.ADVAPI32 ref: 00007FF8BEE465DE
RegCreateKeyExW.KERNEL32 ref: 00007FF8BEE4662F
GetWindowsDirectoryW.KERNEL32 ref: 00007FF8BEE46641
FindFirstFileW.KERNEL32 ref: 00007FF8BEE4666D
FindClose.KERNEL32 ref: 00007FF8BEE4667C
GetWindowsDirectoryW.KERNEL32 ref: 00007FF8BEE46690

Part of subcall function 00007FF8BEE67E1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE67E45

RegQueryValueExA.KERNEL32 ref: 00007FF8BEE46700
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE4675C
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE467A2
RegCloseKey.ADVAPI32 ref: 00007FF8BEE467CF
RegDeleteTreeW.KERNEL32 ref: 00007FF8BEE467E7
RegCreateKeyExW.KERNEL32 ref: 00007FF8BEE46827
RegDeleteValueW.KERNEL32 ref: 00007FF8BEE46843
RegCloseKey.ADVAPI32 ref: 00007FF8BEE4684E

Strings

CLauncherTipContextMenu::ShowLauncherTipContextMenu, xrefs: 00007FF8BEE46292
StartDocked::SystemListPolicyProvider::GetMaximumFrequentApps, xrefs: 00007FF8BEE46555
CLauncherTipContextMenu::GetMenuItemsAsync, xrefs: 00007FF8BEE461BB
\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI.dll, xrefs: 00007FF8BEE46647
CImmersiveContextMenuOwnerDrawHelper::s_ContextMenuWndProc, xrefs: 00007FF8BEE4618D
CTaskBand_CreateInstance, xrefs: 00007FF8BEE45F4A
\explorer.exe, xrefs: 00007FF8BEE45DFA
StartUI, xrefs: 00007FF8BEE467AF
StartDocked::LauncherFrame::ShowAllApps, xrefs: 00007FF8BEE464D1, 00007FF8BEE464FF
HandleFirstTimeLegacy, xrefs: 00007FF8BEE45F75
ImmersiveContextMenuHelper::RemoveOwnerDrawFromMenu, xrefs: 00007FF8BEE46211
Version, xrefs: 00007FF8BEE45E95, 00007FF8BEE4612D, 00007FF8BEE46471, 00007FF8BEE46738
\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll, xrefs: 00007FF8BEE46696
\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartDocked.dll, xrefs: 00007FF8BEE463CF
Hash, xrefs: 00007FF8BEE45E3C, 00007FF8BEE460D4, 00007FF8BEE46411, 00007FF8BEE466D8
ImmersiveContextMenuHelper::ApplyOwnerDrawToMenu, xrefs: 00007FF8BEE461E6
OSBuild, xrefs: 00007FF8BEE4683C
Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher\StartUI, xrefs: 00007FF8BEE465FF, 00007FF8BEE467D9
StartDocked::StartSizingFrame::StartSizingFrame, xrefs: 00007FF8BEE46580
CLauncherTipContextMenu::_ExecuteCommand, xrefs: 00007FF8BEE46267
Software\ExplorerPatcher, xrefs: 00007FF8BEE467FA
SetColorPreferenceForLogonUI, xrefs: 00007FF8BEE45FA0
twinui.pcshell, xrefs: 00007FF8BEE46312
Software\ExplorerPatcher\twinui.pcshell, xrefs: 00007FF8BEE46034, 00007FF8BEE46333
StartUI::SystemListPolicyProvider::GetMaximumFrequentApps, xrefs: 00007FF8BEE46790
!, xrefs: 00007FF8BEE466F8
TrayUI::_UpdatePearlSize, xrefs: 00007FF8BEE45FCB
CMultitaskingViewManager::_CreateDCompMTVHost, xrefs: 00007FF8BEE462E8
CMultitaskingViewManager::_CreateXamlMTVHost, xrefs: 00007FF8BEE462BD
Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher\StartDocked, xrefs: 00007FF8BEE46384, 00007FF8BEE465D0
ImmersiveTray::RaiseWindow, xrefs: 00007FF8BEE45F1F
StartDocked::LauncherFrame::OnVisibilityChanged, xrefs: 00007FF8BEE4652A
\twinui.pcshell.dll, xrefs: 00007FF8BEE4608B
StartDocked, xrefs: 00007FF8BEE4659D
CLauncherTipContextMenu::_ExecuteShutdownCommand, xrefs: 00007FF8BEE4623C
ImmersiveTray::AttachWindowToTray, xrefs: 00007FF8BEE45EE9
Software\ExplorerPatcher\explorer, xrefs: 00007FF8BEE45DA0, 00007FF8BEE46013
[Symbols] Symbols for "%s" are not available., xrefs: 00007FF8BEE45FEE, 00007FF8BEE46319, 00007FF8BEE465A4, 00007FF8BEE467B6
explorer, xrefs: 00007FF8BEE45FE7

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Value$Query$Close$CreateDirectory$DeleteWindows$Tree$Find$AddressFileFirstHandleModuleOpenProcSystem_invalid_parameter_noinfo
String ID: !$CImmersiveContextMenuOwnerDrawHelper::s_ContextMenuWndProc$CLauncherTipContextMenu::GetMenuItemsAsync$CLauncherTipContextMenu::ShowLauncherTipContextMenu$CLauncherTipContextMenu::_ExecuteCommand$CLauncherTipContextMenu::_ExecuteShutdownCommand$CMultitaskingViewManager::_CreateDCompMTVHost$CMultitaskingViewManager::_CreateXamlMTVHost$CTaskBand_CreateInstance$HandleFirstTimeLegacy$Hash$ImmersiveContextMenuHelper::ApplyOwnerDrawToMenu$ImmersiveContextMenuHelper::RemoveOwnerDrawFromMenu$ImmersiveTray::AttachWindowToTray$ImmersiveTray::RaiseWindow$OSBuild$SetColorPreferenceForLogonUI$Software\ExplorerPatcher$Software\ExplorerPatcher\explorer$Software\ExplorerPatcher\twinui.pcshell$Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher\StartDocked$Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher\StartUI$StartDocked$StartDocked::LauncherFrame::OnVisibilityChanged$StartDocked::LauncherFrame::ShowAllApps$StartDocked::StartSizingFrame::StartSizingFrame$StartDocked::SystemListPolicyProvider::GetMaximumFrequentApps$StartUI$StartUI::SystemListPolicyProvider::GetMaximumFrequentApps$TrayUI::_UpdatePearlSize$Version$[Symbols] Symbols for "%s" are not available.$\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartDocked.dll$\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI.dll$\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll$\explorer.exe$\twinui.pcshell.dll$explorer$twinui.pcshell
API String ID: 3716114926-1751072635
Opcode ID: 7956ac15a74029a0eaab39bcb175e0c9f08ee52c61f66d83115e7b2160469f4a
Instruction ID: 47c587ed0cd8f1a17d8e4e6f71ec36a469e976fd58e91563b6e8cda83eedfa04
Opcode Fuzzy Hash: 7956ac15a74029a0eaab39bcb175e0c9f08ee52c61f66d83115e7b2160469f4a
Instruction Fuzzy Hash: C3622272608A839AEB20CB58F4946AA77A5FB847D8F401136D78D47E68DFBCD159CB00

Function 00007FF8BEE31870 Relevance: 152.7, APIs: 49, Strings: 38, Instructions: 444
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8BEE12890: GetModuleHandleW.KERNEL32 ref: 00007FF8BEE128AF
Part of subcall function 00007FF8BEE12890: GetProcAddress.KERNEL32 ref: 00007FF8BEE128C8
Part of subcall function 00007FF8BEE12890: RegOpenKeyExW.KERNEL32 ref: 00007FF8BEE1293F
Part of subcall function 00007FF8BEE12890: RegQueryValueExW.KERNEL32 ref: 00007FF8BEE1296F

GetModuleFileNameW.KERNEL32 ref: 00007FF8BEE318DD
PathStripPathW.SHLWAPI ref: 00007FF8BEE318EA

Part of subcall function 00007FF8BEE68004: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE68021

GetCurrentProcessId.KERNEL32 ref: 00007FF8BEE3190F
OpenProcess.KERNEL32 ref: 00007FF8BEE3191F
QueryFullProcessImageNameW.KERNEL32 ref: 00007FF8BEE31948
CloseHandle.KERNEL32 ref: 00007FF8BEE31951
GetSystemDirectoryW.KERNEL32 ref: 00007FF8BEE31963
GetWindowsDirectoryW.KERNEL32 ref: 00007FF8BEE319A6
GetWindowsDirectoryW.KERNEL32 ref: 00007FF8BEE319EF
GetWindowsDirectoryW.KERNEL32 ref: 00007FF8BEE31A2D
GetSystemDirectoryW.KERNEL32 ref: 00007FF8BEE31A85
LoadLibraryExW.KERNEL32 ref: 00007FF8BEE31AAA
GetProcAddress.KERNEL32 ref: 00007FF8BEE31ABD
GetProcAddress.KERNEL32 ref: 00007FF8BEE31AD4
GetProcAddress.KERNEL32 ref: 00007FF8BEE31AEB
GetProcAddress.KERNEL32 ref: 00007FF8BEE31B02
GetProcAddress.KERNEL32 ref: 00007FF8BEE31B19
GetProcAddress.KERNEL32 ref: 00007FF8BEE31B30
GetProcAddress.KERNEL32 ref: 00007FF8BEE31B47
GetProcAddress.KERNEL32 ref: 00007FF8BEE31B5E
GetProcAddress.KERNEL32 ref: 00007FF8BEE31B75
GetProcAddress.KERNEL32 ref: 00007FF8BEE31B8C
GetProcAddress.KERNEL32 ref: 00007FF8BEE31BA3
GetProcAddress.KERNEL32 ref: 00007FF8BEE31BBA
GetProcAddress.KERNEL32 ref: 00007FF8BEE31BD1
GetProcAddress.KERNEL32 ref: 00007FF8BEE31BE8
GetProcAddress.KERNEL32 ref: 00007FF8BEE31BFF
GetProcAddress.KERNEL32 ref: 00007FF8BEE31C16
GetProcAddress.KERNEL32 ref: 00007FF8BEE31C2D
GetProcAddress.KERNEL32 ref: 00007FF8BEE31C44
GetProcAddress.KERNEL32 ref: 00007FF8BEE31C5B
GetSystemMetrics.USER32 ref: 00007FF8BEE31C7D
RegGetValueW.KERNEL32 ref: 00007FF8BEE31CD0
RegGetValueW.KERNEL32 ref: 00007FF8BEE31D84
FindWindowExW.USER32 ref: 00007FF8BEE31DD1
FindWindowExW.USER32 ref: 00007FF8BEE31DEE
GetAsyncKeyState.USER32 ref: 00007FF8BEE31E16
GetAsyncKeyState.USER32 ref: 00007FF8BEE31E26
GetAsyncKeyState.USER32 ref: 00007FF8BEE31E36
RegSetKeyValueW.KERNELBASE ref: 00007FF8BEE31E89
SHCreateThread.SHLWAPI ref: 00007FF8BEE31EA1
RegSetKeyValueW.ADVAPI32 ref: 00007FF8BEE31EDC
SHCreateThread.SHLWAPI ref: 00007FF8BEE31EF1
LoadLibraryW.KERNEL32 ref: 00007FF8BEE31F3B
RegOpenKeyW.ADVAPI32 ref: 00007FF8BEE31FDE
RegCloseKey.ADVAPI32 ref: 00007FF8BEE31FED
LoadLibraryW.KERNEL32 ref: 00007FF8BEE31FFA
LoadLibraryW.KERNEL32 ref: 00007FF8BEE3205C
GetModuleHandleExW.KERNEL32 ref: 00007FF8BEE32089

Strings

\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe, xrefs: 00007FF8BEE319F5
Progman, xrefs: 00007FF8BEE31DC6
\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe, xrefs: 00007FF8BEE31A33
DXGIDumpJournal, xrefs: 00007FF8BEE31BA9
PIXBeginCapture, xrefs: 00007FF8BEE31BEE
\explorer.exe, xrefs: 00007FF8BEE319AC
UpdateHMDEmulationStatus, xrefs: 00007FF8BEE31C4A
CreateDXGIFactory2, xrefs: 00007FF8BEE31B1F
DXGIGetDebugInterface1, xrefs: 00007FF8BEE31BC0
DXGIDeclareAdapterRemovalSupport, xrefs: 00007FF8BEE31B92
DXGID3D10CreateDevice, xrefs: 00007FF8BEE31B36
DXGID3D10RegisterLayers, xrefs: 00007FF8BEE31B7B
CreateDXGIFactory1, xrefs: 00007FF8BEE31B08
SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE, xrefs: 00007FF8BEE31CB2
DXGID3D10GetLayeredDeviceSize, xrefs: 00007FF8BEE31B64
CompatString, xrefs: 00007FF8BEE31AC3
Proxy Desktop, xrefs: 00007FF8BEE31DE3
LaunchUserOOBE, xrefs: 00007FF8BEE31C99
CreateDXGIFactory, xrefs: 00007FF8BEE31AF1
PIXEndCapture, xrefs: 00007FF8BEE31C05
LaunchCflScenario, xrefs: 00007FF8BEE31D4D
Software\ExplorerPatcher, xrefs: 00007FF8BEE31E76, 00007FF8BEE31ECE
PIXGetCaptureState, xrefs: 00007FF8BEE31C1C
Windows.UI.Xaml.dll, xrefs: 00007FF8BEE31F34, 00007FF8BEE32055
GetProductInfo, xrefs: 00007FF8BEE3200F
Control Panel\Quick Actions\Control Center\QuickActionsStateCapture\ExplorerPatcher, xrefs: 00007FF8BEE31FD7
CrashCounter, xrefs: 00007FF8BEE31E64, 00007FF8BEE31EC3
ApplyCompatResolutionQuirking, xrefs: 00007FF8BEE31AB3
\dxgi.dll, xrefs: 00007FF8BEE31A8B
SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData, xrefs: 00007FF8BEE31D66
Windows.UI.QuickActions.dll, xrefs: 00007FF8BEE31FF3
\SearchIndexer.exe, xrefs: 00007FF8BEE31969
CompatValue, xrefs: 00007FF8BEE31ADA
SetAppCompatStringPointer, xrefs: 00007FF8BEE31C33
api-ms-win-core-sysinfo-l1-2-0.dll, xrefs: 00007FF8BEE32016
DXGIReportAdapterConfiguration, xrefs: 00007FF8BEE31BD7
DXGID3D10CreateLayeredDevice, xrefs: 00007FF8BEE31B4D
dxgi.dll, xrefs: 00007FF8BEE318F0

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: AddressProc$DirectoryValue$LibraryLoad$AsyncHandleModuleOpenProcessStateSystemWindows$CloseCreateFindNamePathQueryThreadWindow$CurrentFileFullImageMetricsStrip_invalid_parameter_noinfo
String ID: ApplyCompatResolutionQuirking$CompatString$CompatValue$Control Panel\Quick Actions\Control Center\QuickActionsStateCapture\ExplorerPatcher$CrashCounter$CreateDXGIFactory$CreateDXGIFactory1$CreateDXGIFactory2$DXGID3D10CreateDevice$DXGID3D10CreateLayeredDevice$DXGID3D10GetLayeredDeviceSize$DXGID3D10RegisterLayers$DXGIDeclareAdapterRemovalSupport$DXGIDumpJournal$DXGIGetDebugInterface1$DXGIReportAdapterConfiguration$GetProductInfo$LaunchCflScenario$LaunchUserOOBE$PIXBeginCapture$PIXEndCapture$PIXGetCaptureState$Progman$Proxy Desktop$SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData$SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE$SetAppCompatStringPointer$Software\ExplorerPatcher$UpdateHMDEmulationStatus$Windows.UI.QuickActions.dll$Windows.UI.Xaml.dll$\SearchIndexer.exe$\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe$\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe$\dxgi.dll$\explorer.exe$api-ms-win-core-sysinfo-l1-2-0.dll$dxgi.dll
API String ID: 425412005-3433049922
Opcode ID: 88c2c6aaff04b593eb52fcd9162841361041791d9db1d1db946c8d4002ca0a51
Instruction ID: afb3c67d8e1aa965ce393815879fbeb45fa4c4ce0f79fadef05e2fe49da7193e
Opcode Fuzzy Hash: 88c2c6aaff04b593eb52fcd9162841361041791d9db1d1db946c8d4002ca0a51
Instruction Fuzzy Hash: 1C324B75A09A439DEB10DB68E8902B923A1FF857C4F800136DB4D466A8EFBDE549C740

Function 00007FF8BEE45620 Relevance: 58.1, APIs: 18, Strings: 15, Instructions: 354
registrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00007FF8BEE45666

Part of subcall function 00007FF8BEE350C0: RegCreateKeyExW.KERNEL32 ref: 00007FF8BEE3511C
Part of subcall function 00007FF8BEE350C0: RegQueryValueExW.KERNEL32 ref: 00007FF8BEE35171
Part of subcall function 00007FF8BEE350C0: GetLocaleInfoW.KERNEL32 ref: 00007FF8BEE351BA
Part of subcall function 00007FF8BEE350C0: GetLocaleInfoW.KERNEL32 ref: 00007FF8BEE351D5
Part of subcall function 00007FF8BEE350C0: SetThreadPreferredUILanguages.KERNEL32 ref: 00007FF8BEE3528B
Part of subcall function 00007FF8BEE350C0: RegCloseKey.KERNEL32 ref: 00007FF8BEE3529B

SHGetFolderPathW.SHELL32 ref: 00007FF8BEE456AA

Part of subcall function 00007FF8BEE67E1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE67E45

LoadLibraryExW.KERNEL32 ref: 00007FF8BEE456D7

Part of subcall function 00007FF8BEE12890: GetModuleHandleW.KERNEL32 ref: 00007FF8BEE128AF
Part of subcall function 00007FF8BEE12890: GetProcAddress.KERNEL32 ref: 00007FF8BEE128C8
Part of subcall function 00007FF8BEE12890: RegOpenKeyExW.KERNEL32 ref: 00007FF8BEE1293F
Part of subcall function 00007FF8BEE12890: RegQueryValueExW.KERNEL32 ref: 00007FF8BEE1296F

RegCreateKeyExW.KERNEL32 ref: 00007FF8BEE45779
RegQueryValueExW.KERNEL32 ref: 00007FF8BEE457B7
LoadStringW.USER32 ref: 00007FF8BEE4581F
LoadStringW.USER32 ref: 00007FF8BEE4585D
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE4590E
RegCloseKey.ADVAPI32 ref: 00007FF8BEE45919
SHGetFolderPathA.SHELL32 ref: 00007FF8BEE4595F
CreateDirectoryA.KERNEL32 ref: 00007FF8BEE45986
LoadStringW.USER32 ref: 00007FF8BEE45AD6
LoadStringW.USER32 ref: 00007FF8BEE45B14
LoadStringW.USER32 ref: 00007FF8BEE45B4D
LoadStringW.USER32 ref: 00007FF8BEE45B8B
LoadStringW.USER32 ref: 00007FF8BEE45BDE
LoadStringW.USER32 ref: 00007FF8BEE45C1C
FreeLibrary.KERNEL32 ref: 00007FF8BEE45CA1

Strings

short, xrefs: 00007FF8BEE457EE, 00007FF8BEE45BA9, 00007FF8BEE45C4D
\ExplorerPatcher\ep_gui.dll, xrefs: 00007FF8BEE456B0
long, xrefs: 00007FF8BEE45B26
<toast scenario="reminder" activationType="protocol" launch="%s" duration="%s"><visual><binding template="ToastGeneric">, xrefs: 00007FF8BEE45887, 00007FF8BEE45BC1, 00007FF8BEE45C46
[Symbols] Downloading to "%s"., xrefs: 00007FF8BEE459AB
Software\ExplorerPatcher, xrefs: 00007FF8BEE45724
\ExplorerPatcher, xrefs: 00007FF8BEE45965
https://github.com/valinet/ExplorerPatcher/wiki/Symbols, xrefs: 00007FF8BEE45874, 00007FF8BEE45BB5, 00007FF8BEE45C33
[Symbols] Finished gathering symbol data., xrefs: 00007FF8BEE45AA1
%d.%d.%d.%d, xrefs: 00007FF8BEE456EC
@, xrefs: 00007FF8BEE457AF
[Symbols] Finished "Download symbols" thread., xrefs: 00007FF8BEE45CA7
[Symbols] Attempting to download symbols for OS version %s., xrefs: 00007FF8BEE45926
SymbolsLastNotifiedOSBuild, xrefs: 00007FF8BEE4578E, 00007FF8BEE458EF
[Symbols] Started "Download symbols" thread., xrefs: 00007FF8BEE4566C

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Load$String$Value$CreateQuery$CloseFolderInfoLibraryLocalePath$AddressDirectoryFreeHandleLanguagesModuleOpenPreferredProcSleepThread_invalid_parameter_noinfo
String ID: %d.%d.%d.%d$<toast scenario="reminder" activationType="protocol" launch="%s" duration="%s"><visual><binding template="ToastGeneric">$@$Software\ExplorerPatcher$SymbolsLastNotifiedOSBuild$[Symbols] Attempting to download symbols for OS version %s.$[Symbols] Downloading to "%s".$[Symbols] Finished "Download symbols" thread.$[Symbols] Finished gathering symbol data.$[Symbols] Started "Download symbols" thread.$\ExplorerPatcher$\ExplorerPatcher\ep_gui.dll$https://github.com/valinet/ExplorerPatcher/wiki/Symbols$long$short
API String ID: 3080592855-3895060210
Opcode ID: db88c42cd2bff578304e446f47b52434223540bcc67150ca6e7fcab444a0de7b
Instruction ID: 2f5c53b3c387241efe5d1009f43db8b8fd229a90562c3dd02a89ae42bae6117c
Opcode Fuzzy Hash: db88c42cd2bff578304e446f47b52434223540bcc67150ca6e7fcab444a0de7b
Instruction Fuzzy Hash: 9D026236A18A839DE760DF64E8506EE33B4FB44388F805136DA4D47A99EFBCD649C740

Function 00007FF8BEE4F250 Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 315
registrysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RoInitialize.COMBASE ref: 00007FF8BEE4F286
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE4F2B5
RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF8BEE4F2D2
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE4F302
RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF8BEE4F31F
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE4F369
FindWindowExW.USER32 ref: 00007FF8BEE4F3BA
Sleep.KERNEL32 ref: 00007FF8BEE4F3CA
FindWindowExW.USER32 ref: 00007FF8BEE4F3DE
Sleep.KERNEL32 ref: 00007FF8BEE4F3EC
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE4F429
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE4F46A
RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF8BEE4F487
CreateEventW.KERNEL32 ref: 00007FF8BEE4F49F
CreateEventW.KERNEL32 ref: 00007FF8BEE4F4B7
CreateEventW.KERNEL32 ref: 00007FF8BEE4F4CF
RegCreateKeyExW.ADVAPI32 ref: 00007FF8BEE4F5C1
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE4F600
RegCloseKey.ADVAPI32 ref: 00007FF8BEE4F60A
WaitForMultipleObjects.KERNEL32 ref: 00007FF8BEE4F652

Strings

EP_Ev_CheckForUpdates_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FF8BEE4F491
Shell_TrayWnd, xrefs: 00007FF8BEE4F3AF, 00007FF8BEE4F3D3
EP_Ev_InstallUpdates_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FF8BEE4F4A9
[Updates] Starting daemon., xrefs: 00007FF8BEE4F3F2
IsUpdatePending, xrefs: 00007FF8BEE4F5F9
Software\ExplorerPatcher, xrefs: 00007FF8BEE4F5B3
Microsoft.Windows.Explorer, xrefs: 00007FF8BEE4F422
Windows.UI.Notifications.ToastNotification, xrefs: 00007FF8BEE4F463
EP_Ev_InstallUpdatesNoConfirm_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FF8BEE4F4C1
ep_updates, xrefs: 00007FF8BEE4F362
Windows.UI.Notifications.ToastNotificationManager, xrefs: 00007FF8BEE4F2AE, 00007FF8BEE4F2FB

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Create$ReferenceStringWindows$ActivationEventFactory$FindSleepWindow$CloseInitializeMultipleObjectsValueWait
String ID: EP_Ev_CheckForUpdates_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}$EP_Ev_InstallUpdatesNoConfirm_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}$EP_Ev_InstallUpdates_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}$IsUpdatePending$Microsoft.Windows.Explorer$Shell_TrayWnd$Software\ExplorerPatcher$Windows.UI.Notifications.ToastNotification$Windows.UI.Notifications.ToastNotificationManager$[Updates] Starting daemon.$ep_updates
API String ID: 515347756-3464217809
Opcode ID: c18357ae3e18e56df48e9b90b3782d440a669a27c2374db1899b79d48f0226c5
Instruction ID: e48f8cb4f519e02b6c134b26d03442f86ebeec12928504c0cd7e46aa51d5e856
Opcode Fuzzy Hash: c18357ae3e18e56df48e9b90b3782d440a669a27c2374db1899b79d48f0226c5
Instruction Fuzzy Hash: 0EE14632B09B429AEB10DF69E8506AD33B1FB49B88F405536DB0D57AA8DFBDE515C300

Function 00007FF8BEE28800 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 190
registrywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8BEE285B6), ref: 00007FF8BEE28877
RegQueryValueExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8BEE285B6), ref: 00007FF8BEE288B5
RegQueryValueExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8BEE285B6), ref: 00007FF8BEE288FE
RegQueryValueExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8BEE285B6), ref: 00007FF8BEE28948
RegCloseKey.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8BEE285B6), ref: 00007FF8BEE28969
RegCreateKeyExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8BEE285B6), ref: 00007FF8BEE289B6
RegQueryValueExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF8BEE285B6), ref: 00007FF8BEE289F3
SendNotifyMessageW.USER32 ref: 00007FF8BEE28A40
FindWindowExW.USER32 ref: 00007FF8BEE28A54
FindWindowExW.USER32 ref: 00007FF8BEE28A6E
FindWindowExW.USER32 ref: 00007FF8BEE28A88
GetWindowLongPtrW.USER32 ref: 00007FF8BEE28A9B
InvalidateRect.USER32 ref: 00007FF8BEE28AC4
FindWindowExW.USER32 ref: 00007FF8BEE28ADF

Strings

ClockButton, xrefs: 00007FF8BEE28AED
TraySettings, xrefs: 00007FF8BEE28A24
ShowTaskViewButton, xrefs: 00007FF8BEE288DE
TaskbarDa, xrefs: 00007FF8BEE28928
Shell_TrayWnd, xrefs: 00007FF8BEE28A49
TrayClockWClass, xrefs: 00007FF8BEE28A79
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF8BEE28852
SOFTWARE\Microsoft\Windows\CurrentVersion\Search, xrefs: 00007FF8BEE28991
TaskbarSmallIcons, xrefs: 00007FF8BEE2889F
SearchboxTaskbarMode, xrefs: 00007FF8BEE289D6
TrayNotifyWnd, xrefs: 00007FF8BEE28A62
Shell_SecondaryTrayWnd, xrefs: 00007FF8BEE28AD3

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Window$FindQueryValue$Create$CloseInvalidateLongMessageNotifyRectSend
String ID: ClockButton$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$SOFTWARE\Microsoft\Windows\CurrentVersion\Search$SearchboxTaskbarMode$Shell_SecondaryTrayWnd$Shell_TrayWnd$ShowTaskViewButton$TaskbarDa$TaskbarSmallIcons$TrayClockWClass$TrayNotifyWnd$TraySettings
API String ID: 3959271719-3714636963
Opcode ID: 4ab373a0b3cc1fd82646b3130a35559c248819b11f2c73222ac6e96f04d1f03e
Instruction ID: eb5b296b46bce54fd18c0907faf974b397d8e9445b2a5a31d42eeae884545eb6
Opcode Fuzzy Hash: 4ab373a0b3cc1fd82646b3130a35559c248819b11f2c73222ac6e96f04d1f03e
Instruction Fuzzy Hash: 5F918A72A09B428EEB60CF68E8906AD77A0FB49798F444535DB4D13B98DFBCE104C710

Function 00007FF8BEE4FE80 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 172
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FF8BEE4FEFB
GetLastError.KERNEL32 ref: 00007FF8BEE4FF0A
GetFileSizeEx.KERNEL32 ref: 00007FF8BEE4FF24
GetLastError.KERNEL32 ref: 00007FF8BEE4FF32
CloseHandle.KERNEL32 ref: 00007FF8BEE4FF3D
CryptGetHashParam.ADVAPI32 ref: 00007FF8BEE500AD
GetLastError.KERNEL32 ref: 00007FF8BEE500FF
CryptDestroyHash.ADVAPI32 ref: 00007FF8BEE5010C
CryptReleaseContext.ADVAPI32 ref: 00007FF8BEE50118
CloseHandle.KERNEL32 ref: 00007FF8BEE50121

Strings

%c%c, xrefs: 00007FF8BEE500C2

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CryptErrorLast$CloseFileHandleHash$ContextCreateDestroyParamReleaseSize
String ID: %c%c
API String ID: 1362656601-3228636524
Opcode ID: 55f61f22b1cfa79a35e07c728d9ce9c7de5a9daabe5a9ab501b041ea079c1ec8
Instruction ID: d0cac3d69af3e74e4ca5687c349129fb1274d6ab15918cad5b237730f848cf2c
Opcode Fuzzy Hash: 55f61f22b1cfa79a35e07c728d9ce9c7de5a9daabe5a9ab501b041ea079c1ec8
Instruction Fuzzy Hash: 5A718E22B19A828EE7108F79E8907BD27A1FF49BD8F004535EF4E16A58DFBCE5459700

Function 00007FF8BEE1E500 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 122
windowregistrytimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStockObject.GDI32 ref: 00007FF8BEE1E547
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE1E557
LoadCursorW.USER32 ref: 00007FF8BEE1E578
RegisterClassW.USER32 ref: 00007FF8BEE1E58B
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE1E593
CreateWindowExW.USER32 ref: 00007FF8BEE1E5CB
SetEvent.KERNEL32 ref: 00007FF8BEE1E735

Part of subcall function 00007FF8BEE509E0: RegOpenKeyExW.KERNEL32(?,?,?,?,?,?,?,00007FF8BEE1E4B6), ref: 00007FF8BEE50A1D
Part of subcall function 00007FF8BEE509E0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00007FF8BEE1E4B6), ref: 00007FF8BEE50A31

SetTimer.USER32 ref: 00007FF8BEE1E60A
RegisterHotKey.USER32 ref: 00007FF8BEE1E630
RegisterHotKey.USER32 ref: 00007FF8BEE1E64E
GetMessageW.USER32 ref: 00007FF8BEE1E664
EnterCriticalSection.KERNEL32 ref: 00007FF8BEE1E699
InvalidateRect.USER32 ref: 00007FF8BEE1E6D2
LeaveCriticalSection.KERNEL32 ref: 00007FF8BEE1E6DF
TranslateMessage.USER32 ref: 00007FF8BEE1E6EF
DispatchMessageW.USER32 ref: 00007FF8BEE1E6FD
GetMessageW.USER32 ref: 00007FF8BEE1E713
DestroyWindow.USER32 ref: 00007FF8BEE1E728

Strings

EP_Service_Window_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FF8BEE1E55D

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Message$Register$CriticalHandleModuleSectionWindow$ClassCloseCreateCursorDestroyDispatchEnterEventInvalidateLeaveLoadObjectOpenRectStockTimerTranslate
String ID: EP_Service_Window_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}
API String ID: 124686274-1881722731
Opcode ID: b57f66ebaee192715d19923a7331629b467761d4b72bedacc28b2662b6677ca9
Instruction ID: 4e97261112ebd16eabcaaf082bc4a2c81e2514498aef3f424496da1f5ffc297c
Opcode Fuzzy Hash: b57f66ebaee192715d19923a7331629b467761d4b72bedacc28b2662b6677ca9
Instruction Fuzzy Hash: AE51FC31A09B828AFB608B69F89477A77A4FF857C0F504035DB8E42AA4DFBDE445C701

Function 00007FF8BEE3A350 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 78
windowsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventW.KERNEL32 ref: 00007FF8BEE3A371
WaitForSingleObject.KERNEL32 ref: 00007FF8BEE3A3A9
GetShellWindow.USER32 ref: 00007FF8BEE3A3C0
SleepEx.KERNEL32 ref: 00007FF8BEE3A3D3
GetWindowThreadProcessId.USER32 ref: 00007FF8BEE3A3EF
SetWindowsHookExW.USER32 ref: 00007FF8BEE3A407
GetMessageW.USER32 ref: 00007FF8BEE3A43B
TranslateMessage.USER32 ref: 00007FF8BEE3A455
DispatchMessageW.USER32 ref: 00007FF8BEE3A460
GetMessageW.USER32 ref: 00007FF8BEE3A473

Strings

ShellDesktopSwitchEvent, xrefs: 00007FF8BEE3A363
Started "Open Start on current monitor" thread., xrefs: 00007FF8BEE3A3AF
Ended "Open Start on current monitor" thread., xrefs: 00007FF8BEE3A47D
Failed to start "Open Start on current monitor" thread., xrefs: 00007FF8BEE3A37C
Progman hook: %d, xrefs: 00007FF8BEE3A410
Progman: %d, xrefs: 00007FF8BEE3A3DE

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Message$Window$CreateDispatchEventHookObjectProcessShellSingleSleepThreadTranslateWaitWindows
String ID: Ended "Open Start on current monitor" thread.$Failed to start "Open Start on current monitor" thread.$Progman hook: %d$Progman: %d$ShellDesktopSwitchEvent$Started "Open Start on current monitor" thread.
API String ID: 2718461970-1416847937
Opcode ID: 18bf67a80918c840e866fcac94c4f4813b1a4977c1fff13bfa3f28c22d21dea2
Instruction ID: d37d8656ab6a21916b9abd20c6ca5aa177c0c09e8dc4972035810b4aede0cf97
Opcode Fuzzy Hash: 18bf67a80918c840e866fcac94c4f4813b1a4977c1fff13bfa3f28c22d21dea2
Instruction Fuzzy Hash: 43316025E1DA428AFB50DB29F86527A63A0FFD97C4F805235EB4E42664EFBCE5448700

Function 00007FF8BEE26900 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 130
synchronizationwindowsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF8BEE2694C
WaitForSingleObject.KERNEL32 ref: 00007FF8BEE26967
SleepEx.KERNEL32 ref: 00007FF8BEE26972
FindWindowExW.USER32 ref: 00007FF8BEE2698E
Sleep.KERNEL32 ref: 00007FF8BEE269B1
FindWindowExW.USER32 ref: 00007FF8BEE269C5
Sleep.KERNEL32 ref: 00007FF8BEE269D5
MsgWaitForMultipleObjectsEx.USER32 ref: 00007FF8BEE26A80
PeekMessageW.USER32 ref: 00007FF8BEE26AD5
TranslateMessage.USER32 ref: 00007FF8BEE26AE4
DispatchMessageW.USER32 ref: 00007FF8BEE26AEF
MsgWaitForMultipleObjectsEx.USER32 ref: 00007FF8BEE26B13
WaitForSingleObject.KERNEL32 ref: 00007FF8BEE26B46

Part of subcall function 00007FF8BEE12890: GetModuleHandleW.KERNEL32 ref: 00007FF8BEE128AF
Part of subcall function 00007FF8BEE12890: GetProcAddress.KERNEL32 ref: 00007FF8BEE128C8
Part of subcall function 00007FF8BEE12890: RegOpenKeyExW.KERNEL32 ref: 00007FF8BEE1293F
Part of subcall function 00007FF8BEE12890: RegQueryValueExW.KERNEL32 ref: 00007FF8BEE1296F

Strings

Shell_TrayWnd, xrefs: 00007FF8BEE26983, 00007FF8BEE269BA
[sws] Waiting for taskbar..., xrefs: 00007FF8BEE269A0

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Wait$MessageObjectSingleSleep$FindMultipleObjectsWindow$AddressDispatchHandleModuleOpenPeekProcQueryTranslateValue
String ID: Shell_TrayWnd$[sws] Waiting for taskbar...
API String ID: 3550486598-3608668894
Opcode ID: 57ef6079be94384d59322cd3f65a3ec6f8af3f743da513ca34b37038eed0cc18
Instruction ID: e630b9ae72f533c0985d86767dc050639de42fa5849a3f6fb7bae0f757f48f30
Opcode Fuzzy Hash: 57ef6079be94384d59322cd3f65a3ec6f8af3f743da513ca34b37038eed0cc18
Instruction Fuzzy Hash: BC517931A1DA838AFB60AF28E89437A27A1EF85BD4F404235D75E466E4DFBDE445C700

Function 00007FF8BEE350C0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 107registrythreadCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNEL32 ref: 00007FF8BEE3511C
RegQueryValueExW.KERNEL32 ref: 00007FF8BEE35171
GetLocaleInfoW.KERNEL32 ref: 00007FF8BEE351BA
GetLocaleInfoW.KERNEL32 ref: 00007FF8BEE351D5
SetThreadPreferredUILanguages.KERNEL32 ref: 00007FF8BEE3528B
RegCloseKey.KERNEL32 ref: 00007FF8BEE3529B

Strings

Software\ExplorerPatcher, xrefs: 00007FF8BEE350EA
Language, xrefs: 00007FF8BEE3514C

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: InfoLocale$CloseCreateLanguagesPreferredQueryThreadValue
String ID: Language$Software\ExplorerPatcher
API String ID: 3850668847-1772575399
Opcode ID: ea0f2633b2db62804292e248124bc3add90470c825c55f2f621eeaab03a689b2
Instruction ID: f0d380c3b01cc743f7e4d37aed659af3f6a16a99dc5b956905403c112e4364e7
Opcode Fuzzy Hash: ea0f2633b2db62804292e248124bc3add90470c825c55f2f621eeaab03a689b2
Instruction Fuzzy Hash: A4516E62A18BC186E7218F68E4543AD7760F7D9B44F41A325DB8C13B56EF78E1D8C700

Function 00007FF8BEE53030 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 146memorywindowCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF8BEE5313B
GetLastError.KERNEL32 ref: 00007FF8BEE5314A
FormatMessageA.KERNEL32 ref: 00007FF8BEE5317D

Strings

commit page %p (base=%p(used=%d), idx=%llu, size=%llu), xrefs: 00007FF8BEE53215
Failed to commit page %p (base=%p(used=%d), idx=%llu, size=%llu, error=%lu(%s)), xrefs: 00007FF8BEE531D6
Unknown Error, xrefs: 00007FF8BEE53189

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: AllocErrorFormatLastMessageVirtual
String ID: commit page %p (base=%p(used=%d), idx=%llu, size=%llu)$Failed to commit page %p (base=%p(used=%d), idx=%llu, size=%llu, error=%lu(%s))$Unknown Error
API String ID: 1689221563-3447313879
Opcode ID: 59323bae295cc87d067fa3d69b427ca384efa90ba0425ecc8e87ce7c99d47a62
Instruction ID: ec9f1e4229d87d47090ae6a1cdbc7b232cfd7cd055f3921d7142ff381e944331
Opcode Fuzzy Hash: 59323bae295cc87d067fa3d69b427ca384efa90ba0425ecc8e87ce7c99d47a62
Instruction Fuzzy Hash: 50517071A09B968AEB60CB2AF89076667A4FB49BC5F400135DF8C47B58DFBCE546C700

Function 00007FF8BEE1D7C0 Relevance: 6.0, APIs: 4, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF8BEE1D829
CheckTokenMembership.KERNELBASE ref: 00007FF8BEE1D83F
GetLastError.KERNEL32 ref: 00007FF8BEE1D849
FreeSid.ADVAPI32 ref: 00007FF8BEE1D85B

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: AllocateCheckErrorFreeInitializeLastMembershipToken
String ID:
API String ID: 3835361876-0
Opcode ID: 9b719a42994329497dcb58755b7362de631d7cd6d6f1faceb73e96b81b9f4dc6
Instruction ID: 2390c97ae4a0e06e6832fd64d7276bfa5a9c7be73fa5c787d97d7993c19bbfbb
Opcode Fuzzy Hash: 9b719a42994329497dcb58755b7362de631d7cd6d6f1faceb73e96b81b9f4dc6
Instruction Fuzzy Hash: B811B472A087818AE7508F6AF49035AFAE5FFD4780F10512AE78983A69DFBCD4458F40

Function 00007FF8BEE2A830 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00007FF8BEE2A891

Part of subcall function 00007FF8BEE12890: GetModuleHandleW.KERNEL32 ref: 00007FF8BEE128AF
Part of subcall function 00007FF8BEE12890: GetProcAddress.KERNEL32 ref: 00007FF8BEE128C8
Part of subcall function 00007FF8BEE12890: RegOpenKeyExW.KERNEL32 ref: 00007FF8BEE1293F
Part of subcall function 00007FF8BEE12890: RegQueryValueExW.KERNEL32 ref: 00007FF8BEE1296F

CoCreateInstance.COMBASE ref: 00007FF8BEE2AA55

Strings

Taskbar10.cpp, xrefs: 00007FF8BEE2A989, 00007FF8BEE2AA20

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CreateInstance$AddressHandleModuleOpenProcQueryValue
String ID: Taskbar10.cpp
API String ID: 1469795854-890630466
Opcode ID: df370a4c7a5dd7268f0eb4ce98fc46467527f5121e2d07c21181c0f23ce58fb0
Instruction ID: b10f189c04c82a392a6aa1478ee3e429568583460eeaa940b7c8a6747ae14954
Opcode Fuzzy Hash: df370a4c7a5dd7268f0eb4ce98fc46467527f5121e2d07c21181c0f23ce58fb0
Instruction Fuzzy Hash: 30510275A09B4289EA509F6DE59437933A0BF44BC4F409036DB5E437A4DFBCE8858701

Function 00007FF8BEE52FA0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF8BEE52099), ref: 00007FF8BEE52FB5

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 2c7f24313fb382f4fdd3077e00c0e51945971d3bd079279820afc05c3462abc3
Instruction ID: 801c6115885999a80a81a67e9049cfa6a550d437749f65eae5018743bd2c42f6
Opcode Fuzzy Hash: 2c7f24313fb382f4fdd3077e00c0e51945971d3bd079279820afc05c3462abc3
Instruction Fuzzy Hash: C3F0F8B5B1ED428AEB548B49FC9062567B1EB5ABC5F004135DB4D82764DE6DE1808700

Function 00007FF8BEE2C1F0 Relevance: 75.5, APIs: 17, Strings: 26, Instructions: 277
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 00007FF8BEE2C21B
GetCurrentProcess.KERNEL32 ref: 00007FF8BEE2C52C
K32GetModuleInformation.KERNEL32 ref: 00007FF8BEE2C543
LoadLibraryExW.KERNEL32 ref: 00007FF8BEE2C5C6
RegGetValueW.KERNEL32 ref: 00007FF8BEE2C6B2
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE2C6EB
GetProcAddress.KERNEL32 ref: 00007FF8BEE2C6FB
LoadLibraryW.KERNEL32 ref: 00007FF8BEE2C752
GetProcAddress.KERNEL32 ref: 00007FF8BEE2C230

Part of subcall function 00007FF8BEE1D290: GetModuleHandleExW.KERNEL32 ref: 00007FF8BEE1D2C6
Part of subcall function 00007FF8BEE1D290: ImageDirectoryEntryToDataEx.DBGHELP ref: 00007FF8BEE1D2F9
Part of subcall function 00007FF8BEE1D290: FreeLibrary.KERNEL32 ref: 00007FF8BEE1D32F

Part of subcall function 00007FF8BEE1D290: FreeLibrary.KERNEL32 ref: 00007FF8BEE1D3B9
Part of subcall function 00007FF8BEE1D290: VirtualQuery.KERNEL32 ref: 00007FF8BEE1D3F8
Part of subcall function 00007FF8BEE1D290: VirtualProtect.KERNEL32 ref: 00007FF8BEE1D413
Part of subcall function 00007FF8BEE1D290: VirtualProtect.KERNEL32 ref: 00007FF8BEE1D43B
Part of subcall function 00007FF8BEE1D290: FreeLibrary.KERNEL32 ref: 00007FF8BEE1D446

LoadLibraryW.KERNEL32 ref: 00007FF8BEE2C24C
GetCurrentProcess.KERNEL32 ref: 00007FF8BEE2C2C1
K32GetModuleInformation.KERNEL32 ref: 00007FF8BEE2C2D8
LoadLibraryW.KERNEL32 ref: 00007FF8BEE2C39E
GetProcAddress.KERNEL32 ref: 00007FF8BEE2C3B1
LoadLibraryExW.KERNEL32 ref: 00007FF8BEE2C3C5
GetCurrentProcess.KERNEL32 ref: 00007FF8BEE2C400
K32GetModuleInformation.KERNEL32 ref: 00007FF8BEE2C417

Strings

API-MS-WIN-CORE-STRING-L1-1-0.DLL, xrefs: 00007FF8BEE2C503
Windows.UI.FileExplorer.dll, xrefs: 00007FF8BEE2C5BF
SystemParametersInfoW, xrefs: 00007FF8BEE2C32A, 00007FF8BEE2C469, 00007FF8BEE2C603
TrackPopupMenu, xrefs: 00007FF8BEE2C297, 00007FF8BEE2C3DA, 00007FF8BEE2C5E3
CreateWindowExW, xrefs: 00007FF8BEE2C34F, 00007FF8BEE2C4AA, 00007FF8BEE2C628
Start_ShowClassicMode, xrefs: 00007FF8BEE2C682
shcore.dll, xrefs: 00007FF8BEE2C489
shcore.dll, xrefs: 00007FF8BEE2C397
shell32.dll, xrefs: 00007FF8BEE2C23D
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF8BEE2C69B
combase.dll, xrefs: 00007FF8BEE2C74B
ExplorerFrame.dll, xrefs: 00007FF8BEE2C3BE
ntdll.dll, xrefs: 00007FF8BEE2C6E4
GetSystemMetricsForDpi, xrefs: 00007FF8BEE2C519
user32.dll, xrefs: 00007FF8BEE2C2A5, 00007FF8BEE2C331, 00007FF8BEE2C35D, 00007FF8BEE2C388, 00007FF8BEE2C3E1, 00007FF8BEE2C470, 00007FF8BEE2C4B8, 00007FF8BEE2C4E3, 00007FF8BEE2C520, 00007FF8BEE2C5EA, 00007FF8BEE2C60A, 00007FF8BEE2C636, 00007FF8BEE2C661
SHRegGetValueFromHKCUHKLM, xrefs: 00007FF8BEE2C226
CoCreateInstance, xrefs: 00007FF8BEE2C5AC
Failed to hook RtlQueryFeatureConfiguration(). rv = %d, xrefs: 00007FF8BEE2C732
RtlQueryFeatureConfiguration, xrefs: 00007FF8BEE2C6F4
api-ms-win-core-com-l1-1-0.dll, xrefs: 00007FF8BEE2C5B3
CompareStringOrdinal, xrefs: 00007FF8BEE2C4FC
Shlwapi.dll, xrefs: 00007FF8BEE2C210
LoadLibraryExW, xrefs: 00007FF8BEE2C762
SetWindowLongPtrW, xrefs: 00007FF8BEE2C37A, 00007FF8BEE2C4D5, 00007FF8BEE2C653
api-ms-win-core-libraryloader-l1-2-0.dll, xrefs: 00007FF8BEE2C769
xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xxx????xxx, xrefs: 00007FF8BEE2C2E2, 00007FF8BEE2C421

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Library$Load$Module$AddressCurrentFreeInformationProcProcessVirtual$HandleProtect$DataDirectoryEntryImageQueryValue
String ID: API-MS-WIN-CORE-STRING-L1-1-0.DLL$CoCreateInstance$CompareStringOrdinal$CreateWindowExW$ExplorerFrame.dll$Failed to hook RtlQueryFeatureConfiguration(). rv = %d$GetSystemMetricsForDpi$LoadLibraryExW$RtlQueryFeatureConfiguration$SHRegGetValueFromHKCUHKLM$SetWindowLongPtrW$Shlwapi.dll$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced$Start_ShowClassicMode$SystemParametersInfoW$TrackPopupMenu$Windows.UI.FileExplorer.dll$api-ms-win-core-com-l1-1-0.dll$api-ms-win-core-libraryloader-l1-2-0.dll$combase.dll$ntdll.dll$shcore.dll$shcore.dll$shell32.dll$user32.dll$xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xxx????xxx
API String ID: 404060323-2645642614
Opcode ID: ce5ff56efb26852bf13776ef3bf0b7fc33ae2dd4a0aa4cba935d9fd63c312870
Instruction ID: e4fce595fcced90f43348f982cb9bf630b5daf496bf52da0011a96b13034da5a
Opcode Fuzzy Hash: ce5ff56efb26852bf13776ef3bf0b7fc33ae2dd4a0aa4cba935d9fd63c312870
Instruction Fuzzy Hash: 12F1F361A09A4B9DFB40DF6CE8906F923A0BF497C5F844136DA0D462A5EFFCE589C341

Function 00007FF8BEE4B3C0 Relevance: 68.7, APIs: 12, Strings: 27, Instructions: 421
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF8BEE2EC0C), ref: 00007FF8BEE4B3F4
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF8BEE2EC0C), ref: 00007FF8BEE4B3FD
K32GetModuleInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF8BEE2EC0C), ref: 00007FF8BEE4B413

Part of subcall function 00007FF8BEE4AEB0: GetSystemDirectoryW.KERNEL32 ref: 00007FF8BEE4AEDB
Part of subcall function 00007FF8BEE4AEB0: CreateFileW.KERNEL32 ref: 00007FF8BEE4AF21

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF8BEE2EC0C), ref: 00007FF8BEE4B6D9
VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF8BEE2EC0C), ref: 00007FF8BEE4B712
VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF8BEE2EC0C), ref: 00007FF8BEE4B82B
VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF8BEE2EC0C), ref: 00007FF8BEE4B866
VirtualProtect.KERNEL32 ref: 00007FF8BEE4B925
VirtualProtect.KERNEL32 ref: 00007FF8BEE4B964
LoadLibraryW.KERNEL32 ref: 00007FF8BEE4B97D
GetCurrentProcess.KERNEL32 ref: 00007FF8BEE4B986
K32GetModuleInformation.KERNEL32 ref: 00007FF8BEE4B99C

Strings

Failed to hook CLauncherTipContextMenu::ShowLauncherTipContextMenu(). rv = %d, xrefs: 00007FF8BEE4B4E4
[CC] rcWorkAssignment = %llX, xrefs: 00007FF8BEE4B78E
x?xxxx?xx?x????xxxx, xrefs: 00007FF8BEE4B8B8
API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL, xrefs: 00007FF8BEE4BAD1
[CC] blockEnd = %llX, xrefs: 00007FF8BEE4B805
Failed to hook PenMenuSystemTrayManager::GetDynamicSystemTrayHeightForMonitor(). rv = %d, xrefs: 00007FF8BEE4BA14
[AC] Patched!, xrefs: 00007FF8BEE4B718
[CC] blockBegin = %llX, xrefs: 00007FF8BEE4B7C9
[TV] firstCallPrep = %llX, xrefs: 00007FF8BEE4B8E0
xxx?xxx?x???xxx, xrefs: 00007FF8BEE4B5C6
[TV] firstCallCall = %llX, xrefs: 00007FF8BEE4B8FE
twinui.pcshell.dll, xrefs: 00007FF8BEE4B3E9
Failed to hook CMultitaskingViewManager::_CreateXamlMTVHost(). rv = %d, xrefs: 00007FF8BEE4B55D
Windows.Internal.HardwareConfirmator.dll, xrefs: 00007FF8BEE4B976
xxxx?xxxxx?x, xrefs: 00007FF8BEE4B72B
Setup twinui.pcshell functions done, xrefs: 00007FF8BEE4BADD
[TV] Patched!, xrefs: 00007FF8BEE4B96A
[CC] rcMonitorAssignment = %llX, xrefs: 00007FF8BEE4B754
xxx?xxxxx?x, xrefs: 00007FF8BEE4B763
[AC] blockEnd = %llX, xrefs: 00007FF8BEE4B6B3
x?xxx?xx?x????xxxx, xrefs: 00007FF8BEE4B885
PenMenuSystemTrayManager::GetDynamicSystemTrayHeightForMonitor() = %llX, xrefs: 00007FF8BEE4B9DE
RegGetValueW, xrefs: 00007FF8BEE4BACA
xxxx?xxxx?xxxxxxx?xxx, xrefs: 00007FF8BEE4B9AE
[AC] rcMonitorAssignment = %llX, xrefs: 00007FF8BEE4B5FD
[CC] Patched!, xrefs: 00007FF8BEE4B86C
[AC] blockBegin = %llX, xrefs: 00007FF8BEE4B677

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ProtectVirtual$CurrentInformationLibraryLoadModuleProcess$CreateDirectoryFileSystem
String ID: API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL$Failed to hook CLauncherTipContextMenu::ShowLauncherTipContextMenu(). rv = %d$Failed to hook CMultitaskingViewManager::_CreateXamlMTVHost(). rv = %d$Failed to hook PenMenuSystemTrayManager::GetDynamicSystemTrayHeightForMonitor(). rv = %d$PenMenuSystemTrayManager::GetDynamicSystemTrayHeightForMonitor() = %llX$RegGetValueW$Setup twinui.pcshell functions done$Windows.Internal.HardwareConfirmator.dll$[AC] Patched!$[AC] blockBegin = %llX$[AC] blockEnd = %llX$[AC] rcMonitorAssignment = %llX$[CC] Patched!$[CC] blockBegin = %llX$[CC] blockEnd = %llX$[CC] rcMonitorAssignment = %llX$[CC] rcWorkAssignment = %llX$[TV] Patched!$[TV] firstCallCall = %llX$[TV] firstCallPrep = %llX$twinui.pcshell.dll$x?xxx?xx?x????xxxx$x?xxxx?xx?x????xxxx$xxx?xxx?x???xxx$xxx?xxxxx?x$xxxx?xxxx?xxxxxxx?xxx$xxxx?xxxxx?x
API String ID: 823495189-2224694150
Opcode ID: 140e55937894aa280f122c5a5f5b0c6c3e0876ff0e009991bc6cba66966b06aa
Instruction ID: 9854dd666347eb55713a4305d1fad53c941c7a09a86f3f4ca5eb5b9d36f9ff98
Opcode Fuzzy Hash: 140e55937894aa280f122c5a5f5b0c6c3e0876ff0e009991bc6cba66966b06aa
Instruction Fuzzy Hash: 82223621A09A478DEB10DB69E8882BD73B1BF447D4F804136DB0D47AA5EFBCE949C700

Function 00007FF8BEE4AEB0 Relevance: 45.8, APIs: 5, Strings: 21, Instructions: 333
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32 ref: 00007FF8BEE4AEDB

Part of subcall function 00007FF8BEE67E1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE67E45

CreateFileW.KERNEL32 ref: 00007FF8BEE4AF21
GetFileSize.KERNEL32 ref: 00007FF8BEE4AF5E
ReadFile.KERNEL32 ref: 00007FF8BEE4AF88

Strings

CLauncherTipContextMenu::_ExecuteShutdownCommand() = %lX, xrefs: 00007FF8BEE4B18E
CLauncherTipContextMenu::GetMenuItemsAsync() = %lX, xrefs: 00007FF8BEE4B0AD
CMultitaskingViewManager::_CreateDCompMTVHost() = %lX, xrefs: 00007FF8BEE4B35A
Failed to open twinui.pcshell.dll, xrefs: 00007FF8BEE4AF30
CImmersiveContextMenuOwnerDrawHelper::s_ContextMenuWndProc() = %lX, xrefs: 00007FF8BEE4B00C
xxxx??x??x?xxxxxx????x, xrefs: 00007FF8BEE4B21F, 00007FF8BEE4B2C9
xx?x????xx?xx?xxxx????x, xrefs: 00007FF8BEE4B15F
xxxx?xxxx?xxxxxxxxxxxxxxx, xrefs: 00007FF8BEE4B116
Failed to read twinui.pcshell.dll, xrefs: 00007FF8BEE4B368
CMultitaskingViewManager::_CreateXamlMTVHost() = %lX, xrefs: 00007FF8BEE4B2A6
CLauncherTipContextMenu::_ExecuteCommand() = %lX, xrefs: 00007FF8BEE4B1FC
xxxxx????x????xxx, xrefs: 00007FF8BEE4AFDE
xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xxx????xxx, xrefs: 00007FF8BEE4B0CD
xx?x????xxxxxxx????xxxx????x, xrefs: 00007FF8BEE4B1CD
xxx????xxxxxxxxx????xxxxxxx????xxxxxxx????xxxxxxx????xxxx, xrefs: 00007FF8BEE4B03A
ImmersiveContextMenuHelper::RemoveOwnerDrawFromMenu() = %lX, xrefs: 00007FF8BEE4B13F
CLauncherTipContextMenu::ShowLauncherTipContextMenu() = %lX, xrefs: 00007FF8BEE4B096
xxx?????x?x??x??x?xxxxxxxx, xrefs: 00007FF8BEE4B24E, 00007FF8BEE4B2F4
xx?x????xxxxxxx????xxxx?xxx, xrefs: 00007FF8BEE4B1AE
\twinui.pcshell.dll, xrefs: 00007FF8BEE4AEE1
ImmersiveContextMenuHelper::ApplyOwnerDrawToMenu() = %lX, xrefs: 00007FF8BEE4B0F6

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: File$CreateDirectoryReadSizeSystem_invalid_parameter_noinfo
String ID: CImmersiveContextMenuOwnerDrawHelper::s_ContextMenuWndProc() = %lX$CLauncherTipContextMenu::GetMenuItemsAsync() = %lX$CLauncherTipContextMenu::ShowLauncherTipContextMenu() = %lX$CLauncherTipContextMenu::_ExecuteCommand() = %lX$CLauncherTipContextMenu::_ExecuteShutdownCommand() = %lX$CMultitaskingViewManager::_CreateDCompMTVHost() = %lX$CMultitaskingViewManager::_CreateXamlMTVHost() = %lX$Failed to open twinui.pcshell.dll$Failed to read twinui.pcshell.dll$ImmersiveContextMenuHelper::ApplyOwnerDrawToMenu() = %lX$ImmersiveContextMenuHelper::RemoveOwnerDrawFromMenu() = %lX$\twinui.pcshell.dll$xx?x????xx?xx?xxxx????x$xx?x????xxxxxxx????xxxx????x$xx?x????xxxxxxx????xxxx?xxx$xxx?????x?x??x??x?xxxxxxxx$xxx????xxxxxxxxx????xxxxxxx????xxxxxxx????xxxxxxx????xxxx$xxxx??x??x?xxxxxx????x$xxxx?xxxx?xxxxxxxxxxxxxxx$xxxxx????x????xxx$xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xxx????xxx
API String ID: 1602095072-3745368841
Opcode ID: f84e96306b30a0f295d584e1bb5d815ec3794e38e58154dc3a94890206953a3d
Instruction ID: cf8c8a0b0368dc78fbf811d7279fbb7b4735f8f639586fb8d75b760d80a01cd5
Opcode Fuzzy Hash: f84e96306b30a0f295d584e1bb5d815ec3794e38e58154dc3a94890206953a3d
Instruction Fuzzy Hash: 36F15A72A085438AEB64DB69D8502BD33B1AF80BE4F454232DB6D836E5DFBCE945C740

Function 00007FF8BEE52BC0 Relevance: 37.0, APIs: 11, Strings: 10, Instructions: 226
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 00007FF8BEE52BFA
VirtualQuery.KERNEL32 ref: 00007FF8BEE52C95
GetLastError.KERNEL32 ref: 00007FF8BEE52CA4
FormatMessageA.KERNEL32 ref: 00007FF8BEE52CD7
VirtualAlloc.KERNEL32 ref: 00007FF8BEE52D1E
GetLastError.KERNEL32 ref: 00007FF8BEE52D30
FormatMessageA.KERNEL32 ref: 00007FF8BEE52D63
VirtualAlloc.KERNEL32 ref: 00007FF8BEE52E18
GetLastError.KERNEL32 ref: 00007FF8BEE52E2A
FormatMessageA.KERNEL32 ref: 00007FF8BEE52E5D
VirtualFree.KERNEL32 ref: 00007FF8BEE52ED4

Strings

Failed to execute VirtualQuery (addr=%p, error=%lu(%s)), xrefs: 00007FF8BEE52F68
change hint address from %p to %p, xrefs: 00007FF8BEE52CF6
commit memory %p for read-write (hint=%p, size=%llu), xrefs: 00007FF8BEE52EE6
Failed to commit memory %p for read-write (hint=%p, size=%llu, error=%lu(%s)), xrefs: 00007FF8BEE52EA4
used, xrefs: 00007FF8BEE52C18
free, xrefs: 00007FF8BEE52C09
reserve memory %p (hint=%p, size=%llu), xrefs: 00007FF8BEE52DE8
process map: %08llx-%08llx %s, xrefs: 00007FF8BEE52C24
Unknown Error, xrefs: 00007FF8BEE52CE7, 00007FF8BEE52D6F, 00007FF8BEE52E69
Failed to reserve memory %p (hint=%p, size=%llu, errro=%lu(%s)), xrefs: 00007FF8BEE52DB2

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Virtual$ErrorFormatLastMessage$AllocQuery$Free
String ID: change hint address from %p to %p$ commit memory %p for read-write (hint=%p, size=%llu)$ process map: %08llx-%08llx %s$ reserve memory %p (hint=%p, size=%llu)$Failed to commit memory %p for read-write (hint=%p, size=%llu, error=%lu(%s))$Failed to execute VirtualQuery (addr=%p, error=%lu(%s))$Failed to reserve memory %p (hint=%p, size=%llu, errro=%lu(%s))$Unknown Error$free$used
API String ID: 2999834170-966645287
Opcode ID: ac436147e9372ba52faa06f986f0cedc3b6d744b3a35cd07e7307206f472d4b0
Instruction ID: a7742dfada0c37cfaa066d88d51e9fb9fd8b413440e9006cf418d9be583c1ec6
Opcode Fuzzy Hash: ac436147e9372ba52faa06f986f0cedc3b6d744b3a35cd07e7307206f472d4b0
Instruction Fuzzy Hash: B6A17071B1DB868AEB608B1AE45037967E0FB49BC4F440135EB8D47BA4EFBCE1458B00

Function 00007FF8BEE28B30 Relevance: 35.3, APIs: 9, Strings: 11, Instructions: 301
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetAncestor.USER32 ref: 00007FF8BEE28CD5
GetClassNameW.USER32 ref: 00007FF8BEE28CEC
GetClassNameW.USER32 ref: 00007FF8BEE28DA8
CreateWindowExW.USER32 ref: 00007FF8BEE28E3D
#410.COMCTL32 ref: 00007FF8BEE28F79
GetCurrentThreadId.KERNEL32 ref: 00007FF8BEE28F7F
SetWindowsHookExW.USER32 ref: 00007FF8BEE28F97
FindWindowW.USER32 ref: 00007FF8BEE28FFE
#410.COMCTL32 ref: 00007FF8BEE2901F

Strings

ClockButton, xrefs: 00007FF8BEE28EA5
TrayClockWClass, xrefs: 00007FF8BEE28E5C
Shell_TrayWnd, xrefs: 00007FF8BEE28DB9, 00007FF8BEE28F39, 00007FF8BEE28FA6
CabinetWClass, xrefs: 00007FF8BEE28CFD
NotifyIconOverflowWindow, xrefs: 00007FF8BEE28C1A
SysTreeView32, xrefs: 00007FF8BEE28C86
SysListView32, xrefs: 00007FF8BEE28C5A
TrayNotifyWnd, xrefs: 00007FF8BEE28BED
Shell_SecondaryTrayWnd, xrefs: 00007FF8BEE28FB3
ReBarWindow32, xrefs: 00007FF8BEE28D30, 00007FF8BEE28FE6
TrayShowDesktopButtonWClass, xrefs: 00007FF8BEE28EED

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: #410ClassNameWindow$AncestorCreateCurrentFindHookThreadWindows
String ID: CabinetWClass$ClockButton$NotifyIconOverflowWindow$ReBarWindow32$Shell_SecondaryTrayWnd$Shell_TrayWnd$SysListView32$SysTreeView32$TrayClockWClass$TrayNotifyWnd$TrayShowDesktopButtonWClass
API String ID: 2746137922-373551488
Opcode ID: e27cfe17aae0ae7c93bef44b9aaa07cf2fe1a1013142067cdfbd1078846d3aa7
Instruction ID: 8e34099b564dc8f7795b155eda2854a06aa66b2384b199020a73da4930e4c36b
Opcode Fuzzy Hash: e27cfe17aae0ae7c93bef44b9aaa07cf2fe1a1013142067cdfbd1078846d3aa7
Instruction Fuzzy Hash: 65E18562A08A4689FBA49F0DE45057D73A1FB94FD0F844132DF4E52698EFBCE895C305

Function 00007FF8BEE1E350 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 106
registrywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterWindowMessageW.USER32 ref: 00007FF8BEE1E37F
DefWindowProcW.USER32 ref: 00007FF8BEE1E4E1

Strings

Windows.UI.Core.CoreWindow, xrefs: 00007FF8BEE1E44A
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF8BEE1E485
Refreshed Spotlight, xrefs: 00007FF8BEE1E4CA
TaskbarCreated, xrefs: 00007FF8BEE1E378
d, xrefs: 00007FF8BEE1E4AB
TaskbarAl, xrefs: 00007FF8BEE1E476

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Window$MessageProcRegister
String ID: Refreshed Spotlight$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$TaskbarAl$TaskbarCreated$Windows.UI.Core.CoreWindow$d
API String ID: 136062168-2101710627
Opcode ID: 3b09d4f9d53760f7fe3767ce1d9f3c804247ff1e6b53c71246f0daace642527b
Instruction ID: 26b218c9cb8442a73674a1178851260468eb7b47a8683428fb2d6fce9d6de28f
Opcode Fuzzy Hash: 3b09d4f9d53760f7fe3767ce1d9f3c804247ff1e6b53c71246f0daace642527b
Instruction Fuzzy Hash: 80416361E0C6428DFBA09B6DE8946BA6690BF557E4F840131FB4E026E5DFECE4C4C712

Function 00007FF8BEE444E0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 90COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE ref: 00007FF8BEE44504
RoInitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF8BEE4450F
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE4452B
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE44548
RoActivateInstance.COMBASE ref: 00007FF8BEE44569
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE44620
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE4462B

Strings

%s:%d:: QueryInterface = %d, xrefs: 00007FF8BEE445C7
String2IXMLDocument, xrefs: 00007FF8BEE445BA, 00007FF8BEE44602
Windows.Data.Xml.Dom.XmlDocument, xrefs: 00007FF8BEE44524
%s:%d:: RoActivateInstance = %d, xrefs: 00007FF8BEE4460F

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: StringWindows$CreateDeleteInitializeReference$ActivateInstance
String ID: %s:%d:: QueryInterface = %d$%s:%d:: RoActivateInstance = %d$String2IXMLDocument$Windows.Data.Xml.Dom.XmlDocument
API String ID: 2286360050-3498695339
Opcode ID: 29bb18efdd665beadc699538b6af495fe490c6f4a0d1ec4f190c8520a347695b
Instruction ID: e3686d9e2a3e3e1175b54c36d1726c7059a83ff2411130245fff550d45ed0682
Opcode Fuzzy Hash: 29bb18efdd665beadc699538b6af495fe490c6f4a0d1ec4f190c8520a347695b
Instruction Fuzzy Hash: 02410E76B08A4686EB109F69E49026A67B1FF88BD9F404132EF4E43B64DFBCD549C700

Function 00007FF8BEE2ADC0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 87registrystringCOMMON

Download Yara Rule

APIs

lstrcmpW.KERNEL32 ref: 00007FF8BEE2AE11
RegGetValueW.ADVAPI32 ref: 00007FF8BEE2AE4C

Part of subcall function 00007FF8BEE12890: GetModuleHandleW.KERNEL32 ref: 00007FF8BEE128AF
Part of subcall function 00007FF8BEE12890: GetProcAddress.KERNEL32 ref: 00007FF8BEE128C8
Part of subcall function 00007FF8BEE12890: RegOpenKeyExW.KERNEL32 ref: 00007FF8BEE1293F
Part of subcall function 00007FF8BEE12890: RegQueryValueExW.KERNEL32 ref: 00007FF8BEE1296F

lstrcmpW.KERNEL32 ref: 00007FF8BEE2AE97
lstrcmpW.KERNEL32 ref: 00007FF8BEE2AEAB
RegGetValueW.ADVAPI32 ref: 00007FF8BEE2AEEA
RegGetValueW.KERNEL32 ref: 00007FF8BEE2AF31

Strings

TaskbarDa, xrefs: 00007FF8BEE2AE23
TaskbarGlomLevel, xrefs: 00007FF8BEE2AE8D
ShowCortanaButton, xrefs: 00007FF8BEE2AE07
Software\ExplorerPatcher, xrefs: 00007FF8BEE2AEBA
MMTaskbarGlomLevel, xrefs: 00007FF8BEE2AEA1

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Value$lstrcmp$AddressHandleModuleOpenProcQuery
String ID: MMTaskbarGlomLevel$ShowCortanaButton$Software\ExplorerPatcher$TaskbarDa$TaskbarGlomLevel
API String ID: 2197982753-1130954207
Opcode ID: 5fc2345eeb559a7a51ed9741c2e5903653179be25ee697d7bc4c4906fda69bd8
Instruction ID: be13ce5ec4cca5be4a4b9d2ebff018743f6e7fbac1955fe0c12571a777c69c94
Opcode Fuzzy Hash: 5fc2345eeb559a7a51ed9741c2e5903653179be25ee697d7bc4c4906fda69bd8
Instruction Fuzzy Hash: 96413F71A18B82C9EB508F2AF88466AB7A5FB44BD4F444135DB8D43B68DFBCD445CB04

Function 00007FF8BEE44320 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 110COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF8BEE44345
RoInitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF8BEE44350
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE4436A
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE443A5

Strings

Microsoft.Windows.Explorer, xrefs: 00007FF8BEE44363
Windows.UI.Notifications.ToastNotificationManager, xrefs: 00007FF8BEE4439E
Windows.UI.Notifications.ToastNotification, xrefs: 00007FF8BEE44414

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CreateInitializeReferenceStringWindows
String ID: Microsoft.Windows.Explorer$Windows.UI.Notifications.ToastNotification$Windows.UI.Notifications.ToastNotificationManager
API String ID: 3973075819-205246331
Opcode ID: bad3cb61ad32a0b5546914f8a6ca0e8b2114f70bdd3b9801e6c1c526c0c049c0
Instruction ID: b33a11bf4ab37c2627328f96afe366bfb4ed0ba817b8a674a510ca2cf8fce9b9
Opcode Fuzzy Hash: bad3cb61ad32a0b5546914f8a6ca0e8b2114f70bdd3b9801e6c1c526c0c049c0
Instruction Fuzzy Hash: 5051C966B05A568AEB10DBA9D4A43AD27B1FB48BC8F400432DF0E63B58DFB9D509C351

Function 00007FF8BEE21DF0 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF8BEE21E10

Part of subcall function 00007FF8BEE1D290: GetModuleHandleExW.KERNEL32 ref: 00007FF8BEE1D2C6
Part of subcall function 00007FF8BEE1D290: ImageDirectoryEntryToDataEx.DBGHELP ref: 00007FF8BEE1D2F9
Part of subcall function 00007FF8BEE1D290: FreeLibrary.KERNEL32 ref: 00007FF8BEE1D32F

GetCurrentProcess.KERNEL32 ref: 00007FF8BEE21E3E
K32GetModuleInformation.KERNEL32 ref: 00007FF8BEE21E55

Strings

Setup sndvolsso functions done, xrefs: 00007FF8BEE21ECC
user32.dll, xrefs: 00007FF8BEE21E2A
TrackPopupMenuEx, xrefs: 00007FF8BEE21E20
sndvolsso.dll, xrefs: 00007FF8BEE21E09
api-ms-win-core-registry-l1-1-0.dll, xrefs: 00007FF8BEE21EC0
xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xxx????xxx, xrefs: 00007FF8BEE21E5F
RegGetValueW, xrefs: 00007FF8BEE21EB9

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: LibraryModule$CurrentDataDirectoryEntryFreeHandleImageInformationLoadProcess
String ID: RegGetValueW$Setup sndvolsso functions done$TrackPopupMenuEx$api-ms-win-core-registry-l1-1-0.dll$sndvolsso.dll$user32.dll$xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xxx????xxx
API String ID: 2511907732-965438320
Opcode ID: d55d94c0579eabded5e0c3831d6f3bd1030193f69442e971412faabfb3a5b2e3
Instruction ID: 9fcfff5a7ea992733e248201b43cd30a1038c01a09468f85368146f2a24937f1
Opcode Fuzzy Hash: d55d94c0579eabded5e0c3831d6f3bd1030193f69442e971412faabfb3a5b2e3
Instruction Fuzzy Hash: FA214F61A19A4B98EA50DF69F8510FA2361BF897C0F844132EB4E037A6DEFCF145C742

Function 00007FF8BEE2DA80 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BEE1D290: GetModuleHandleExW.KERNEL32 ref: 00007FF8BEE1D2C6
Part of subcall function 00007FF8BEE1D290: ImageDirectoryEntryToDataEx.DBGHELP ref: 00007FF8BEE1D2F9
Part of subcall function 00007FF8BEE1D290: FreeLibrary.KERNEL32 ref: 00007FF8BEE1D32F

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,00007FF8BEE230C8), ref: 00007FF8BEE2DB03
K32GetModuleInformation.KERNEL32(?,?,?,?,?,?,?,00007FF8BEE230C8), ref: 00007FF8BEE2DB1A

Part of subcall function 00007FF8BEE1D290: FreeLibrary.KERNEL32 ref: 00007FF8BEE1D3B9
Part of subcall function 00007FF8BEE1D290: VirtualQuery.KERNEL32 ref: 00007FF8BEE1D3F8
Part of subcall function 00007FF8BEE1D290: VirtualProtect.KERNEL32 ref: 00007FF8BEE1D413
Part of subcall function 00007FF8BEE1D290: VirtualProtect.KERNEL32 ref: 00007FF8BEE1D43B
Part of subcall function 00007FF8BEE1D290: FreeLibrary.KERNEL32 ref: 00007FF8BEE1D446

Strings

api-ms-win-core-com-l1-1-0.dll, xrefs: 00007FF8BEE2DAAA
user32.dll, xrefs: 00007FF8BEE2DAF0
TrackPopupMenu, xrefs: 00007FF8BEE2DAE9
api-ms-win-core-registry-l1-1-0.dll, xrefs: 00007FF8BEE2DAD3
xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xxx????xxx, xrefs: 00007FF8BEE2DB24
CoCreateInstance, xrefs: 00007FF8BEE2DAA3
Setup pnidui functions done, xrefs: 00007FF8BEE2DB62
RegGetValueW, xrefs: 00007FF8BEE2DACC

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: FreeLibraryVirtual$ModuleProtect$CurrentDataDirectoryEntryHandleImageInformationProcessQuery
String ID: CoCreateInstance$RegGetValueW$Setup pnidui functions done$TrackPopupMenu$api-ms-win-core-com-l1-1-0.dll$api-ms-win-core-registry-l1-1-0.dll$user32.dll$xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xxx????xxx
API String ID: 430087472-2450567920
Opcode ID: e9e4abc3c9c468b89c24930d4d63e9cd5367572069bf472c9ec42d5176aea36f
Instruction ID: df15b476bd18a709c2785af1172ecf5fca57057cea1477e669c758023780be82
Opcode Fuzzy Hash: e9e4abc3c9c468b89c24930d4d63e9cd5367572069bf472c9ec42d5176aea36f
Instruction Fuzzy Hash: 5F211B61A0DA4799EA50DF69F8500F92360BF447C4F844133EB0E16766DEFCE589C781

Function 00007FF8BEE2CD30 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegGetValueW.KERNEL32 ref: 00007FF8BEE2CDAB
RegGetValueW.KERNEL32 ref: 00007FF8BEE2CDEF
RegGetValueW.ADVAPI32 ref: 00007FF8BEE2CE34
RegGetValueW.ADVAPI32 ref: 00007FF8BEE2CE83

Strings

CrashThresholdTime, xrefs: 00007FF8BEE2CE0F
Software\ExplorerPatcher, xrefs: 00007FF8BEE2CD8A, 00007FF8BEE2CDD6, 00007FF8BEE2CE1B, 00007FF8BEE2CE6A
CrashCounterThreshold, xrefs: 00007FF8BEE2CE5E
CrashCounterDisabled, xrefs: 00007FF8BEE2CD7E
CrashCounter, xrefs: 00007FF8BEE2CDCA

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Value
String ID: CrashCounter$CrashCounterDisabled$CrashCounterThreshold$CrashThresholdTime$Software\ExplorerPatcher
API String ID: 3702945584-694238707
Opcode ID: b5187abff7cff12360a2aadd25fd6aa9536eda466c1bd5ed562ffc37d15f0430
Instruction ID: 6e98982e43afc93ac512c50c0210ca6235eef16a14cbeabe9b20bc77e99ac0cc
Opcode Fuzzy Hash: b5187abff7cff12360a2aadd25fd6aa9536eda466c1bd5ed562ffc37d15f0430
Instruction Fuzzy Hash: D6416DB2508B40CAE720CF58F4402997BB4FB857A4F904226EB9C07798DFBED145CB44

Function 00007FF8BEE527F0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 161COMMON

Download Yara Rule

Strings

failed to make trampoline, xrefs: 00007FF8BEE52873
Could not allocate memory near address %p, xrefs: 00007FF8BEE52928
failed to get page, xrefs: 00007FF8BEE52949
Could not modify already-installed funchook handle., xrefs: 00007FF8BEE5281D

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID: failed to get page$ failed to make trampoline$Could not allocate memory near address %p$Could not modify already-installed funchook handle.
API String ID: 0-2189554615
Opcode ID: 8698435a8b958e4643bd2e633bbc31b9c9ec2b6ca923fe9917008f672881973e
Instruction ID: a0585607d309958ea103abb791639521827845aeee2119c8eced18e626bf2bc7
Opcode Fuzzy Hash: 8698435a8b958e4643bd2e633bbc31b9c9ec2b6ca923fe9917008f672881973e
Instruction Fuzzy Hash: F1715262A19B868ADB60DF29E4402AA73B0FB49BC4F445036EF8E47759EF7CE545C700

Function 00007FF8BEE12890 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 64registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF8BEE128AF
GetProcAddress.KERNEL32 ref: 00007FF8BEE128C8
RegOpenKeyExW.KERNEL32 ref: 00007FF8BEE1293F
RegQueryValueExW.KERNEL32 ref: 00007FF8BEE1296F

Strings

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF8BEE128FD
ntdll.dll, xrefs: 00007FF8BEE128A8
RtlGetVersion, xrefs: 00007FF8BEE128BE
UBR, xrefs: 00007FF8BEE12958

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: AddressHandleModuleOpenProcQueryValue
String ID: RtlGetVersion$UBR$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion$ntdll.dll
API String ID: 3749297518-2374052841
Opcode ID: 138d03d2620e87957fa60c226b165fc95dbeabef36849e6ed6bd8574009bb8fd
Instruction ID: c0011d48d8e20e2164cbe1d2834c9fee664e278b7ac775e12e0ba1e1ac587dc7
Opcode Fuzzy Hash: 138d03d2620e87957fa60c226b165fc95dbeabef36849e6ed6bd8574009bb8fd
Instruction Fuzzy Hash: 39219371A19A428AEB50DB18E89127A73E0FF887C0F841136EB5D47795EF7CD144CB00

Function 00007FF8BEE537B0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 92memorywindowCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FF8BEE53823
GetLastError.KERNEL32 ref: 00007FF8BEE5385C
FormatMessageA.KERNEL32 ref: 00007FF8BEE5388D
GetLastError.KERNEL32 ref: 00007FF8BEE538D1

Strings

Failed to unprotect memory %p (size=%llu) <- %p (size=%llu, error=%lu(%s)), xrefs: 00007FF8BEE538DB
unprotect memory %p (size=%llu) <- %p (size=%llu), xrefs: 00007FF8BEE53831
Unknown Error, xrefs: 00007FF8BEE5389A

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ErrorLast$FormatMessageProtectVirtual
String ID: unprotect memory %p (size=%llu) <- %p (size=%llu)$Failed to unprotect memory %p (size=%llu) <- %p (size=%llu, error=%lu(%s))$Unknown Error
API String ID: 2888148163-2742179861
Opcode ID: 77621f6088311bb16b2a1a1736ac767bba04458eefaa33bc65850d377d01560e
Instruction ID: 1d542642f36f8b4266d670a84a021499fe8f3b69a8834d4a8c70504470e00a04
Opcode Fuzzy Hash: 77621f6088311bb16b2a1a1736ac767bba04458eefaa33bc65850d377d01560e
Instruction Fuzzy Hash: 4741A062A09B8689EB248F19F89037977A0FB49BC4F044136EB8D57798DF7CE455C700

Function 00007FF8BEE53930 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 68memorywindowCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FF8BEE53965
GetLastError.KERNEL32 ref: 00007FF8BEE53994
FormatMessageA.KERNEL32 ref: 00007FF8BEE539C5
GetLastError.KERNEL32 ref: 00007FF8BEE53A0F

Strings

Failed to protect memory %p (size=%llu, error=%lu(%s)), xrefs: 00007FF8BEE53A19
protect memory %p (size=%llu), xrefs: 00007FF8BEE53973
Unknown Error, xrefs: 00007FF8BEE539D2

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ErrorLast$FormatMessageProtectVirtual
String ID: protect memory %p (size=%llu)$Failed to protect memory %p (size=%llu, error=%lu(%s))$Unknown Error
API String ID: 2888148163-2522531280
Opcode ID: c5c763f95a8c7ad05ca221d15951da865442d1dedde559e9e1de8ae9c109cd39
Instruction ID: a17a282ce31fa31558457d4505e7e65a41361710c8d1f2bca89390c025824ca3
Opcode Fuzzy Hash: c5c763f95a8c7ad05ca221d15951da865442d1dedde559e9e1de8ae9c109cd39
Instruction Fuzzy Hash: 39314F6160CAC68AEB608B19E4503BAB7A0FB49BC8F044136DB8D57B99DFBCE445C740

Function 00007FF8BEE534A0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 67memorywindowCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FF8BEE534DA
GetLastError.KERNEL32 ref: 00007FF8BEE5350C
FormatMessageA.KERNEL32 ref: 00007FF8BEE5353D
GetLastError.KERNEL32 ref: 00007FF8BEE53581

Strings

protect page %p (size=%llu, prot=read,exec), xrefs: 00007FF8BEE534EB
Failed to protect page %p (size=%llu, prot=read,exec, error=%lu(%s)), xrefs: 00007FF8BEE5358E
Unknown Error, xrefs: 00007FF8BEE5354A

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ErrorLast$FormatMessageProtectVirtual
String ID: protect page %p (size=%llu, prot=read,exec)$Failed to protect page %p (size=%llu, prot=read,exec, error=%lu(%s))$Unknown Error
API String ID: 2888148163-3855186111
Opcode ID: 06213efa1661eafe047554ef56b97f22fd05762a321bc7c6cdb9fcd96fde09df
Instruction ID: 7eb5eb5da11f1118b8a460a05b4b04a05d789661a7ff595057a041e23d949aee
Opcode Fuzzy Hash: 06213efa1661eafe047554ef56b97f22fd05762a321bc7c6cdb9fcd96fde09df
Instruction Fuzzy Hash: 01319360A0CA868AFB608B59F8503BA67E0FB48BC4F440136DB8D57B99DFBCE544C700

Function 00007FF8BEE2AC20 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 50memorystringregistryCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 00007FF8BEE2AC58
VirtualProtect.KERNEL32 ref: 00007FF8BEE2AC75
lstrcpyW.KERNEL32 ref: 00007FF8BEE2AC89
VirtualProtect.KERNEL32 ref: 00007FF8BEE2ACA1
RegOpenKeyExW.KERNEL32 ref: 00007FF8BEE2ACB8

Strings

Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify, xrefs: 00007FF8BEE2AC48
Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB, xrefs: 00007FF8BEE2AC7F

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ProtectVirtual$Openlstrcmpilstrcpy
String ID: Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB$Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify
API String ID: 3588037206-2075971939
Opcode ID: e99585d31a0eb10509ab71d1ff8db9e99c385f03bc4c8402c0fab63be74c322f
Instruction ID: bb7dff48fa6747ea0cce7308e42daa1f585a6e95ac7ec68cbdf1a39ee91c213f
Opcode Fuzzy Hash: e99585d31a0eb10509ab71d1ff8db9e99c385f03bc4c8402c0fab63be74c322f
Instruction Fuzzy Hash: E2117061719B428AE7508F1ABC50A7A6761BB8AFD0F445035EE0E47B18DE7CE446C700

Function 00007FF8BEE5176C Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8BEE51794
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8BEE517E6
_RTC_Initialize.LIBCMT ref: 00007FF8BEE51814
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8BEE5183A
__scrt_release_startup_lock.LIBCMT ref: 00007FF8BEE51865

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: db39cd3f2f16f5343a8e4e09a2e3fed93350a9b5ce6b027fd328810dc9bbf990
Instruction ID: 8be5c8ade655b895781a0a272d9fb4ca835574dd0aece9599a1de6cc64e61468
Opcode Fuzzy Hash: db39cd3f2f16f5343a8e4e09a2e3fed93350a9b5ce6b027fd328810dc9bbf990
Instruction Fuzzy Hash: 0581A0A1E0CA4B8EFA60AB6DA4A12B966D0AF457C0F144435FB0D47797DEFCF9458301

Function 00007FF8BEE1D290 Relevance: 12.1, APIs: 8, Instructions: 118memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF8BEE1D2C6
ImageDirectoryEntryToDataEx.DBGHELP ref: 00007FF8BEE1D2F9
FreeLibrary.KERNEL32 ref: 00007FF8BEE1D32F
FreeLibrary.KERNEL32 ref: 00007FF8BEE1D3B9
VirtualQuery.KERNEL32 ref: 00007FF8BEE1D3F8
VirtualProtect.KERNEL32 ref: 00007FF8BEE1D413
VirtualProtect.KERNEL32 ref: 00007FF8BEE1D43B
FreeLibrary.KERNEL32 ref: 00007FF8BEE1D446

Part of subcall function 00007FF8BEE6A364: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE6A381

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: FreeLibraryVirtual$Protect$DataDirectoryEntryHandleImageModuleQuery_invalid_parameter_noinfo
String ID:
API String ID: 3041990818-0
Opcode ID: 682e78e4db77ee8b47885a981a1b213cddc3e3f46b588dca37eddaf2f5718b7c
Instruction ID: 73b41f1a733ef29fdda8c59fd870e5fe81443528741b881eccdb65f9d694889f
Opcode Fuzzy Hash: 682e78e4db77ee8b47885a981a1b213cddc3e3f46b588dca37eddaf2f5718b7c
Instruction Fuzzy Hash: F8515272B1D6428AEB909F2AE59037F63A0FB85BC5F445035EB4E87798DE7CE4848701

Function 00007FF8BEE39E43 Relevance: 10.7, APIs: 7, Instructions: 165registrysynchronizationCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00007FF8BEE39ED4
RegCreateKeyExW.KERNEL32 ref: 00007FF8BEE39F37
RegNotifyChangeKeyValue.KERNEL32 ref: 00007FF8BEE39F68
WaitForMultipleObjects.KERNEL32 ref: 00007FF8BEE39F8F
WaitForSingleObject.KERNEL32 ref: 00007FF8BEE39FD9
CloseHandle.KERNEL32 ref: 00007FF8BEE3A039
RegCloseKey.ADVAPI32 ref: 00007FF8BEE3A04F

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CloseCreateWait$ChangeEventHandleMultipleNotifyObjectObjectsSingleValue
String ID:
API String ID: 3111792343-0
Opcode ID: e950b941e2b3aeec993550c333e84e614fc6404132692e977b1ab77bf58c0bb6
Instruction ID: d9ed4c82a3044965a5a0b35fce854d0646139ffed4ade9242cc2938a855f2d38
Opcode Fuzzy Hash: e950b941e2b3aeec993550c333e84e614fc6404132692e977b1ab77bf58c0bb6
Instruction Fuzzy Hash: C661C032715A418AEB15CB69E49477967A1FB84BC4F088235CF5E477A8DF7DE882C700

Function 00007FF8BEE1D460 Relevance: 7.6, APIs: 5, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF8BEE1D494
FreeLibrary.KERNEL32 ref: 00007FF8BEE1D5BB

Part of subcall function 00007FF8BEE6A364: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE6A381

VirtualProtect.KERNEL32 ref: 00007FF8BEE1D538
VirtualProtect.KERNEL32 ref: 00007FF8BEE1D55B
FreeLibrary.KERNEL32 ref: 00007FF8BEE1D566

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: FreeLibraryProtectVirtual$HandleModule_invalid_parameter_noinfo
String ID:
API String ID: 172810297-0
Opcode ID: ce3db9a925f55ecbca5daaa1c5a6bf37ef528cf5e4f8c2f8d563e78c92f4414f
Instruction ID: 53c4eccb140bad0836316d26d7ba8b6813d6020c9bff3f486cb2bf1dcc61704e
Opcode Fuzzy Hash: ce3db9a925f55ecbca5daaa1c5a6bf37ef528cf5e4f8c2f8d563e78c92f4414f
Instruction Fuzzy Hash: 25415E62B08A418AEB64CF19E49073A67A1FF89BD9F044035EF8D47B58DE7CE480CB00

Function 00007FF8BEE2C050 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF8BEE2C087
GetProcAddress.KERNEL32 ref: 00007FF8BEE2C097

Strings

win32u.dll, xrefs: 00007FF8BEE2C080
NtUserFindWindowEx, xrefs: 00007FF8BEE2C090

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtUserFindWindowEx$win32u.dll
API String ID: 1646373207-2703420062
Opcode ID: e4bd7934b399dbc79271bff89f1285f6fc833ff83cee651dc7fb117a3296fabf
Instruction ID: adcc9a781b02b1356204afeb40e78c8dc68d57c5acc172fabffc372c08ac61ac
Opcode Fuzzy Hash: e4bd7934b399dbc79271bff89f1285f6fc833ff83cee651dc7fb117a3296fabf
Instruction Fuzzy Hash: 6E01AD25A08B4589E600CF1AF88042AB7A0FB85BD0F500535DF8D47768DEBCE4428B40

Function 00007FF8BEE2D550 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20registryCOMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 00007FF8BEE2D563
RegSetKeyValueW.KERNELBASE ref: 00007FF8BEE2D59E

Strings

Software\ExplorerPatcher, xrefs: 00007FF8BEE2D590
CrashCounter, xrefs: 00007FF8BEE2D581

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: SleepValue
String ID: CrashCounter$Software\ExplorerPatcher
API String ID: 1540188156-2892006628
Opcode ID: 8932f61db9e237cb56b2e6419a0636596f1e2fb8941f83692bf55bde4ec60dd6
Instruction ID: 9cd5e24844fe0fec85717ba301c7e566dce543db9df7cc122de0e8b09b4868cb
Opcode Fuzzy Hash: 8932f61db9e237cb56b2e6419a0636596f1e2fb8941f83692bf55bde4ec60dd6
Instruction Fuzzy Hash: 01F082B5A29B8189EB50DB14F49035A37A0FF887E4F801235E74E06768DF7CD145CB00

Function 00007FF8BEE52270 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00007FF8BEE5224B,?,?,00000000,00007FF8BEE21EA7), ref: 00007FF8BEE52355
FlushInstructionCache.KERNEL32(?,00007FF8BEE5224B,?,?,00000000,00007FF8BEE21EA7), ref: 00007FF8BEE52364

Strings

Patched Instructions:, xrefs: 00007FF8BEE52373

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcess
String ID: Patched Instructions:
API String ID: 2564211676-4020029282
Opcode ID: ed4c4f6c62a2f8c717e28cde53f487d8b1a712bfc88bbde7716ad91db4ce9ee1
Instruction ID: dfed38d51b1ae28ee21983f0983c6c6d991bb7b55ac54966e1f6f6d427660cac
Opcode Fuzzy Hash: ed4c4f6c62a2f8c717e28cde53f487d8b1a712bfc88bbde7716ad91db4ce9ee1
Instruction Fuzzy Hash: D6415EA2A18A8689EB60DB29E4413BA77E4FB48BC4F405031DF4D57B59EFBCE405C744

Function 00007FF8BEE509E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,?,?,?,?,?,?,00007FF8BEE1E4B6), ref: 00007FF8BEE50A1D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00007FF8BEE1E4B6), ref: 00007FF8BEE50A31

Strings

Software\Classes\CLSID\{2CC5CA98-6485-489A-920E-B3E88A6CCCE3}, xrefs: 00007FF8BEE50A0F

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Classes\CLSID\{2CC5CA98-6485-489A-920E-B3E88A6CCCE3}
API String ID: 47109696-1447196730
Opcode ID: 63e2e3eee6d020e2cd3f80c23a1dc357a0f66dbddb58984caf15a9489333853d
Instruction ID: b26ef0f23742240f82feb7effc4b6f1c4d4d5eb206a1a19084f1d76c7b28bbbb
Opcode Fuzzy Hash: 63e2e3eee6d020e2cd3f80c23a1dc357a0f66dbddb58984caf15a9489333853d
Instruction Fuzzy Hash: 87F05B71729B4586EB504B29F8D156673A4FF447D4F802135FA4E46758EF6CD0558700

Function 00007FF8BEE1F230 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27registryCOMMON

Download Yara Rule

APIs

RegGetValueW.KERNEL32 ref: 00007FF8BEE1F287

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher, xrefs: 00007FF8BEE1F26A
XamlSounds, xrefs: 00007FF8BEE1F257

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Value
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher$XamlSounds
API String ID: 3702945584-1822384862
Opcode ID: 97a367034ec62005128dc975c952e63d6e4a6bcd7d34eb2bbcb373900e4ece20
Instruction ID: c4dca3edee946dcb82c75e18904a64c1919758dac597efe67833b1334b65a43e
Opcode Fuzzy Hash: 97a367034ec62005128dc975c952e63d6e4a6bcd7d34eb2bbcb373900e4ece20
Instruction Fuzzy Hash: CAF06272618B4186EB108F18F48019A77B4FB89784FD0123AE78C07B98EF7DD554CB00

Function 00007FF8BEE6DDEC Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,834800000B7CE800,00007FF8BEE7764A,?,?,?,00007FF8BEE77687,?,?,00000000,00007FF8BEE75669,?,?,00007FF8BEE6D14A,00007FF8BEE7559B), ref: 00007FF8BEE6DE02
GetLastError.KERNEL32(?,?,834800000B7CE800,00007FF8BEE7764A,?,?,?,00007FF8BEE77687,?,?,00000000,00007FF8BEE75669,?,?,00007FF8BEE6D14A,00007FF8BEE7559B), ref: 00007FF8BEE6DE0C

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: a6678511dc5ac773f7913335461e1c2c7be48ef586cd0cba9a917b621943f4cf
Instruction ID: 4392f04f9fbe06cfc3dff60108ec902815be1239905467e5bfcbe639647a08df
Opcode Fuzzy Hash: a6678511dc5ac773f7913335461e1c2c7be48ef586cd0cba9a917b621943f4cf
Instruction Fuzzy Hash: 04E0C250F1A6428EFF287FFA68840752260EFA87C1F404034CB0D47361DFACB8554200

Function 00007FF8BEE51568 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8BEE5157C

Part of subcall function 00007FF8BEE5AB58: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF8BEE5AB60
Part of subcall function 00007FF8BEE5AB58: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF8BEE5AB65

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: 9ff4ce4781127c8bc802118fd2a34e64d87eed5673847b4679c47d8435940bb9
Instruction ID: a7500f9759f2355ac1d62cce856ab8c3ea62eff3f29f6cc29f86ad680aa9b8ea
Opcode Fuzzy Hash: 9ff4ce4781127c8bc802118fd2a34e64d87eed5673847b4679c47d8435940bb9
Instruction Fuzzy Hash: A5E0ECD4D0DE4B5DFEA83A6D25622B913C01F2A3C4F5001B5FB0F021C3AEED705A9162

Function 00007FF8BEE6DD74 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF8BEE7046A,?,?,00004B6BF894E032,00007FF8BEE6C0D9,?,?,?,?,00007FF8BEE706D2,?,?,00000000), ref: 00007FF8BEE6DDC9

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: e578c43444c32e6720132160586d7cc94147cb681874c574235c8713629e0420
Instruction ID: 91ef33e1914bd0a910e6e7a40af14d491c601a399b5c86cc0abdae37646e6e2a
Opcode Fuzzy Hash: e578c43444c32e6720132160586d7cc94147cb681874c574235c8713629e0420
Instruction Fuzzy Hash: B5F06D40B0960B8DFE987E6A99503B962806F59BC0F8C5131CF0E863D6EFDCF4809250

Function 00007FF8BEE6E630 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF8BEE706B9,?,?,00000000,00007FF8BEE750A7,?,?,?,00007FF8BEE6CE73,?,?,?,00007FF8BEE6CD69), ref: 00007FF8BEE6E66E

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 32244fcb8596d69c427d8a13f20aa17588a93e41e7ee2a9feca6fe38006fab21
Instruction ID: 9b48eb903abfa897e92c609a5f39577d809c036793a1289ed557fed7cb84bb4a
Opcode Fuzzy Hash: 32244fcb8596d69c427d8a13f20aa17588a93e41e7ee2a9feca6fe38006fab21
Instruction Fuzzy Hash: 7FF08C00F0D6068DFF542EA9698027966819F847E4F080234DF2F863E5DEECF6818520

Non-executed Functions

Function 00007FF8BEE17B50 Relevance: 180.1, APIs: 97, Strings: 5, Instructions: 1573timewindowkeyboardCOMMON

Download Yara Rule

APIs

SetWindowLongPtrW.USER32 ref: 00007FF8BEE17BAE
SetTimer.USER32 ref: 00007FF8BEE17BC5
GetWindow.USER32 ref: 00007FF8BEE17C18
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8BEE17C47
#339.COMCTL32 ref: 00007FF8BEE17C74
GetForegroundWindow.USER32 ref: 00007FF8BEE17C87
#334.COMCTL32 ref: 00007FF8BEE17CD2
GetWindowLongPtrW.USER32 ref: 00007FF8BEE17D56
GetAsyncKeyState.USER32 ref: 00007FF8BEE17D89
KillTimer.USER32 ref: 00007FF8BEE17DA6
KillTimer.USER32 ref: 00007FF8BEE17DC6
SendMessageW.USER32 ref: 00007FF8BEE17DE9
KillTimer.USER32 ref: 00007FF8BEE17DF6
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8BEE17E5A
#339.COMCTL32 ref: 00007FF8BEE17E89
GetWindow.USER32 ref: 00007FF8BEE17EB7
GetLastActivePopup.USER32 ref: 00007FF8BEE17EC7
KillTimer.USER32 ref: 00007FF8BEE17F47
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8BEE1804A
#339.COMCTL32 ref: 00007FF8BEE18077
DefWindowProcW.USER32 ref: 00007FF8BEE1883B
IsWindowVisible.USER32 ref: 00007FF8BEE1885F
GetPropW.USER32 ref: 00007FF8BEE188A1
GetPropW.USER32 ref: 00007FF8BEE188B6
#328.COMCTL32 ref: 00007FF8BEE188DA
EnumWindows.USER32 ref: 00007FF8BEE188ED
#329.COMCTL32 ref: 00007FF8BEE1897D
CompareStringOrdinal.KERNEL32 ref: 00007FF8BEE189B5
DestroyWindow.USER32 ref: 00007FF8BEE189DA
PostQuitMessage.USER32 ref: 00007FF8BEE189ED
SetEvent.KERNEL32 ref: 00007FF8BEE189FA
KillTimer.USER32 ref: 00007FF8BEE18A1D
KillTimer.USER32 ref: 00007FF8BEE18A2B
SystemParametersInfoW.USER32 ref: 00007FF8BEE18A5B
SystemParametersInfoW.USER32 ref: 00007FF8BEE18A9E
SystemParametersInfoW.USER32 ref: 00007FF8BEE18AC7
RedrawWindow.USER32 ref: 00007FF8BEE18C7B
ShowWindow.USER32 ref: 00007FF8BEE18D18
GetKeyState.USER32 ref: 00007FF8BEE18D77
IsWindowVisible.USER32 ref: 00007FF8BEE18EB3
GetWindow.USER32 ref: 00007FF8BEE18F41
IsWindowVisible.USER32 ref: 00007FF8BEE18F52
GetKeyState.USER32 ref: 00007FF8BEE18FD4
RedrawWindow.USER32 ref: 00007FF8BEE192E2
SetForegroundWindow.USER32 ref: 00007FF8BEE192EC
IsHungAppWindow.USER32 ref: 00007FF8BEE1940E
ShowWindow.USER32 ref: 00007FF8BEE1941E
GetCurrentThreadId.KERNEL32 ref: 00007FF8BEE1943D
GetThreadDesktop.USER32 ref: 00007FF8BEE19445
SHCreateThread.SHLWAPI ref: 00007FF8BEE19462
EndTask.USER32 ref: 00007FF8BEE1947C
PostMessageW.USER32 ref: 00007FF8BEE19495

Strings

ImmersiveColorSet, xrefs: 00007FF8BEE189A8
\rundll32.exe, xrefs: 00007FF8BEE1866D
valinet.ExplorerPatcher.ShellManagedWindow, xrefs: 00007FF8BEE188AC
Microsoft.Windows.ShellManagedWindowAsNormalWindow, xrefs: 00007FF8BEE18897
&, xrefs: 00007FF8BEE1911F

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Window$Timer$KillSystemTime$#339FileInfoMessageParametersStateThreadVisible$ForegroundLongPostPropRedrawShow$#328#329#334ActiveAsyncCompareCreateCurrentDesktopDestroyEnumEventHungLastOrdinalPopupProcQuitSendStringTaskWindows
String ID: &$ImmersiveColorSet$Microsoft.Windows.ShellManagedWindowAsNormalWindow$\rundll32.exe$valinet.ExplorerPatcher.ShellManagedWindow
API String ID: 1047848470-551150430
Opcode ID: 5ea5d6b7ec779afa1acab4212b65c5d61fb9129dcb8deb0b8248f5ca86f2707b
Instruction ID: de289680f65498aad2a5be674a2b1980634899d42cb148da90094a38db7679a7
Opcode Fuzzy Hash: 5ea5d6b7ec779afa1acab4212b65c5d61fb9129dcb8deb0b8248f5ca86f2707b
Instruction Fuzzy Hash: A1E29F71A096468AEBA88F29D58437A77A1FB49BC0F044235DB1E47790DFBCE8D1C742

Function 00007FF8BEE47010 Relevance: 149.6, APIs: 75, Strings: 10, Instructions: 867windowregistryCOMMON

Download Yara Rule

APIs

RegisterWindowMessageW.USER32 ref: 00007FF8BEE47057
GetClassWord.USER32 ref: 00007FF8BEE47093
RegisterWindowMessageW.USER32 ref: 00007FF8BEE470B7
GetParent.USER32 ref: 00007FF8BEE470C6
GetClassWord.USER32 ref: 00007FF8BEE470D7
GetPropW.USER32 ref: 00007FF8BEE47114
RemovePropW.USER32 ref: 00007FF8BEE47129
GetParent.USER32 ref: 00007FF8BEE47147
GetParent.USER32 ref: 00007FF8BEE47155
FindWindowExW.USER32 ref: 00007FF8BEE4716D
GetWindowLongPtrW.USER32 ref: 00007FF8BEE4717D
FindWindowExW.USER32 ref: 00007FF8BEE471BB
FindWindowExW.USER32 ref: 00007FF8BEE471D3
GetClientRect.USER32 ref: 00007FF8BEE47240
FindWindowExW.USER32 ref: 00007FF8BEE47263
IsWindowVisible.USER32 ref: 00007FF8BEE47288
GetClientRect.USER32 ref: 00007FF8BEE47299
FindWindowExW.USER32 ref: 00007FF8BEE472CF
GetWindowRect.USER32 ref: 00007FF8BEE472F7
MonitorFromWindow.USER32 ref: 00007FF8BEE4731D
GetMonitorInfoW.USER32 ref: 00007FF8BEE4732A
GetPropW.USER32 ref: 00007FF8BEE47354
SetWindowPos.USER32 ref: 00007FF8BEE473BA
GetClientRect.USER32 ref: 00007FF8BEE473C7
FindWindowExW.USER32 ref: 00007FF8BEE473F9
IsWindowVisible.USER32 ref: 00007FF8BEE4741F
GetClientRect.USER32 ref: 00007FF8BEE47430
MoveWindow.USER32 ref: 00007FF8BEE47465
InvalidateRect.USER32 ref: 00007FF8BEE4747B
FindWindowExW.USER32 ref: 00007FF8BEE474A8
SetWindowPos.USER32 ref: 00007FF8BEE474DE
GetClientRect.USER32 ref: 00007FF8BEE474EB
FindWindowExW.USER32 ref: 00007FF8BEE4751D
IsWindowVisible.USER32 ref: 00007FF8BEE4753E
GetClientRect.USER32 ref: 00007FF8BEE4754F
MoveWindow.USER32 ref: 00007FF8BEE47583
InvalidateRect.USER32 ref: 00007FF8BEE47594
FindWindowExW.USER32 ref: 00007FF8BEE475BA
InvalidateRect.USER32 ref: 00007FF8BEE475EC
GetClientRect.USER32 ref: 00007FF8BEE47613
GetClientRect.USER32 ref: 00007FF8BEE47625
GetWindowRect.USER32 ref: 00007FF8BEE47632
GetClientRect.USER32 ref: 00007FF8BEE47667
SetWindowPos.USER32 ref: 00007FF8BEE477BB
GetClientRect.USER32 ref: 00007FF8BEE477C8
FindWindowExW.USER32 ref: 00007FF8BEE477FA
IsWindowVisible.USER32 ref: 00007FF8BEE4782F
GetClientRect.USER32 ref: 00007FF8BEE47840
MoveWindow.USER32 ref: 00007FF8BEE47873
InvalidateRect.USER32 ref: 00007FF8BEE47889
FindWindowExW.USER32 ref: 00007FF8BEE478BA
SetWindowPos.USER32 ref: 00007FF8BEE47900
GetClientRect.USER32 ref: 00007FF8BEE4790D
FindWindowExW.USER32 ref: 00007FF8BEE4793F
IsWindowVisible.USER32 ref: 00007FF8BEE4795E
GetClientRect.USER32 ref: 00007FF8BEE4796F
MoveWindow.USER32 ref: 00007FF8BEE479A6
InvalidateRect.USER32 ref: 00007FF8BEE479B7
FindWindowExW.USER32 ref: 00007FF8BEE479E4
InvalidateRect.USER32 ref: 00007FF8BEE47A12
RegisterWindowMessageW.USER32 ref: 00007FF8BEE47A43
SendMessageW.USER32 ref: 00007FF8BEE47A91
GetClassWord.USER32 ref: 00007FF8BEE47AA0
SendMessageW.USER32 ref: 00007FF8BEE47ADB
SendMessageW.USER32 ref: 00007FF8BEE47B47
GetClassWord.USER32 ref: 00007FF8BEE47B5B
SendMessageW.USER32 ref: 00007FF8BEE47B8D
SendMessageW.USER32 ref: 00007FF8BEE47BBF
SendNotifyMessageW.USER32 ref: 00007FF8BEE47BE2
SendMessageW.USER32 ref: 00007FF8BEE47BF6
SendMessageW.USER32 ref: 00007FF8BEE47C55
GetClassWord.USER32 ref: 00007FF8BEE47C69
GetClientRect.USER32 ref: 00007FF8BEE47C92
SendMessageW.USER32 ref: 00007FF8BEE47CCB
GetClientRect.USER32 ref: 00007FF8BEE47CE6

Strings

MSTaskListWClass, xrefs: 00007FF8BEE47050
TraySettings, xrefs: 00007FF8BEE47BCE
Start, xrefs: 00007FF8BEE4715E
!@, xrefs: 00007FF8BEE4778B
MSTaskSwWClass, xrefs: 00007FF8BEE470B0
TrayButton, xrefs: 00007FF8BEE4724D, 00007FF8BEE47271, 00007FF8BEE473D1, 00007FF8BEE47410, 00007FF8BEE47500, 00007FF8BEE477D2, 00007FF8BEE47820, 00007FF8BEE478A4, 00007FF8BEE47922
EPTBLEN, xrefs: 00007FF8BEE4710A, 00007FF8BEE4711F, 00007FF8BEE4734A
ReBarWindow32, xrefs: 00007FF8BEE471AF
TrayDummySearchControl, xrefs: 00007FF8BEE47229, 00007FF8BEE47278, 00007FF8BEE473DC, 00007FF8BEE4748A, 00007FF8BEE474F5, 00007FF8BEE4752F, 00007FF8BEE477DD, 00007FF8BEE47898, 00007FF8BEE47917, 00007FF8BEE479C6
PeopleBand, xrefs: 00007FF8BEE471C4, 00007FF8BEE47A3C

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Window$Rect$Client$Find$Message$Send$Invalidate$ClassVisibleWord$Move$ParentPropRegister$Monitor$FromInfoLongNotifyRemove
String ID: !@$EPTBLEN$MSTaskListWClass$MSTaskSwWClass$PeopleBand$ReBarWindow32$Start$TrayButton$TrayDummySearchControl$TraySettings
API String ID: 2509908205-217918233
Opcode ID: df11b95f88c1c0d937a37726a203e0aab8b3c820706bcc3d3b8b3aecafb5995a
Instruction ID: 88b6b37a35f2737f217b08485c2e24aaa24cb82b679e37214ddb6c208ade2736
Opcode Fuzzy Hash: df11b95f88c1c0d937a37726a203e0aab8b3c820706bcc3d3b8b3aecafb5995a
Instruction Fuzzy Hash: D5826C36A096428EE710CF39E8846A97BA1FB89BC8F444235DF4967B58DFBCE5448740

Function 00007FF8BEE16F20 Relevance: 117.9, APIs: 64, Strings: 3, Instructions: 685windowtimeregistryCOMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32 ref: 00007FF8BEE16F60
QueryPerformanceCounter.KERNEL32 ref: 00007FF8BEE16F6F
GetTickCount.KERNEL32 ref: 00007FF8BEE16F87
SetRect.USER32 ref: 00007FF8BEE16FB4
IsWindow.USER32 ref: 00007FF8BEE16FC1
GetWindowRect.USER32 ref: 00007FF8BEE16FD7
GetClassWord.USER32 ref: 00007FF8BEE16FE9
RegisterWindowMessageW.USER32 ref: 00007FF8BEE1700D
EnumWindows.USER32 ref: 00007FF8BEE1703B
#329.COMCTL32 ref: 00007FF8BEE17061
GetCursorPos.USER32 ref: 00007FF8BEE17082
IsWindowVisible.USER32 ref: 00007FF8BEE1709D
EnumDisplayMonitors.USER32 ref: 00007FF8BEE170C3
MonitorFromPoint.USER32 ref: 00007FF8BEE170E7
#328.COMCTL32 ref: 00007FF8BEE171C5
EnumWindows.USER32 ref: 00007FF8BEE171D8
QueryPerformanceFrequency.KERNEL32 ref: 00007FF8BEE171E3
QueryPerformanceCounter.KERNEL32 ref: 00007FF8BEE171F2
GetTickCount.KERNEL32 ref: 00007FF8BEE1720A
#339.COMCTL32 ref: 00007FF8BEE17249
QueryPerformanceFrequency.KERNEL32 ref: 00007FF8BEE17284
QueryPerformanceCounter.KERNEL32 ref: 00007FF8BEE17293
GetTickCount.KERNEL32 ref: 00007FF8BEE172AA
#338.COMCTL32 ref: 00007FF8BEE172C7
QueryPerformanceFrequency.KERNEL32 ref: 00007FF8BEE172D1
QueryPerformanceCounter.KERNEL32 ref: 00007FF8BEE172DF
GetTickCount.KERNEL32 ref: 00007FF8BEE172F5
GetWindowThreadProcessId.USER32 ref: 00007FF8BEE17353
GetLastError.KERNEL32 ref: 00007FF8BEE1735D
OpenProcess.KERNEL32 ref: 00007FF8BEE17382
K32GetModuleFileNameExW.KERNEL32 ref: 00007FF8BEE1739F
CloseHandle.KERNEL32 ref: 00007FF8BEE173A8
#386.COMCTL32 ref: 00007FF8BEE17431
QueryPerformanceFrequency.KERNEL32 ref: 00007FF8BEE1743B
QueryPerformanceCounter.KERNEL32 ref: 00007FF8BEE1744A
GetTickCount.KERNEL32 ref: 00007FF8BEE17464

Part of subcall function 00007FF8BEE142C0: IsWindowVisible.USER32 ref: 00007FF8BEE14329
Part of subcall function 00007FF8BEE142C0: QueryPerformanceFrequency.KERNEL32 ref: 00007FF8BEE14355
Part of subcall function 00007FF8BEE142C0: QueryPerformanceCounter.KERNEL32 ref: 00007FF8BEE14364
Part of subcall function 00007FF8BEE142C0: GetForegroundWindow.USER32(?), ref: 00007FF8BEE14393
Part of subcall function 00007FF8BEE142C0: GetWindow.USER32 ref: 00007FF8BEE143A4
Part of subcall function 00007FF8BEE142C0: IsWindowVisible.USER32 ref: 00007FF8BEE143B5
Part of subcall function 00007FF8BEE142C0: QueryPerformanceFrequency.KERNEL32 ref: 00007FF8BEE14416
Part of subcall function 00007FF8BEE142C0: QueryPerformanceCounter.KERNEL32 ref: 00007FF8BEE14425
Part of subcall function 00007FF8BEE142C0: QueryPerformanceFrequency.KERNEL32(?), ref: 00007FF8BEE1445B
Part of subcall function 00007FF8BEE142C0: QueryPerformanceCounter.KERNEL32 ref: 00007FF8BEE1446A

ShowWindow.USER32 ref: 00007FF8BEE174E4
EndBufferedPaint.UXTHEME ref: 00007FF8BEE17502
ReleaseDC.USER32 ref: 00007FF8BEE17513
GetDC.USER32 ref: 00007FF8BEE1752C
SetRect.USER32 ref: 00007FF8BEE17575
BeginBufferedPaint.UXTHEME ref: 00007FF8BEE1759D
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8BEE175FA
#339.COMCTL32 ref: 00007FF8BEE1762A
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8BEE176A4
#339.COMCTL32 ref: 00007FF8BEE176D3
DwmUpdateThumbnailProperties.DWMAPI ref: 00007FF8BEE1775A
IsWindowVisible.USER32 ref: 00007FF8BEE1776B
DwmSetWindowAttribute.DWMAPI ref: 00007FF8BEE17799
SetEvent.KERNEL32 ref: 00007FF8BEE177A6
DwmSetWindowAttribute.DWMAPI ref: 00007FF8BEE177C7
SetEvent.KERNEL32 ref: 00007FF8BEE177E4
SetWindowPos.USER32 ref: 00007FF8BEE1780E
ShowWindow.USER32 ref: 00007FF8BEE1781D
SetForegroundWindow.USER32 ref: 00007FF8BEE17827
InvalidateRect.USER32 ref: 00007FF8BEE17858

Part of subcall function 00007FF8BEE68004: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE68021

GetSystemDirectoryW.KERNEL32 ref: 00007FF8BEE178BF
QueryPerformanceFrequency.KERNEL32 ref: 00007FF8BEE1794E
QueryPerformanceCounter.KERNEL32 ref: 00007FF8BEE1795D
GetTickCount.KERNEL32 ref: 00007FF8BEE17974
IsHungAppWindow.USER32 ref: 00007FF8BEE179AC
SetTimer.USER32 ref: 00007FF8BEE179C8
SendMessageCallbackW.USER32 ref: 00007FF8BEE179ED
SetTimer.USER32 ref: 00007FF8BEE17A42

Strings

\rundll32.exe, xrefs: 00007FF8BEE178C5
WorkerW, xrefs: 00007FF8BEE17006
[sws] WindowSwitcher::Show %x [[ %lld + %lld + %lld + %lld = %lld ]], xrefs: 00007FF8BEE174A5

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: PerformanceQuery$Window$CounterFrequency$CountTick$RectTimeVisible$#339EnumFileSystem$AttributeBufferedEventForegroundMessagePaintProcessShowTimerWindows$#328#329#338#386BeginCallbackClassCloseCursorDirectoryDisplayErrorFromHandleHungInvalidateLastModuleMonitorMonitorsNameOpenPointPropertiesRegisterReleaseSendThreadThumbnailUpdateWord_invalid_parameter_noinfo
String ID: WorkerW$[sws] WindowSwitcher::Show %x [[ %lld + %lld + %lld + %lld = %lld ]]$\rundll32.exe
API String ID: 3472475047-3998000322
Opcode ID: e327f96872e015b853de3b058e537f335c508d4a14a0122e6e260d717f3477a2
Instruction ID: 72852d239b64509507c6df5b9469f4bf1413fe57b9efdee8637185af6bbd64fe
Opcode Fuzzy Hash: e327f96872e015b853de3b058e537f335c508d4a14a0122e6e260d717f3477a2
Instruction Fuzzy Hash: 7A726E32A09B428AE790DF69E48426E77A0FB89BC4F140235DB4D577A8DFBCE585C701

Function 00007FF8BEE4DF40 Relevance: 98.2, APIs: 7, Strings: 49, Instructions: 183registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BEE67E1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE67E45

RegCreateKeyExW.ADVAPI32 ref: 00007FF8BEE4E020
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE4E069
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE4E0E7
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE4E138
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE4E169
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE4E1BB
RegCloseKey.ADVAPI32 ref: 00007FF8BEE4E1E8

Part of subcall function 00007FF8BEE4DF40: CreateEventW.KERNEL32 ref: 00007FF8BEE4C892
Part of subcall function 00007FF8BEE4DF40: WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE4C8D1
Part of subcall function 00007FF8BEE4DF40: WindowsCreateString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE4C8FB
Part of subcall function 00007FF8BEE4DF40: InternetOpenA.WININET ref: 00007FF8BEE4C93F
Part of subcall function 00007FF8BEE4DF40: WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE4C95F
Part of subcall function 00007FF8BEE4DF40: InternetOpenUrlW.WININET ref: 00007FF8BEE4C982

Strings

[Updates] Checking against hash "%s", xrefs: 00007FF8BEE4DFD4
runas, xrefs: 00007FF8BEE4D7E4
ExplorerPatcher, xrefs: 00007FF8BEE4D782
https://api.github.com/repos/valinet/ExplorerPatcher/releases?per_page=1, xrefs: 00007FF8BEE4E177, 00007FF8BEE4E1CE
[Updates] Downloaded finished., xrefs: 00007FF8BEE4D3E5
iex (irm 'https://raw.githubusercontent.com/valinet/ep_make/master/ep_make_safe.ps1'), xrefs: 00007FF8BEE4D800
\Update for ExplorerPatcher from , xrefs: 00007FF8BEE4D14C
[Updates] Local version obtained from hash is %d.%d.%d.%d., xrefs: 00007FF8BEE4CEEA
[Updates] Update URL: %s, xrefs: 00007FF8BEE4E1F2
UpdateURLStaging, xrefs: 00007FF8BEE4E19E
UpdatePreferStaging, xrefs: 00007FF8BEE4E14C
[Updates] Failed. Read %d bytes., xrefs: 00007FF8BEE4D0BC
[Updates] In order to install this update for the product "ExplorerPatcher", please allow the request., xrefs: 00007FF8BEE4D41A
https://github.com/valinet/ExplorerPatcher/releases/latest, xrefs: 00007FF8BEE4DFBC, 00007FF8BEE4E07C, 00007FF8BEE4E0F9
UpdateURL, xrefs: 00007FF8BEE4E053, 00007FF8BEE4E0CE
\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00007FF8BEE4D2B3
ConsentPromptBehaviorAdmin, xrefs: 00007FF8BEE4D4BC
Software\ExplorerPatcher, xrefs: 00007FF8BEE4D029, 00007FF8BEE4D286, 00007FF8BEE4DFF8
\ExplorerPatcher, xrefs: 00007FF8BEE4D110
ep_setup.exe, xrefs: 00007FF8BEE4DC24, 00007FF8BEE4E0A6
kernel32.dll, xrefs: 00007FF8BEE4D46D
/download/, xrefs: 00007FF8BEE4E091
ExplorerPatcher, xrefs: 00007FF8BEE4C938, 00007FF8BEE4CC10
UpdateTimeout, xrefs: 00007FF8BEE4E11B
\ExplorerPatcher\ep_gui.dll, xrefs: 00007FF8BEE4D6E0
[Updates] Hash of remote file is "%s" (%s)., xrefs: 00007FF8BEE4CCF5
name, xrefs: 00007FF8BEE4DC94
open, xrefs: 00007FF8BEE4D7DD
[Updates] Prerelease update URL: "%s", xrefs: 00007FF8BEE4CB90
html_url, xrefs: 00007FF8BEE4DAEC
assets, xrefs: 00007FF8BEE4DB50
/update_silent, xrefs: 00007FF8BEE4D807
[Updates] Update successful, File Explorer will probably restart momentarily., xrefs: 00007FF8BEE4D878
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00007FF8BEE4D4C3, 00007FF8BEE4D64E
[Updates] Update failed because the request was denied., xrefs: 00007FF8BEE4D8D0
ExplorerPatcher_GUI_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FF8BEE4D76C
CheckElevationEnabled, xrefs: 00007FF8BEE4D47D
valid, xrefs: 00007FF8BEE4CCE1
updates.cpp, xrefs: 00007FF8BEE4D9FA, 00007FF8BEE4DA83, 00007FF8BEE4DABA, 00007FF8BEE4DB1A, 00007FF8BEE4DB7F, 00007FF8BEE4DBBA, 00007FF8BEE4DD6B, 00007FF8BEE4DE72, 00007FF8BEE4DE9A, 00007FF8BEE4DEC9
S-1-5-, xrefs: 00007FF8BEE4D5E2
[Updates] Release notes URL: "%s", xrefs: 00007FF8BEE4CB70
browser_download_url, xrefs: 00007FF8BEE4DE30
UpdateAllowDowngrades, xrefs: 00007FF8BEE4D022
invalid, xrefs: 00007FF8BEE4CCEA
[Updates] Update failed because the following error has occured: %d., xrefs: 00007FF8BEE4D8A2, 00007FF8BEE4D8EF
FilterAdministratorToken, xrefs: 00007FF8BEE4D647
UpdateUseLocal, xrefs: 00007FF8BEE4D27F
Windows.Data.Json.JsonArray, xrefs: 00007FF8BEE4D9AC
[Updates] Download path is "%s"., xrefs: 00007FF8BEE4D22C

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: QueryValue$CreateStringWindows$InternetOpen$BufferCloseDeleteEvent_invalid_parameter_noinfo
String ID: /download/$/update_silent$CheckElevationEnabled$ConsentPromptBehaviorAdmin$ExplorerPatcher$ExplorerPatcher$ExplorerPatcher_GUI_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}$FilterAdministratorToken$S-1-5-$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System$Software\ExplorerPatcher$UpdateAllowDowngrades$UpdatePreferStaging$UpdateTimeout$UpdateURL$UpdateURLStaging$UpdateUseLocal$Windows.Data.Json.JsonArray$[Updates] Checking against hash "%s"$[Updates] Download path is "%s".$[Updates] Downloaded finished.$[Updates] Failed. Read %d bytes.$[Updates] Hash of remote file is "%s" (%s).$[Updates] In order to install this update for the product "ExplorerPatcher", please allow the request.$[Updates] Local version obtained from hash is %d.%d.%d.%d.$[Updates] Prerelease update URL: "%s"$[Updates] Release notes URL: "%s"$[Updates] Update URL: %s$[Updates] Update failed because the following error has occured: %d.$[Updates] Update failed because the request was denied.$[Updates] Update successful, File Explorer will probably restart momentarily.$\ExplorerPatcher$\ExplorerPatcher\ep_gui.dll$\Update for ExplorerPatcher from $\WindowsPowerShell\v1.0\powershell.exe$assets$browser_download_url$ep_setup.exe$html_url$https://api.github.com/repos/valinet/ExplorerPatcher/releases?per_page=1$https://github.com/valinet/ExplorerPatcher/releases/latest$iex (irm 'https://raw.githubusercontent.com/valinet/ep_make/master/ep_make_safe.ps1')$invalid$kernel32.dll$name$open$runas$updates.cpp$valid
API String ID: 1866200-3143775457
Opcode ID: 040291f58ba558a885b2c0bcf4542b59f3c709bf8426a0f927b8f1bcb1741c4a
Instruction ID: 0b35d7a5ef7144b92745c868f407fb47b2a36b81ba6e431265911e76970abeeb
Opcode Fuzzy Hash: 040291f58ba558a885b2c0bcf4542b59f3c709bf8426a0f927b8f1bcb1741c4a
Instruction Fuzzy Hash: 38910C72A08A529EF7608FA8E8446EE77B0FB44398F501236DB4D57A68DF7CD549CB00

Function 00007FF8BEE19AA0 Relevance: 89.8, APIs: 43, Strings: 8, Instructions: 577registrycomsleepCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 00007FF8BEE19B67
RoInitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF8BEE19B87
CreateEventW.KERNEL32 ref: 00007FF8BEE19C22
GetLastError.KERNEL32 ref: 00007FF8BEE19C34
CreateThread.KERNEL32 ref: 00007FF8BEE19C6F
GetLastError.KERNEL32 ref: 00007FF8BEE19C81
CreateEventW.KERNEL32 ref: 00007FF8BEE19CB1
GetLastError.KERNEL32 ref: 00007FF8BEE19CC3
CreateThread.KERNEL32 ref: 00007FF8BEE19CFE
GetLastError.KERNEL32 ref: 00007FF8BEE19D10
#328.COMCTL32 ref: 00007FF8BEE19D38
GetLastError.KERNEL32 ref: 00007FF8BEE19D4A
EnumWindows.USER32 ref: 00007FF8BEE19D73
CreateSolidBrush.GDI32 ref: 00007FF8BEE19D96
CreateSolidBrush.GDI32 ref: 00007FF8BEE19DB3
CreateSolidBrush.GDI32 ref: 00007FF8BEE19DC5
CreateSolidBrush.GDI32 ref: 00007FF8BEE19DD7
OpenThemeData.UXTHEME ref: 00007FF8BEE19DED
RegisterWindowMessageW.USER32 ref: 00007FF8BEE19E2A
GetLastError.KERNEL32 ref: 00007FF8BEE19E37
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE19E90
LoadCursorW.USER32 ref: 00007FF8BEE19EAC
RegisterClassExW.USER32 ref: 00007FF8BEE19EBA
GetLastError.KERNEL32 ref: 00007FF8BEE19EC5
BufferedPaintInit.UXTHEME ref: 00007FF8BEE19F10
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE19F18
GetLastError.KERNEL32 ref: 00007FF8BEE19F72
SetWinEventHook.USER32 ref: 00007FF8BEE19FBB
GetLastError.KERNEL32 ref: 00007FF8BEE19FC6
RegisterShellHookWindow.USER32 ref: 00007FF8BEE1A00D
GetLastError.KERNEL32 ref: 00007FF8BEE1A017
CreateEventW.KERNEL32 ref: 00007FF8BEE1A044
GetLastError.KERNEL32 ref: 00007FF8BEE1A056
CoCreateInstance.OLE32 ref: 00007FF8BEE1A09B
GetWindowLongPtrW.USER32 ref: 00007FF8BEE1A0F0
CreateWindowExW.USER32 ref: 00007FF8BEE1A138
GetLastError.KERNEL32 ref: 00007FF8BEE1A14A
CoCreateInstance.OLE32 ref: 00007FF8BEE1A192
DwmSetWindowAttribute.DWMAPI ref: 00007FF8BEE1A370
Sleep.KERNEL32 ref: 00007FF8BEE1A3A3
Sleep.KERNEL32 ref: 00007FF8BEE1A3B7
EnumWindows.USER32 ref: 00007FF8BEE1A3CC
GetWindowRect.USER32 ref: 00007FF8BEE1A3E6

Strings

Grid_backgroundPercent, xrefs: 00007FF8BEE1A239
SHELLHOOK, xrefs: 00007FF8BEE19DF3
[sws] Wallpaper RECT %d %d %d %d, xrefs: 00007FF8BEE1A3EF
SimpleWindowSwitcher_{BEA057BB-66C7-4758-A610-FAE6013E9F98}, xrefs: 00007FF8BEE19E96
Static, xrefs: 00007FF8BEE1A107
ControlPanelStyle, xrefs: 00007FF8BEE19DDD
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MultitaskingView\AltTabViewHost, xrefs: 00007FF8BEE1A24E
, xrefs: 00007FF8BEE1A272

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CreateErrorLast$Window$BrushEventSolid$Register$EnumHandleHookInitializeInstanceModuleSleepThreadWindows$#328AttributeBufferedClassCursorDataInitLoadLongMessageOpenPaintRectShellTheme
String ID: $ControlPanelStyle$Grid_backgroundPercent$SHELLHOOK$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MultitaskingView\AltTabViewHost$SimpleWindowSwitcher_{BEA057BB-66C7-4758-A610-FAE6013E9F98}$Static$[sws] Wallpaper RECT %d %d %d %d
API String ID: 2117921315-4056204263
Opcode ID: 4f75617dc93189382ac3fef9dec2e945391e7ebfe1089fca1c2c852bd3cdda7b
Instruction ID: 72ab82c783293ad469b1fdd5faff0827a78a8ad759e9730d75dda22e9b7478e9
Opcode Fuzzy Hash: 4f75617dc93189382ac3fef9dec2e945391e7ebfe1089fca1c2c852bd3cdda7b
Instruction Fuzzy Hash: FA425C31B08B828AE7949B79A8547BA36E4FF44788F004139DB4D87795EFBDE4A4C701

Function 00007FF8BEE23880 Relevance: 89.6, APIs: 45, Strings: 6, Instructions: 320windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FF8BEE238AC
MonitorFromPoint.USER32 ref: 00007FF8BEE238BB
FindWindowExW.USER32 ref: 00007FF8BEE238DF
MonitorFromWindow.USER32 ref: 00007FF8BEE238F0
FindWindowExW.USER32 ref: 00007FF8BEE23915
FindWindowExW.USER32 ref: 00007FF8BEE23934
FindWindowW.USER32 ref: 00007FF8BEE2395D
FindWindowExW.USER32 ref: 00007FF8BEE23984
FindWindowExW.USER32 ref: 00007FF8BEE23999
GetCursorPos.USER32 ref: 00007FF8BEE239B4
GetCursorPos.USER32 ref: 00007FF8BEE239C2
MonitorFromPoint.USER32 ref: 00007FF8BEE239DB
FindWindowExW.USER32 ref: 00007FF8BEE239FF
MonitorFromWindow.USER32 ref: 00007FF8BEE23A10
MonitorFromPoint.USER32 ref: 00007FF8BEE23A2A
GetMonitorInfoW.USER32 ref: 00007FF8BEE23A37
FindWindowExW.USER32 ref: 00007FF8BEE23A50
MonitorFromWindow.USER32 ref: 00007FF8BEE23A61
GetMonitorInfoW.USER32 ref: 00007FF8BEE23A6E
GetWindowRect.USER32 ref: 00007FF8BEE23A80
SetCursorPos.USER32 ref: 00007FF8BEE23AB4
SetCursorPos.USER32 ref: 00007FF8BEE23ACA
FindWindowW.USER32 ref: 00007FF8BEE23AE0
PostMessageW.USER32 ref: 00007FF8BEE23AF4
PostMessageW.USER32 ref: 00007FF8BEE23B1B
FindWindowExW.USER32 ref: 00007FF8BEE23CB7
PostMessageW.USER32 ref: 00007FF8BEE23CCE

Strings

ClockButton, xrefs: 00007FF8BEE23B32
TrayClockWClass, xrefs: 00007FF8BEE2398D
Shell_TrayWnd, xrefs: 00007FF8BEE2390A, 00007FF8BEE23929, 00007FF8BEE23A45, 00007FF8BEE23C25, 00007FF8BEE23CAC
ClockFlyoutWindow, xrefs: 00007FF8BEE23956, 00007FF8BEE23AD9, 00007FF8BEE23B60
Shell_SecondaryTrayWnd, xrefs: 00007FF8BEE238D3, 00007FF8BEE239F3, 00007FF8BEE23BD3
TrayNotifyWnd, xrefs: 00007FF8BEE23978

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Window$Find$Monitor$From$Cursor$MessagePointPost$Info$Rect
String ID: ClockButton$ClockFlyoutWindow$Shell_SecondaryTrayWnd$Shell_TrayWnd$TrayClockWClass$TrayNotifyWnd
API String ID: 3707082976-1578901108
Opcode ID: 16f2e63d218c669eabb7d4e0ce2db9eb8d8b2f3126ba723a3e0b36579a2d8633
Instruction ID: fb3831a1c6816f43112b6c07eaddf3809b42a91f3005e439bbc516f5cb2627f5
Opcode Fuzzy Hash: 16f2e63d218c669eabb7d4e0ce2db9eb8d8b2f3126ba723a3e0b36579a2d8633
Instruction Fuzzy Hash: 8AE18C75B0AA428EF7649F29E8546BD67A1FF89BD5F404035CE0E13B58DEBCE8458700

Function 00007FF8BEE4E830 Relevance: 88.1, APIs: 33, Strings: 17, Instructions: 568filelibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BEE350C0: RegCreateKeyExW.KERNEL32 ref: 00007FF8BEE3511C
Part of subcall function 00007FF8BEE350C0: RegQueryValueExW.KERNEL32 ref: 00007FF8BEE35171
Part of subcall function 00007FF8BEE350C0: GetLocaleInfoW.KERNEL32 ref: 00007FF8BEE351BA
Part of subcall function 00007FF8BEE350C0: GetLocaleInfoW.KERNEL32 ref: 00007FF8BEE351D5
Part of subcall function 00007FF8BEE350C0: SetThreadPreferredUILanguages.KERNEL32 ref: 00007FF8BEE3528B
Part of subcall function 00007FF8BEE350C0: RegCloseKey.KERNEL32 ref: 00007FF8BEE3529B

SHGetFolderPathW.SHELL32 ref: 00007FF8BEE4E8AB

Part of subcall function 00007FF8BEE67E1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE67E45

LoadLibraryExW.KERNEL32 ref: 00007FF8BEE4E8D8
FindResourceW.KERNEL32 ref: 00007FF8BEE4E91F
SizeofResource.KERNEL32 ref: 00007FF8BEE4E92E
LoadResource.KERNEL32 ref: 00007FF8BEE4E93D
LockResource.KERNEL32 ref: 00007FF8BEE4E949
LocalAlloc.KERNEL32 ref: 00007FF8BEE4E95A
FreeResource.KERNEL32 ref: 00007FF8BEE4E974
VerQueryValueW.VERSION ref: 00007FF8BEE4E98D
LocalFree.KERNEL32 ref: 00007FF8BEE4E9C4
LoadStringW.USER32 ref: 00007FF8BEE4EAF1
LoadStringW.USER32 ref: 00007FF8BEE4EB23
LoadStringW.USER32 ref: 00007FF8BEE4EB52
GetModuleFileNameW.KERNEL32 ref: 00007FF8BEE4EC42
CreateFileW.KERNEL32 ref: 00007FF8BEE4ECA5
CreateFileMappingW.KERNEL32 ref: 00007FF8BEE4ECD0
CloseHandle.KERNEL32 ref: 00007FF8BEE4ECE1
MapViewOfFile.KERNEL32 ref: 00007FF8BEE4ECFC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE4ED2C
UnmapViewOfFile.KERNEL32 ref: 00007FF8BEE4ED34
CloseHandle.KERNEL32 ref: 00007FF8BEE4ED3D
CloseHandle.KERNEL32 ref: 00007FF8BEE4ED46
LoadStringW.USER32 ref: 00007FF8BEE4EE72
LoadStringW.USER32 ref: 00007FF8BEE4EE8D
LoadStringW.USER32 ref: 00007FF8BEE4EF7A
LoadStringW.USER32 ref: 00007FF8BEE4EF8E
LoadStringW.USER32 ref: 00007FF8BEE4EFDF
LoadStringW.USER32 ref: 00007FF8BEE4F002
FreeLibrary.KERNEL32 ref: 00007FF8BEE4F0CF
LoadStringW.USER32 ref: 00007FF8BEE4F140
LoadStringW.USER32 ref: 00007FF8BEE4F152
LoadStringW.USER32 ref: 00007FF8BEE4F16D
FreeLibrary.KERNEL32 ref: 00007FF8BEE4F20F

Strings

short, xrefs: 00007FF8BEE4EEC0, 00007FF8BEE4F1A0
https://github.com/valinet/ExplorerPatcher/releases/latest, xrefs: 00007FF8BEE4E8F9
[Updates] No updates are available., xrefs: 00007FF8BEE4F0E7
\ExplorerPatcher\ep_gui.dll, xrefs: 00007FF8BEE4E8B1
long, xrefs: 00007FF8BEE4EAA1, 00007FF8BEE4F060
<actions><action content="%s" arguments="%s"/></actions>, xrefs: 00007FF8BEE4F01B
<progress value="{progressValue}" status="{progressStatus}"/>, xrefs: 00007FF8BEE4EAF7
This, xrefs: 00007FF8BEE4ED5B
[Updates] Configured update policy on this system: "Install updates automatically"., xrefs: 00007FF8BEE4EACA
[Updates] Configured update policy on this system: "Manually check for updates"., xrefs: 00007FF8BEE4E9F4
action=update, xrefs: 00007FF8BEE4F008
[Updates] Path to module: %s, xrefs: 00007FF8BEE4EC4F
[Updates] Unable to check for updates because the remote server is unavailable., xrefs: 00007FF8BEE4F0E0
[Updates] Using hardcoded hash., xrefs: 00007FF8BEE4ED8B
<toast scenario="reminder" activationType="protocol" launch="%s" duration="%s"><visual><binding template="ToastGeneric">, xrefs: 00007FF8BEE4EA0A
[Updates] An update is available., xrefs: 00007FF8BEE4EDFA
[Updates] Configured update policy on this system: "Check for updates but let me choose whether to download and install them"., xrefs: 00007FF8BEE4EAB8

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Load$String$FileResource$CloseFree$CreateHandleLibrary$InfoLocalLocaleQueryValueView_invalid_parameter_noinfo$AllocFindFolderLanguagesLockMappingModuleNamePathPreferredSizeofThreadUnmap
String ID: <progress value="{progressValue}" status="{progressStatus}"/>$<actions><action content="%s" arguments="%s"/></actions>$<toast scenario="reminder" activationType="protocol" launch="%s" duration="%s"><visual><binding template="ToastGeneric">$This$[Updates] An update is available.$[Updates] Configured update policy on this system: "Check for updates but let me choose whether to download and install them".$[Updates] Configured update policy on this system: "Install updates automatically".$[Updates] Configured update policy on this system: "Manually check for updates".$[Updates] No updates are available.$[Updates] Path to module: %s$[Updates] Unable to check for updates because the remote server is unavailable.$[Updates] Using hardcoded hash.$\ExplorerPatcher\ep_gui.dll$action=update$https://github.com/valinet/ExplorerPatcher/releases/latest$long$short
API String ID: 3445338827-2029114158
Opcode ID: 559e2b912634e1291cae8304e0bf23cc6b1779b18a3a70d6040deef8487f5299
Instruction ID: 14585cb19880bc54e2889a89e651114df7ce360a08cd55e2a96974225636bb74
Opcode Fuzzy Hash: 559e2b912634e1291cae8304e0bf23cc6b1779b18a3a70d6040deef8487f5299
Instruction Fuzzy Hash: BB526136A18B828AE760CF29E8406EE77A4FB85788F405131DB4D17B69EF7CE645C740

Function 00007FF8BEE30D10 Relevance: 87.9, APIs: 24, Strings: 26, Instructions: 393librarythreadloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FF8BEE30DBA
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE30DC7
LoadLibraryW.KERNEL32 ref: 00007FF8BEE30DF9
LoadLibraryW.KERNEL32 ref: 00007FF8BEE30E0E

Part of subcall function 00007FF8BEE1D290: GetModuleHandleExW.KERNEL32 ref: 00007FF8BEE1D2C6
Part of subcall function 00007FF8BEE1D290: ImageDirectoryEntryToDataEx.DBGHELP ref: 00007FF8BEE1D2F9
Part of subcall function 00007FF8BEE1D290: FreeLibrary.KERNEL32 ref: 00007FF8BEE1D32F

Part of subcall function 00007FF8BEE1D290: FreeLibrary.KERNEL32 ref: 00007FF8BEE1D3B9
Part of subcall function 00007FF8BEE1D290: VirtualQuery.KERNEL32 ref: 00007FF8BEE1D3F8
Part of subcall function 00007FF8BEE1D290: VirtualProtect.KERNEL32 ref: 00007FF8BEE1D413
Part of subcall function 00007FF8BEE1D290: VirtualProtect.KERNEL32 ref: 00007FF8BEE1D43B
Part of subcall function 00007FF8BEE1D290: FreeLibrary.KERNEL32 ref: 00007FF8BEE1D446

CreateEventW.KERNEL32 ref: 00007FF8BEE3107B

Part of subcall function 00007FF8BEE12890: GetModuleHandleW.KERNEL32 ref: 00007FF8BEE128AF
Part of subcall function 00007FF8BEE12890: GetProcAddress.KERNEL32 ref: 00007FF8BEE128C8
Part of subcall function 00007FF8BEE12890: RegOpenKeyExW.KERNEL32 ref: 00007FF8BEE1293F
Part of subcall function 00007FF8BEE12890: RegQueryValueExW.KERNEL32 ref: 00007FF8BEE1296F

GetCurrentProcess.KERNEL32 ref: 00007FF8BEE30E66
K32GetModuleInformation.KERNEL32 ref: 00007FF8BEE30E7C
LoadLibraryW.KERNEL32 ref: 00007FF8BEE30E98
GetCurrentProcess.KERNEL32 ref: 00007FF8BEE30EAA
K32GetModuleInformation.KERNEL32 ref: 00007FF8BEE30EC0
FindResourceW.KERNEL32 ref: 00007FF8BEE30ED8
LoadResource.KERNEL32 ref: 00007FF8BEE30EF4
LockResource.KERNEL32 ref: 00007FF8BEE30F06
SizeofResource.KERNEL32 ref: 00007FF8BEE30F1D
LoadLibraryW.KERNEL32 ref: 00007FF8BEE30FE4
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE30FF1
CreateThread.KERNEL32 ref: 00007FF8BEE31226
LoadLibraryW.KERNEL32 ref: 00007FF8BEE31247
GetProcAddress.KERNEL32 ref: 00007FF8BEE3126A
FreeLibrary.KERNEL32 ref: 00007FF8BEE3135B
FreeLibraryAndExitThread.KERNEL32 ref: 00007FF8BEE313BA
FreeLibraryAndExitThread.KERNEL32 ref: 00007FF8BEE313FF
FreeLibraryAndExitThread.KERNEL32 ref: 00007FF8BEE31444
FreeLibraryAndExitThread.KERNEL32 ref: 00007FF8BEE31462

Strings

StartDocked::SystemListPolicyProvider::GetMaximumFrequentApps, xrefs: 00007FF8BEE3130C
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF8BEE31133
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage, xrefs: 00007FF8BEE310B8
StartUI_.dll, xrefs: 00007FF8BEE30E07
StartUI.dll, xrefs: 00007FF8BEE30DF2
ext-ms-win-ntuser-draw-l1-1-0.dll, xrefs: 00007FF8BEE30DE1, 00007FF8BEE30E28
SetWindowRgn, xrefs: 00007FF8BEE30DD7, 00007FF8BEE30E21
RegQueryValueExW, xrefs: 00007FF8BEE31021
SOFTWARE\Policies\Microsoft\Windows\Explorer, xrefs: 00007FF8BEE31176
StartDocked::LauncherFrame::ShowAllApps, xrefs: 00007FF8BEE31288, 00007FF8BEE312B4
StartDocked.dll, xrefs: 00007FF8BEE30DB3, 00007FF8BEE30DC0
Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher, xrefs: 00007FF8BEE310F0
api-ms-win-core-registry-l1-1-0.dll, xrefs: 00007FF8BEE3100B, 00007FF8BEE31028, 00007FF8BEE31045
Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher\StartUI, xrefs: 00007FF8BEE31349
RegCloseKey, xrefs: 00007FF8BEE3103E
Windows.UI.Xaml.dll, xrefs: 00007FF8BEE30E91
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00007FF8BEE311B9
SHRegGetValueFromHKCUHKLM, xrefs: 00007FF8BEE31259
StartUI::SystemListPolicyProvider::GetMaximumFrequentApps, xrefs: 00007FF8BEE31338
Shlwapi.dll, xrefs: 00007FF8BEE31240
Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher\StartDocked, xrefs: 00007FF8BEE31299, 00007FF8BEE312C5, 00007FF8BEE312F1, 00007FF8BEE3131D
StartDocked::LauncherFrame::OnVisibilityChanged, xrefs: 00007FF8BEE312E0
xxxxxxxxx?xxxxxx, xrefs: 00007FF8BEE30F8A
xxxxx????xx, xrefs: 00007FF8BEE30F26
RegOpenKeyExW, xrefs: 00007FF8BEE31001
Windows.CloudStore.dll, xrefs: 00007FF8BEE30FDD, 00007FF8BEE30FEA

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Library$Free$Load$Module$Thread$ExitHandleResource$Virtual$AddressCreateCurrentInformationProcProcessProtectQuery$DataDirectoryEntryEventFindImageLockOpenSizeofValue
String ID: RegCloseKey$RegOpenKeyExW$RegQueryValueExW$SHRegGetValueFromHKCUHKLM$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer$SOFTWARE\Policies\Microsoft\Windows\Explorer$SetWindowRgn$Shlwapi.dll$Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher$Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher\StartDocked$Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher\StartUI$StartDocked.dll$StartDocked::LauncherFrame::OnVisibilityChanged$StartDocked::LauncherFrame::ShowAllApps$StartDocked::SystemListPolicyProvider::GetMaximumFrequentApps$StartUI.dll$StartUI::SystemListPolicyProvider::GetMaximumFrequentApps$StartUI_.dll$Windows.CloudStore.dll$Windows.UI.Xaml.dll$api-ms-win-core-registry-l1-1-0.dll$ext-ms-win-ntuser-draw-l1-1-0.dll$xxxxx????xx$xxxxxxxxx?xxxxxx
API String ID: 1727790171-714608195
Opcode ID: a6c211eb3d1282101e3cf187c5596701cd8cb8dbf5dd7bc9041fa49edd53e002
Instruction ID: 3501949c94e280711545288c86e7ae4c690f68f67e3d8d92c94f2108accb4940
Opcode Fuzzy Hash: a6c211eb3d1282101e3cf187c5596701cd8cb8dbf5dd7bc9041fa49edd53e002
Instruction Fuzzy Hash: EE224875A09B4289EB10DFA8E8802A937A4FF48BD8F84013ADB4D477A4DFBDE545C350

Function 00007FF8BEE44A00 Relevance: 68.5, APIs: 18, Strings: 21, Instructions: 256registrymemoryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 00007FF8BEE44A6E
GetSystemDirectoryA.KERNEL32 ref: 00007FF8BEE44AD5

Part of subcall function 00007FF8BEE6A434: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE6A45C

GetSystemDirectoryW.KERNEL32 ref: 00007FF8BEE44B26

Part of subcall function 00007FF8BEE67E1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE67E45

Part of subcall function 00007FF8BEE4FE80: CreateFileW.KERNEL32 ref: 00007FF8BEE4FEFB
Part of subcall function 00007FF8BEE4FE80: GetLastError.KERNEL32 ref: 00007FF8BEE4FF0A

Part of subcall function 00007FF8BEE1CE30: CreateFileA.KERNEL32 ref: 00007FF8BEE1CEAB

VirtualProtect.KERNEL32 ref: 00007FF8BEE44BE8
VirtualProtect.KERNEL32 ref: 00007FF8BEE44C16
RegCloseKey.ADVAPI32 ref: 00007FF8BEE44C8A
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE44CE0
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE44D0C
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE44D38
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE44D64
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE44D90
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE44DBC
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE44DE8
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE44E14
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE44E40
RegSetValueExA.ADVAPI32 ref: 00007FF8BEE44E80
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE44EB5

Part of subcall function 00007FF8BEE12890: GetModuleHandleW.KERNEL32 ref: 00007FF8BEE128AF
Part of subcall function 00007FF8BEE12890: GetProcAddress.KERNEL32 ref: 00007FF8BEE128C8
Part of subcall function 00007FF8BEE12890: RegOpenKeyExW.KERNEL32 ref: 00007FF8BEE1293F
Part of subcall function 00007FF8BEE12890: RegQueryValueExW.KERNEL32 ref: 00007FF8BEE1296F

RegCloseKey.ADVAPI32 ref: 00007FF8BEE44EC5

Strings

[Symbols] Reading symbols..., xrefs: 00007FF8BEE44B9B
CLauncherTipContextMenu::_ExecuteCommand, xrefs: 00007FF8BEE44DA7
CLauncherTipContextMenu::ShowLauncherTipContextMenu, xrefs: 00007FF8BEE44DD3
CLauncherTipContextMenu::GetMenuItemsAsync, xrefs: 00007FF8BEE44CF7
[Symbols] Failure in reading symbols for "%s"., xrefs: 00007FF8BEE44C70
CImmersiveContextMenuOwnerDrawHelper::s_ContextMenuWndProc, xrefs: 00007FF8BEE44CC3
twinui.pcshell, xrefs: 00007FF8BEE44AF0
Software\ExplorerPatcher\twinui.pcshell, xrefs: 00007FF8BEE44A46
.dll, xrefs: 00007FF8BEE44B05
[Symbols] Downloading symbols for "%s" ("%s")..., xrefs: 00007FF8BEE44B5E
[Symbols] Unable to create registry key., xrefs: 00007FF8BEE44ED2
CMultitaskingViewManager::_CreateDCompMTVHost, xrefs: 00007FF8BEE44E2B
ImmersiveContextMenuHelper::RemoveOwnerDrawFromMenu, xrefs: 00007FF8BEE44D4F
[Symbols] Please refer to "https://github.com/valinet/ExplorerPatcher/wiki/Symbols" for more information., xrefs: 00007FF8BEE44B8A
CMultitaskingViewManager::_CreateXamlMTVHost, xrefs: 00007FF8BEE44DFF
Version, xrefs: 00007FF8BEE44E98
[Symbols] Symbols for "%s" are not available - unable to download., xrefs: 00007FF8BEE44B7E
Hash, xrefs: 00007FF8BEE44E60
ImmersiveContextMenuHelper::ApplyOwnerDrawToMenu, xrefs: 00007FF8BEE44D23
\twinui.pcshell.dll, xrefs: 00007FF8BEE44B2C
CLauncherTipContextMenu::_ExecuteShutdownCommand, xrefs: 00007FF8BEE44D7B

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Value$Create$CloseDirectoryFileProtectSystemVirtual_invalid_parameter_noinfo$AddressErrorHandleLastModuleOpenProcQuery
String ID: .dll$CImmersiveContextMenuOwnerDrawHelper::s_ContextMenuWndProc$CLauncherTipContextMenu::GetMenuItemsAsync$CLauncherTipContextMenu::ShowLauncherTipContextMenu$CLauncherTipContextMenu::_ExecuteCommand$CLauncherTipContextMenu::_ExecuteShutdownCommand$CMultitaskingViewManager::_CreateDCompMTVHost$CMultitaskingViewManager::_CreateXamlMTVHost$Hash$ImmersiveContextMenuHelper::ApplyOwnerDrawToMenu$ImmersiveContextMenuHelper::RemoveOwnerDrawFromMenu$Software\ExplorerPatcher\twinui.pcshell$Version$[Symbols] Downloading symbols for "%s" ("%s")...$[Symbols] Failure in reading symbols for "%s".$[Symbols] Please refer to "https://github.com/valinet/ExplorerPatcher/wiki/Symbols" for more information.$[Symbols] Reading symbols...$[Symbols] Symbols for "%s" are not available - unable to download.$[Symbols] Unable to create registry key.$\twinui.pcshell.dll$twinui.pcshell
API String ID: 2736650789-497210955
Opcode ID: 7279e2340fd88a1bea62bff2242454aefb5ca5df99c5eae57e3fe0494704474e
Instruction ID: 97447f40d901fde4a7b643066b24d4936ba375f93b81ce3be739715861f62b63
Opcode Fuzzy Hash: 7279e2340fd88a1bea62bff2242454aefb5ca5df99c5eae57e3fe0494704474e
Instruction Fuzzy Hash: 4ED17476A18A428AFB20DF68F8907A97760FB847D8F404132DB4D43AA8DFBCD545CB44

Function 00007FF8BEE305A0 Relevance: 63.3, APIs: 24, Strings: 12, Instructions: 291registrywindowCOMMON

Download Yara Rule

APIs

SetProcessDpiAwarenessContext.USER32 ref: 00007FF8BEE305CF

Part of subcall function 00007FF8BEE1D7C0: AllocateAndInitializeSid.ADVAPI32 ref: 00007FF8BEE1D829
Part of subcall function 00007FF8BEE1D7C0: CheckTokenMembership.KERNELBASE ref: 00007FF8BEE1D83F
Part of subcall function 00007FF8BEE1D7C0: GetLastError.KERNEL32 ref: 00007FF8BEE1D849
Part of subcall function 00007FF8BEE1D7C0: FreeSid.ADVAPI32 ref: 00007FF8BEE1D85B

GetModuleFileNameW.KERNEL32 ref: 00007FF8BEE30612
GetCurrentDirectoryW.KERNEL32 ref: 00007FF8BEE30637
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE30643
ShellExecuteExW.SHELL32 ref: 00007FF8BEE3071A
GetLastError.KERNEL32 ref: 00007FF8BEE30728
LoadStringW.USER32 ref: 00007FF8BEE3077A
LoadStringW.USER32 ref: 00007FF8BEE30799
MessageBoxW.USER32 ref: 00007FF8BEE307B5
GetModuleFileNameW.KERNEL32 ref: 00007FF8BEE3081E
GetLastError.KERNEL32 ref: 00007FF8BEE30828
RegCreateKeyExW.ADVAPI32 ref: 00007FF8BEE30874
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE308DB
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE30903
RegCloseKey.ADVAPI32 ref: 00007FF8BEE30910
PathRemoveExtensionW.SHLWAPI ref: 00007FF8BEE30923
PathRemoveExtensionW.SHLWAPI ref: 00007FF8BEE3092E
RegCreateKeyExW.ADVAPI32 ref: 00007FF8BEE3097E
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE309DB
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE30A03
RegCloseKey.ADVAPI32 ref: 00007FF8BEE30A10
RegCreateKeyExW.ADVAPI32 ref: 00007FF8BEE30A52
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE30A93
RegCloseKey.ADVAPI32 ref: 00007FF8BEE30AA0

Strings

runas, xrefs: 00007FF8BEE306B9
SOFTWARE\Classes\Drive\shellex\FolderExtensions\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FF8BEE30A2D
DriveMask, xrefs: 00007FF8BEE30A8C
\ExplorerPatcher.amd64.dll", xrefs: 00007FF8BEE306A1
ThreadingModel, xrefs: 00007FF8BEE308E6, 00007FF8BEE309E6
SOFTWARE\WOW6432Node\Classes\CLSID\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}\InProcServer32, xrefs: 00007FF8BEE30959
.IA-32.dll, xrefs: 00007FF8BEE30934
ext-ms-win-ntuser-dialogbox-l1-1-0.dll, xrefs: 00007FF8BEE3065A
p, xrefs: 00007FF8BEE306DB
SOFTWARE\Classes\CLSID\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}\InProcServer32, xrefs: 00007FF8BEE30847
MessageBoxW, xrefs: 00007FF8BEE30653
Apartment, xrefs: 00007FF8BEE3087F

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Value$CloseCreateErrorLastModule$ExtensionFileLoadNamePathRemoveString$AllocateAwarenessCheckContextCurrentDirectoryExecuteFreeHandleInitializeMembershipMessageProcessShellToken
String ID: .IA-32.dll$Apartment$DriveMask$MessageBoxW$SOFTWARE\Classes\CLSID\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}\InProcServer32$SOFTWARE\Classes\Drive\shellex\FolderExtensions\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}$SOFTWARE\WOW6432Node\Classes\CLSID\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}\InProcServer32$ThreadingModel$\ExplorerPatcher.amd64.dll"$ext-ms-win-ntuser-dialogbox-l1-1-0.dll$p$runas
API String ID: 3183597740-1688178669
Opcode ID: c05d36aab759ccae8d75bceb780709277f0a3ce24c1ade3265239c1bb6372715
Instruction ID: 77bc56f72f45d481d3343775d812bdc12d03240bd673ae514cc755fbf4a4947c
Opcode Fuzzy Hash: c05d36aab759ccae8d75bceb780709277f0a3ce24c1ade3265239c1bb6372715
Instruction Fuzzy Hash: EBE17731A08B818AE7209F69E4847AA77A1FB85794F405235DB9D43BD8DFFCE145CB00

Function 00007FF8BEE25B40 Relevance: 61.6, APIs: 28, Strings: 7, Instructions: 332memorylibraryCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF8BEE25B99
GetWindowLongPtrW.USER32 ref: 00007FF8BEE25BD8
GetWindowLongPtrW.USER32 ref: 00007FF8BEE25C48
IsBadCodePtr.KERNEL32 ref: 00007FF8BEE25CA2
GetWindowTextW.USER32 ref: 00007FF8BEE25CD3
LoadLibraryExW.KERNEL32 ref: 00007FF8BEE25CE8
LoadStringW.USER32 ref: 00007FF8BEE25D0B
FreeLibrary.KERNEL32 ref: 00007FF8BEE25D14
VirtualProtect.KERNEL32 ref: 00007FF8BEE25DA1
VirtualProtect.KERNEL32 ref: 00007FF8BEE25DE2
VirtualProtect.KERNEL32 ref: 00007FF8BEE25DFF
VirtualProtect.KERNEL32 ref: 00007FF8BEE25E40
VirtualProtect.KERNEL32 ref: 00007FF8BEE25EC4
VirtualProtect.KERNEL32 ref: 00007FF8BEE25EEE

Strings

CortanaButton, xrefs: 00007FF8BEE25D4F
ControlCenterButton, xrefs: 00007FF8BEE25BAA
PeopleBand.dll, xrefs: 00007FF8BEE25CDB
pnidui.dll, xrefs: 00007FF8BEE26101
MultitaskingButton, xrefs: 00007FF8BEE25E4B
TrayButton, xrefs: 00007FF8BEE25C09
PeopleButton, xrefs: 00007FF8BEE25C96

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ProtectVirtual$Window$LibraryLoadLong$ClassCodeFreeNameStringText
String ID: ControlCenterButton$CortanaButton$MultitaskingButton$PeopleBand.dll$PeopleButton$TrayButton$pnidui.dll
API String ID: 3103532507-4160915873
Opcode ID: e0476e56a3aecb8464881f4e6907b5f5c27fc42999c23e30719ac4a2253a5859
Instruction ID: bc90f16a7ed2498cd07b4dcc7b3fdd2360cd339e12b3d05e7de1c36cf2fad28b
Opcode Fuzzy Hash: e0476e56a3aecb8464881f4e6907b5f5c27fc42999c23e30719ac4a2253a5859
Instruction Fuzzy Hash: 52027571A19A438AEB54CF29E8943BD33A1FB45B84F804136DB4E43664DFBCE989C701

Function 00007FF8BEE2F810 Relevance: 61.6, APIs: 20, Strings: 15, Instructions: 322registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 00007FF8BEE2F86B
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE2F8B0
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE2F8E3
RegCloseKey.ADVAPI32 ref: 00007FF8BEE2F8ED
RegCreateKeyExW.ADVAPI32 ref: 00007FF8BEE2F926
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE2F972
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE2F9BE
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE2FA0C
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE2FA5A
RegCloseKey.ADVAPI32 ref: 00007FF8BEE2FA85
RegCreateKeyExW.ADVAPI32 ref: 00007FF8BEE2FABE
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE2FB33
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE2FBB8
RegCloseKey.ADVAPI32 ref: 00007FF8BEE2FBE4
RegCreateKeyExW.ADVAPI32 ref: 00007FF8BEE2FC1D
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE2FC62
RegCloseKey.ADVAPI32 ref: 00007FF8BEE2FC85
RegCreateKeyExW.ADVAPI32 ref: 00007FF8BEE2FCBE
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE2FCFB
RegCloseKey.ADVAPI32 ref: 00007FF8BEE2FD1A

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF8BEE2FA99
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage, xrefs: 00007FF8BEE2F83B
ForceStartSize, xrefs: 00007FF8BEE2FC49
Start_ShowClassicMode, xrefs: 00007FF8BEE2FB0C
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00007FF8BEE2FC99
MakeAllAppsDefault, xrefs: 00007FF8BEE2F897
StartDocked_DisableRecommendedSection, xrefs: 00007FF8BEE2F98F
TaskbarAl, xrefs: 00007FF8BEE2FB8D
SOFTWARE\Policies\Microsoft\Windows\Explorer, xrefs: 00007FF8BEE2FBF8
StartUI_ShowMoreTiles, xrefs: 00007FF8BEE2FA2B
Start_MaximumFrequentApps, xrefs: 00007FF8BEE2F955
Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher, xrefs: 00007FF8BEE2F901
MonitorOverride, xrefs: 00007FF8BEE2F8C3
StartUI_EnableRoundedCorners, xrefs: 00007FF8BEE2F9DD
NoStartMenuMorePrograms, xrefs: 00007FF8BEE2FCE2

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: QueryValue$CloseCreate
String ID: ForceStartSize$MakeAllAppsDefault$MonitorOverride$NoStartMenuMorePrograms$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer$SOFTWARE\Policies\Microsoft\Windows\Explorer$Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher$StartDocked_DisableRecommendedSection$StartUI_EnableRoundedCorners$StartUI_ShowMoreTiles$Start_MaximumFrequentApps$Start_ShowClassicMode$TaskbarAl
API String ID: 2657993070-1512199074
Opcode ID: fa77e6e580e8ba6d01c16af590dcbac6f5a310362da92c6cbe026ad94f6406c1
Instruction ID: 7d38d215526efd1f8542450202a295cb83ec5ab1eb3d28bdcae1e1ab9ac1affd
Opcode Fuzzy Hash: fa77e6e580e8ba6d01c16af590dcbac6f5a310362da92c6cbe026ad94f6406c1
Instruction Fuzzy Hash: 45F10676A19B428EEB20CF68E8906AD37A4FB48398F500535DB4D57A58DFBDD144CB40

Function 00007FF8BEE4BF10 Relevance: 54.8, APIs: 21, Strings: 10, Instructions: 574libraryCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF8BEE4BF57
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE4BF88
RoActivateInstance.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF8BEE4BFA0
StrFormatByteSizeW.SHLWAPI ref: 00007FF8BEE4C18D
StrFormatByteSizeW.SHLWAPI ref: 00007FF8BEE4C1AA
SHGetFolderPathW.SHELL32 ref: 00007FF8BEE4C216
LoadLibraryExW.KERNEL32 ref: 00007FF8BEE4C243
LoadStringW.USER32 ref: 00007FF8BEE4C262
FreeLibrary.KERNEL32 ref: 00007FF8BEE4C271
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE4C2C0
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE4C2EB

Part of subcall function 00007FF8BEE67EB8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE67EDE

WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE4C3AD
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE4C3DA
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE4C524
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE4C680
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE4C734

Strings

%s / %s, xrefs: 00007FF8BEE4C1B8
\ExplorerPatcher\ep_gui.dll, xrefs: 00007FF8BEE4C21C
progressStatus, xrefs: 00007FF8BEE4C3D3
progressValue, xrefs: 00007FF8BEE4C2E4
Windows.UI.Notifications.NotificationData, xrefs: 00007FF8BEE4BF81
action=update, xrefs: 00007FF8BEE4C6C6
indeterminate, xrefs: 00007FF8BEE4C15E
EP_Ev_InstallUpdatesNoConfirm_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FF8BEE4C6F2
ep_updates, xrefs: 00007FF8BEE4C51D
updates.cpp, xrefs: 00007FF8BEE4BFB6, 00007FF8BEE4C02C, 00007FF8BEE4C094, 00007FF8BEE4C31B, 00007FF8BEE4C40A, 00007FF8BEE4C48F, 00007FF8BEE4C555, 00007FF8BEE4C657, 00007FF8BEE4C6A3

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: String$Windows$CreateReference$ByteDeleteFormatLibraryLoadSize$ActivateCounterFolderFreeInstancePathPerformanceQuery_invalid_parameter_noinfo
String ID: %s / %s$EP_Ev_InstallUpdatesNoConfirm_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}$Windows.UI.Notifications.NotificationData$\ExplorerPatcher\ep_gui.dll$action=update$ep_updates$indeterminate$progressStatus$progressValue$updates.cpp
API String ID: 2375332063-2428038664
Opcode ID: 3e038110ad303b7245781c35bcd8e09fa420e93852786730b7b4aea4bf3d7499
Instruction ID: 96ec62cf60f37f7d11dc272f429b166261abea44de147c54f8aee9ec5d670623
Opcode Fuzzy Hash: 3e038110ad303b7245781c35bcd8e09fa420e93852786730b7b4aea4bf3d7499
Instruction Fuzzy Hash: 61324936B09B468AEB119B69E8506AE67B1FF85BC4F404132DB4E53B68DFBCE445C700

Function 00007FF8BEE44650 Relevance: 52.7, APIs: 13, Strings: 17, Instructions: 191registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 00007FF8BEE446C1
GetWindowsDirectoryA.KERNEL32 ref: 00007FF8BEE44728

Part of subcall function 00007FF8BEE6A434: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE6A45C

GetWindowsDirectoryW.KERNEL32 ref: 00007FF8BEE4474F

Part of subcall function 00007FF8BEE67E1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE67E45

Part of subcall function 00007FF8BEE4FE80: CreateFileW.KERNEL32 ref: 00007FF8BEE4FEFB
Part of subcall function 00007FF8BEE4FE80: GetLastError.KERNEL32 ref: 00007FF8BEE4FF0A

Part of subcall function 00007FF8BEE1CE30: CreateFileA.KERNEL32 ref: 00007FF8BEE1CEAB

RegSetValueExW.ADVAPI32 ref: 00007FF8BEE44837
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE44863
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE4488F
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE448BB
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE448E7
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE44913
RegSetValueExA.ADVAPI32 ref: 00007FF8BEE44953
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE44988
RegCloseKey.ADVAPI32 ref: 00007FF8BEE44998
RegCloseKey.ADVAPI32 ref: 00007FF8BEE449BF

Strings

[Symbols] Reading symbols..., xrefs: 00007FF8BEE447C4
[Symbols] Failure in reading symbols for "%s"., xrefs: 00007FF8BEE449A9
SetColorPreferenceForLogonUI, xrefs: 00007FF8BEE448D2
CTaskBand_CreateInstance, xrefs: 00007FF8BEE4487A
\explorer.exe, xrefs: 00007FF8BEE44755
HandleFirstTimeLegacy, xrefs: 00007FF8BEE448A6
[Symbols] Downloading symbols for "%s" ("%s")..., xrefs: 00007FF8BEE44787
TrayUI::_UpdatePearlSize, xrefs: 00007FF8BEE448FE
[Symbols] Unable to create registry key., xrefs: 00007FF8BEE449C7
\explorer.exe, xrefs: 00007FF8BEE4472E
[Symbols] Please refer to "https://github.com/valinet/ExplorerPatcher/wiki/Symbols" for more information., xrefs: 00007FF8BEE447B3
Version, xrefs: 00007FF8BEE4496B
[Symbols] Symbols for "%s" are not available - unable to download., xrefs: 00007FF8BEE447A7
Hash, xrefs: 00007FF8BEE44933
ImmersiveTray::RaiseWindow, xrefs: 00007FF8BEE4484E
ImmersiveTray::AttachWindowToTray, xrefs: 00007FF8BEE4481A
Software\ExplorerPatcher\explorer, xrefs: 00007FF8BEE446A1

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Value$Create$CloseDirectoryFileWindows_invalid_parameter_noinfo$ErrorLast
String ID: CTaskBand_CreateInstance$HandleFirstTimeLegacy$Hash$ImmersiveTray::AttachWindowToTray$ImmersiveTray::RaiseWindow$SetColorPreferenceForLogonUI$Software\ExplorerPatcher\explorer$TrayUI::_UpdatePearlSize$Version$[Symbols] Downloading symbols for "%s" ("%s")...$[Symbols] Failure in reading symbols for "%s".$[Symbols] Please refer to "https://github.com/valinet/ExplorerPatcher/wiki/Symbols" for more information.$[Symbols] Reading symbols...$[Symbols] Symbols for "%s" are not available - unable to download.$[Symbols] Unable to create registry key.$\explorer.exe$\explorer.exe
API String ID: 3922731654-964289750
Opcode ID: 2999d926a6055610ebd9f8c3668666e27c1a31db4b43e24e8e7238bc69317f22
Instruction ID: 1d6523b6b5ba7b84801f9fecd19637103a20b819bd82e242c74563848300adc9
Opcode Fuzzy Hash: 2999d926a6055610ebd9f8c3668666e27c1a31db4b43e24e8e7238bc69317f22
Instruction Fuzzy Hash: BEA17676B18A428AEB20DF68E4907A97771FB857D8F405232DB4D43AA9DFBCD145C700

Function 00007FF8BEE1CE30 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 248fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BEE6A434: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE6A45C

CreateFileA.KERNEL32 ref: 00007FF8BEE1CEAB
CreateFileMappingW.KERNEL32 ref: 00007FF8BEE1CEE3
CloseHandle.KERNEL32 ref: 00007FF8BEE1CEF4

Strings

/download/symbols/, xrefs: 00007FF8BEE1CE6C
%x/, xrefs: 00007FF8BEE1D17E
RSDS, xrefs: 00007FF8BEE1D063
%08lX%04hX%04hX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX, xrefs: 00007FF8BEE1D111

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CreateFile$CloseHandleMapping_invalid_parameter_noinfo
String ID: %08lX%04hX%04hX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX$%x/$/download/symbols/$RSDS
API String ID: 1983873661-2402091955
Opcode ID: 638dfb43851133801f2dc14af45ed182553db894b6b77104bbaf18ad00394b01
Instruction ID: b82cde302dc05067a5998f72124970eb5f6bce74aa2f6c4d31a0b23d9e56de28
Opcode Fuzzy Hash: 638dfb43851133801f2dc14af45ed182553db894b6b77104bbaf18ad00394b01
Instruction Fuzzy Hash: 36B1D2B1A086C28AEB649F19E8543BA7760FB89BD5F404131DB5E03B94DFBCE495C701

Function 00007FF8BEE44F10 Relevance: 50.9, APIs: 12, Strings: 17, Instructions: 182registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 00007FF8BEE44F81
GetWindowsDirectoryA.KERNEL32 ref: 00007FF8BEE44FE8

Part of subcall function 00007FF8BEE6A434: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE6A45C

GetWindowsDirectoryW.KERNEL32 ref: 00007FF8BEE45039

Part of subcall function 00007FF8BEE67E1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE67E45

Part of subcall function 00007FF8BEE4FE80: CreateFileW.KERNEL32 ref: 00007FF8BEE4FEFB
Part of subcall function 00007FF8BEE4FE80: GetLastError.KERNEL32 ref: 00007FF8BEE4FF0A

Part of subcall function 00007FF8BEE1CE30: CreateFileA.KERNEL32 ref: 00007FF8BEE1CEAB

RegCloseKey.ADVAPI32 ref: 00007FF8BEE450F1
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE4511E
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE4514A
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE45176
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE451A2
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE451CE
RegSetValueExA.ADVAPI32 ref: 00007FF8BEE4520E
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE45243
RegCloseKey.ADVAPI32 ref: 00007FF8BEE45253

Strings

StartDocked::StartSizingFrame::StartSizingFrame, xrefs: 00007FF8BEE451B9
[Symbols] Reading symbols..., xrefs: 00007FF8BEE450AB
StartDocked::SystemListPolicyProvider::GetMaximumFrequentApps, xrefs: 00007FF8BEE4518D
[Symbols] Failure in reading symbols for "%s"., xrefs: 00007FF8BEE450D7
StartDocked::LauncherFrame::ShowAllApps, xrefs: 00007FF8BEE45101, 00007FF8BEE45135
.dll, xrefs: 00007FF8BEE45018
[Symbols] Downloading symbols for "%s" ("%s")..., xrefs: 00007FF8BEE45071
[Symbols] Unable to create registry key., xrefs: 00007FF8BEE45260
[Symbols] Please refer to "https://github.com/valinet/ExplorerPatcher/wiki/Symbols" for more information., xrefs: 00007FF8BEE4509D
Version, xrefs: 00007FF8BEE45226
Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher\StartDocked, xrefs: 00007FF8BEE44F61
[Symbols] Symbols for "%s" are not available - unable to download., xrefs: 00007FF8BEE45091
\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartDocked.dll, xrefs: 00007FF8BEE4503F
Hash, xrefs: 00007FF8BEE451EE
StartDocked::LauncherFrame::OnVisibilityChanged, xrefs: 00007FF8BEE45161
\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\, xrefs: 00007FF8BEE44FEE
StartDocked, xrefs: 00007FF8BEE45003

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Value$Create$CloseDirectoryFileWindows_invalid_parameter_noinfo$ErrorLast
String ID: .dll$Hash$Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher\StartDocked$StartDocked$StartDocked::LauncherFrame::OnVisibilityChanged$StartDocked::LauncherFrame::ShowAllApps$StartDocked::StartSizingFrame::StartSizingFrame$StartDocked::SystemListPolicyProvider::GetMaximumFrequentApps$Version$[Symbols] Downloading symbols for "%s" ("%s")...$[Symbols] Failure in reading symbols for "%s".$[Symbols] Please refer to "https://github.com/valinet/ExplorerPatcher/wiki/Symbols" for more information.$[Symbols] Reading symbols...$[Symbols] Symbols for "%s" are not available - unable to download.$[Symbols] Unable to create registry key.$\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\$\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartDocked.dll
API String ID: 3922731654-50308056
Opcode ID: ca77b8ddde9d7b1228341580207da3b5d40f45053d1f3dabb358db633d20350a
Instruction ID: a670d6e650bbc82ac997801443e8d8d1464c37d452de2724eeb90a8ba22db197
Opcode Fuzzy Hash: ca77b8ddde9d7b1228341580207da3b5d40f45053d1f3dabb358db633d20350a
Instruction Fuzzy Hash: 26916776A18A428AEB10DF58E8503AD7771FB847D8F405232DB5D43AA9DFBCD149C740

Function 00007FF8BEE11B20 Relevance: 47.6, APIs: 26, Strings: 1, Instructions: 331windowthreadtimeCOMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF8BEE11B62
GetWindowThreadProcessId.USER32 ref: 00007FF8BEE11B83
DestroyIcon.USER32 ref: 00007FF8BEE11BE9
GetCurrentProcessId.KERNEL32 ref: 00007FF8BEE11BFF
CopyIcon.USER32 ref: 00007FF8BEE11C20
GetCurrentProcessId.KERNEL32 ref: 00007FF8BEE11C6D
DestroyIcon.USER32 ref: 00007FF8BEE11C7C
OpenProcess.KERNEL32 ref: 00007FF8BEE11CF8
K32GetModuleFileNameExW.KERNEL32 ref: 00007FF8BEE11D19
CharLowerW.USER32 ref: 00007FF8BEE11D26
SHGetFileInfoW.SHELL32 ref: 00007FF8BEE11D5D
SHGetPropertyStoreForWindow.SHELL32 ref: 00007FF8BEE11D9D
SHCreateItemInKnownFolder.SHELL32 ref: 00007FF8BEE11E1F
ImageList_Create.COMCTL32 ref: 00007FF8BEE11E95
ImageList_Add.COMCTL32 ref: 00007FF8BEE11EA9
ImageList_GetIcon.COMCTL32 ref: 00007FF8BEE11EC0
ImageList_Destroy.COMCTL32 ref: 00007FF8BEE11ECC
DeleteObject.GDI32 ref: 00007FF8BEE11ED7
IsHungAppWindow.USER32 ref: 00007FF8BEE1206B
KillTimer.USER32 ref: 00007FF8BEE12086
SendMessageW.USER32 ref: 00007FF8BEE1209E

Strings

\imageres.dll, xrefs: 00007FF8BEE11FAA

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: IconImageList_ProcessWindow$Destroy$CreateCurrentFile$CharCopyDeleteFolderHungInfoItemKillKnownLongLowerMessageModuleNameObjectOpenPropertySendStoreThreadTimer
String ID: \imageres.dll
API String ID: 2056515760-856694671
Opcode ID: fa4231e157aaf93894071cbadc55bdeb7f66d54dc3a3e305537413a899d70841
Instruction ID: 824c3472b13ba977cdfbf90ad7b79ba1400869f7e92edddcce303c5a41b6926e
Opcode Fuzzy Hash: fa4231e157aaf93894071cbadc55bdeb7f66d54dc3a3e305537413a899d70841
Instruction Fuzzy Hash: 74F18332709A818AEB64CF29E8D466A77A0FF85BC4F40413ADB4E476A4DF7DE485C701

Function 00007FF8BEE30070 Relevance: 40.6, APIs: 18, Strings: 5, Instructions: 349COMMON

Download Yara Rule

APIs

WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE300BC
RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF8BEE300EE
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE3015F
OpenMutexW.KERNEL32 ref: 00007FF8BEE301AB
CloseHandle.KERNEL32 ref: 00007FF8BEE301B9
ShowWindow.USER32 ref: 00007FF8BEE301CE
EnumDisplayMonitors.USER32 ref: 00007FF8BEE30250
MonitorFromPoint.USER32 ref: 00007FF8BEE3026C
FindWindowExW.USER32 ref: 00007FF8BEE30286
MonitorFromWindow.USER32 ref: 00007FF8BEE3029C
FindWindowExW.USER32 ref: 00007FF8BEE302BF
MonitorFromWindow.USER32 ref: 00007FF8BEE302D5
MonitorFromWindow.USER32 ref: 00007FF8BEE3031B
GetMonitorInfoW.USER32 ref: 00007FF8BEE30328
GetWindowRect.USER32 ref: 00007FF8BEE30341
GetCursorPos.USER32 ref: 00007FF8BEE30387
SetWindowPos.USER32 ref: 00007FF8BEE3050A
SetWindowRgn.USER32 ref: 00007FF8BEE30575

Strings

Windows.UI.Xaml.Window, xrefs: 00007FF8BEE300B1
!@, xrefs: 00007FF8BEE304F3
Shell_TrayWnd, xrefs: 00007FF8BEE30278
EPStart10_AnimationsPatched_{A6EA9C2D-4982-4827-9204-0AC532959F6D}, xrefs: 00007FF8BEE3019D
Shell_SecondaryTrayWnd, xrefs: 00007FF8BEE302B3

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Window$Monitor$From$FindStringWindows$ActivationCloseCreateCursorDeleteDisplayEnumFactoryHandleInfoMonitorsMutexOpenPointRectReferenceShow
String ID: !@$EPStart10_AnimationsPatched_{A6EA9C2D-4982-4827-9204-0AC532959F6D}$Shell_SecondaryTrayWnd$Shell_TrayWnd$Windows.UI.Xaml.Window
API String ID: 3798604058-3529946197
Opcode ID: 9013be772f44af882ff57b6541dfcd952e3de35dc8bc2ed47a797580871492a2
Instruction ID: accec2a162bc58c0a37a26d240c009d55ae2b73fa0a351acd1eac4cfa4d846c4
Opcode Fuzzy Hash: 9013be772f44af882ff57b6541dfcd952e3de35dc8bc2ed47a797580871492a2
Instruction Fuzzy Hash: D7F11636B49A429EF721CBB9D8846AD77B1BB447C8F004135CF0E53A99DEBDB9458B00

Function 00007FF8BEE2CEC0 Relevance: 40.4, APIs: 15, Strings: 8, Instructions: 163sleepregistryprocessCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 00007FF8BEE2CFB7
CloseHandle.KERNEL32 ref: 00007FF8BEE2CFC6
CloseHandle.KERNEL32 ref: 00007FF8BEE2CFD1
RegSetKeyValueW.ADVAPI32 ref: 00007FF8BEE2D084
SetLastError.KERNEL32 ref: 00007FF8BEE2D08C
CreateEventW.KERNEL32 ref: 00007FF8BEE2D0A0
GetLastError.KERNEL32 ref: 00007FF8BEE2D0AE
SetEvent.KERNEL32 ref: 00007FF8BEE2D0BE
CreateThread.KERNEL32 ref: 00007FF8BEE2D0E0
Sleep.KERNEL32 ref: 00007FF8BEE2D0EB
SetLastError.KERNEL32 ref: 00007FF8BEE2D0F3
CreateEventW.KERNEL32 ref: 00007FF8BEE2D107
GetLastError.KERNEL32 ref: 00007FF8BEE2D115
SetEvent.KERNEL32 ref: 00007FF8BEE2D125
ShellExecuteW.SHELL32 ref: 00007FF8BEE2D14F

Strings

eplink://update, xrefs: 00007FF8BEE2CFFE
EP_Ev_InstallUpdates_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FF8BEE2D092, 00007FF8BEE2D0F9
eplink://update/staging, xrefs: 00007FF8BEE2D03C
eplink://update/stable, xrefs: 00007FF8BEE2D01B
Software\ExplorerPatcher, xrefs: 00007FF8BEE2D07D
h, xrefs: 00007FF8BEE2CF3E
open, xrefs: 00007FF8BEE2D146
UpdatePreferStaging, xrefs: 00007FF8BEE2D06F

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CreateErrorEventLast$CloseHandle$ExecuteProcessShellSleepThreadValue
String ID: EP_Ev_InstallUpdates_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}$Software\ExplorerPatcher$UpdatePreferStaging$eplink://update$eplink://update/stable$eplink://update/staging$h$open
API String ID: 2028834884-198725195
Opcode ID: ee5818e020c4af8db8580b810069c4b8851a4d8c5bc1e6f6e8260e125535d6e4
Instruction ID: ba6edcd164a2d7116fa30c259e5f7c065032164df9837c100a78d21c7d99293d
Opcode Fuzzy Hash: ee5818e020c4af8db8580b810069c4b8851a4d8c5bc1e6f6e8260e125535d6e4
Instruction Fuzzy Hash: CA715C21A0DB828AF7209F29E85036A67A1FB897D4F541235DB8D46AA5DFBCE185C700

Function 00007FF8BEE1FBE0 Relevance: 38.8, APIs: 17, Strings: 5, Instructions: 274comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00007FF8BEE1FC85
GetClassNameW.USER32 ref: 00007FF8BEE1FD74
IsWindow.USER32 ref: 00007FF8BEE1FD7F

Part of subcall function 00007FF8BEE12890: GetModuleHandleW.KERNEL32 ref: 00007FF8BEE128AF
Part of subcall function 00007FF8BEE12890: GetProcAddress.KERNEL32 ref: 00007FF8BEE128C8
Part of subcall function 00007FF8BEE12890: RegOpenKeyExW.KERNEL32 ref: 00007FF8BEE1293F
Part of subcall function 00007FF8BEE12890: RegQueryValueExW.KERNEL32 ref: 00007FF8BEE1296F

GetAncestor.USER32 ref: 00007FF8BEE1FE0E
FindWindowExW.USER32 ref: 00007FF8BEE1FE23
IsWindow.USER32 ref: 00007FF8BEE1FE2F
FindWindowExW.USER32 ref: 00007FF8BEE1FE48
IsWindow.USER32 ref: 00007FF8BEE1FE54
SysFreeString.OLEAUT32 ref: 00007FF8BEE20007
SysFreeString.OLEAUT32 ref: 00007FF8BEE2001A

Strings

MSTaskListWClass, xrefs: 00007FF8BEE1FDCE
Taskbar.TaskbarFrameAutomationPeer, xrefs: 00007FF8BEE1FD11
Windows.UI.Composition.DesktopWindowContentBridge, xrefs: 00007FF8BEE1FE17
Windows.UI.Input.InputSite.WindowClass, xrefs: 00007FF8BEE1FD94
WorkerW, xrefs: 00007FF8BEE1FF81

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Window$FindFreeString$AddressAncestorClassCreateHandleInstanceModuleNameOpenProcQueryValue
String ID: MSTaskListWClass$Taskbar.TaskbarFrameAutomationPeer$Windows.UI.Composition.DesktopWindowContentBridge$Windows.UI.Input.InputSite.WindowClass$WorkerW
API String ID: 1963979031-3829649249
Opcode ID: 395a62cfaa09d49961aa6f410cd0ab3f39cbac17818aa978afe4f4361d43f49e
Instruction ID: 75ea73011e548ecce1e4adf5100d8062d074aa470e08384ca57a0bc473c593f4
Opcode Fuzzy Hash: 395a62cfaa09d49961aa6f410cd0ab3f39cbac17818aa978afe4f4361d43f49e
Instruction Fuzzy Hash: 3BD16E36A08A8286EB908F29E45467A77A1FF85FD0F444131DF4E47A68DFBCD884D741

Function 00007FF8BEE50A50 Relevance: 37.1, APIs: 16, Strings: 5, Instructions: 327windowregistryCOMMON

Download Yara Rule

APIs

SHParseDisplayName.SHELL32 ref: 00007FF8BEE50AA1
SHBindToParent.SHELL32 ref: 00007FF8BEE50AC6
CreatePopupMenu.USER32 ref: 00007FF8BEE50B1B
TrackPopupMenuEx.USER32 ref: 00007FF8BEE50B80
RegQueryValueW.ADVAPI32 ref: 00007FF8BEE50C6A
RegQueryValueW.ADVAPI32 ref: 00007FF8BEE50D11
InsertMenuItemW.USER32 ref: 00007FF8BEE50DF6
DestroyMenu.USER32 ref: 00007FF8BEE50F8F
CoTaskMemFree.OLE32 ref: 00007FF8BEE50FB6

Strings

InfoTip, xrefs: 00007FF8BEE50C88, 00007FF8BEE50D2F
P, xrefs: 00007FF8BEE50F08
c, xrefs: 00007FF8BEE50E12
::{2CC5CA98-6485-489A-920E-B3E88A6CCCE3}, xrefs: 00007FF8BEE50A94
Software\Classes\CLSID\{2cc5ca98-6485-489a-920e-b3e88a6ccce3}, xrefs: 00007FF8BEE50C53, 00007FF8BEE50CFA

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Menu$PopupQueryValue$BindCreateDestroyDisplayFreeInsertItemNameParentParseTaskTrack
String ID: ::{2CC5CA98-6485-489A-920E-B3E88A6CCCE3}$InfoTip$P$Software\Classes\CLSID\{2cc5ca98-6485-489a-920e-b3e88a6ccce3}$c
API String ID: 3796425743-3612032762
Opcode ID: 9cd229d3631c545b0634ef201122fc31d9eccefe4e429930d42113ac2ce186df
Instruction ID: 0bebfd8b833288b2b388a3c2f74aa0b02b453f4b9e22578fb7d85f4cd25d932c
Opcode Fuzzy Hash: 9cd229d3631c545b0634ef201122fc31d9eccefe4e429930d42113ac2ce186df
Instruction Fuzzy Hash: E6E15172A08B558AE710CF65E8403AE77A4FB85B98F104235EB8D57B98DFBDE544CB00

Function 00007FF8BEE50750 Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 137networkfilesleepCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET ref: 00007FF8BEE50790
InternetOpenUrlA.WININET ref: 00007FF8BEE507C7
InternetReadFile.WININET ref: 00007FF8BEE50813
SHGetFolderPathW.SHELL32 ref: 00007FF8BEE50848

Part of subcall function 00007FF8BEE67E1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE67E45

CreateDirectoryW.KERNEL32 ref: 00007FF8BEE50869
GetLastError.KERNEL32 ref: 00007FF8BEE50873
ShellExecuteExW.SHELL32 ref: 00007FF8BEE50940
WaitForSingleObject.KERNEL32 ref: 00007FF8BEE50958
CloseHandle.KERNEL32 ref: 00007FF8BEE50962
Sleep.KERNEL32 ref: 00007FF8BEE5096D
DeleteFileW.KERNEL32 ref: 00007FF8BEE50977
InternetCloseHandle.WININET ref: 00007FF8BEE5098D
InternetCloseHandle.WININET ref: 00007FF8BEE5099E

Strings

https://go.microsoft.com/fwlink/p/?LinkId=2124703, xrefs: 00007FF8BEE507A7
\ExplorerPatcher, xrefs: 00007FF8BEE5084E
@, xrefs: 00007FF8BEE5090B
\MicrosoftEdgeWebview2Setup.exe, xrefs: 00007FF8BEE50884
p, xrefs: 00007FF8BEE508ED
ExplorerPatcher, xrefs: 00007FF8BEE5077D

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Internet$CloseHandle$FileOpen$CreateDeleteDirectoryErrorExecuteFolderLastObjectPathReadShellSingleSleepWait_invalid_parameter_noinfo
String ID: @$ExplorerPatcher$\ExplorerPatcher$\MicrosoftEdgeWebview2Setup.exe$https://go.microsoft.com/fwlink/p/?LinkId=2124703$p
API String ID: 2895610840-1819798696
Opcode ID: 73797eea3d20164ce8798a1fb41ad3299fb21ab335c1a1c90c84feb7e795d679
Instruction ID: 6f11c95ad0bf559dae9a73b8bdb69a3b42345101790f5e592508800a1e4e5559
Opcode Fuzzy Hash: 73797eea3d20164ce8798a1fb41ad3299fb21ab335c1a1c90c84feb7e795d679
Instruction Fuzzy Hash: 40617022A18B828AF710DFA4E8806AA73B1FB857C4F444235EB8D13B59DFBCE545C700

Function 00007FF8BEE1CAC0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF8BEE1CAF2
SymGetOptions.DBGHELP ref: 00007FF8BEE1CB02
SymSetOptions.DBGHELP ref: 00007FF8BEE1CB12
SymInitialize.DBGHELP ref: 00007FF8BEE1CB22
SymLoadModuleEx.DBGHELP ref: 00007FF8BEE1CB6F
SymCleanup.DBGHELP ref: 00007FF8BEE1CB82

Strings

Failed to open pool-size guide file., xrefs: 00007FF8BEE1CE0E

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Options$CleanupInfoInitializeLoadModuleSystem
String ID: Failed to open pool-size guide file.
API String ID: 4119312768-3392875237
Opcode ID: 683703a3d9c3a6bfb52f6d538efb8f5971c80577f3ec9791ce6834ea93cee3c5
Instruction ID: 79c4cda96abf7645210c1f87b56b5a813edb6ef469c166688b91422ab5c5ade6
Opcode Fuzzy Hash: 683703a3d9c3a6bfb52f6d538efb8f5971c80577f3ec9791ce6834ea93cee3c5
Instruction Fuzzy Hash: B791CE71A0CA428AE7649F2AA89037A76A1FF897D4F144139DB1E877D4DFBCE4018B00

Function 00007FF8BEE1EF90 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 94windowsleepregistryCOMMON

Download Yara Rule

APIs

GetStockObject.GDI32 ref: 00007FF8BEE1EFDD
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE1EFED
LoadCursorW.USER32 ref: 00007FF8BEE1F00E
RegisterClassW.USER32 ref: 00007FF8BEE1F021
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE1F029
CreateWindowExW.USER32 ref: 00007FF8BEE1F061
GetMessageW.USER32 ref: 00007FF8BEE1F083
TranslateMessage.USER32 ref: 00007FF8BEE1F09D
DispatchMessageW.USER32 ref: 00007FF8BEE1F0AB
GetMessageW.USER32 ref: 00007FF8BEE1F0C1
DestroyWindow.USER32 ref: 00007FF8BEE1F0CE
SHAppBarMessage.SHELL32 ref: 00007FF8BEE1F0EC
SHAppBarMessage.SHELL32 ref: 00007FF8BEE1F10D
Sleep.KERNEL32 ref: 00007FF8BEE1F118
SHAppBarMessage.SHELL32 ref: 00007FF8BEE1F137
SetEvent.KERNEL32 ref: 00007FF8BEE1F144

Strings

FixTaskbarAutohide_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FF8BEE1EFF3
0, xrefs: 00007FF8BEE1F0DC

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Message$HandleModuleWindow$ClassCreateCursorDestroyDispatchEventLoadObjectRegisterSleepStockTranslate
String ID: 0$FixTaskbarAutohide_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}
API String ID: 2692392126-3745785993
Opcode ID: 7414187e4b0defae1d7e8932077febe665ab2e6b2044caf150748a7d02bb3947
Instruction ID: e1cea2ec42ddaeaf9e99cb7fa8a73b9ec7810fdaf081d483b45834b8cbb3f9b5
Opcode Fuzzy Hash: 7414187e4b0defae1d7e8932077febe665ab2e6b2044caf150748a7d02bb3947
Instruction Fuzzy Hash: 96411332609B8286E7609B28F49436BB7E5FFC9784F404139D78E46AA8DFBCD455CB00

Function 00007FF8BEE47FB0 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 244windowsleepregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF8BEE48033
LoadCursorW.USER32 ref: 00007FF8BEE48048
GetStockObject.GDI32 ref: 00007FF8BEE48054
RegisterClassW.USER32 ref: 00007FF8BEE48071
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE48097
CreateWindowInBand.USER32 ref: 00007FF8BEE480DF
SetForegroundWindow.USER32 ref: 00007FF8BEE480EB
Sleep.KERNEL32 ref: 00007FF8BEE48115
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE4814F
LoadStringW.USER32 ref: 00007FF8BEE48166
GetMenuItemCount.USER32 ref: 00007FF8BEE48209
InsertMenuItemW.USER32 ref: 00007FF8BEE4821F
TrackPopupMenu.USER32 ref: 00007FF8BEE482AB
RemoveMenu.USER32 ref: 00007FF8BEE482ED
SendMessageW.USER32 ref: 00007FF8BEE4837C

Strings

ExplorerFrame.dll, xrefs: 00007FF8BEE48148
LauncherTipWnd, xrefs: 00007FF8BEE48062

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Menu$HandleModule$ItemLoadWindow$BandClassCountCreateCursorForegroundInsertMessageObjectPopupRegisterRemoveSendSleepStockStringTrack
String ID: ExplorerFrame.dll$LauncherTipWnd
API String ID: 1231917228-1828045394
Opcode ID: 1bfc0e6d2432d13c82b1688de0999442273069d06b19c670a1dc122881063ff4
Instruction ID: 5c272eaaba532fc67534f1371cd4d3026b130768d9948be81f648419f8e0c810
Opcode Fuzzy Hash: 1bfc0e6d2432d13c82b1688de0999442273069d06b19c670a1dc122881063ff4
Instruction Fuzzy Hash: D2C11732A09B428AEB508F69E8846AD37B4FB49B84F144139DF4D53BA8DFBDE454C704

Function 00007FF8BEE4E520 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 184librarymemorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BEE350C0: RegCreateKeyExW.KERNEL32 ref: 00007FF8BEE3511C
Part of subcall function 00007FF8BEE350C0: RegQueryValueExW.KERNEL32 ref: 00007FF8BEE35171
Part of subcall function 00007FF8BEE350C0: GetLocaleInfoW.KERNEL32 ref: 00007FF8BEE351BA
Part of subcall function 00007FF8BEE350C0: GetLocaleInfoW.KERNEL32 ref: 00007FF8BEE351D5
Part of subcall function 00007FF8BEE350C0: SetThreadPreferredUILanguages.KERNEL32 ref: 00007FF8BEE3528B
Part of subcall function 00007FF8BEE350C0: RegCloseKey.KERNEL32 ref: 00007FF8BEE3529B

SHGetFolderPathW.SHELL32 ref: 00007FF8BEE4E593

Part of subcall function 00007FF8BEE67E1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE67E45

LoadLibraryExW.KERNEL32 ref: 00007FF8BEE4E5C0
FindResourceW.KERNEL32 ref: 00007FF8BEE4E5DC
SizeofResource.KERNEL32 ref: 00007FF8BEE4E5EB
LoadResource.KERNEL32 ref: 00007FF8BEE4E5FA
LockResource.KERNEL32 ref: 00007FF8BEE4E606
LocalAlloc.KERNEL32 ref: 00007FF8BEE4E617
FreeResource.KERNEL32 ref: 00007FF8BEE4E631
VerQueryValueW.VERSION ref: 00007FF8BEE4E64B
LocalFree.KERNEL32 ref: 00007FF8BEE4E673
LoadStringW.USER32 ref: 00007FF8BEE4E708
LoadStringW.USER32 ref: 00007FF8BEE4E731
FreeLibrary.KERNEL32 ref: 00007FF8BEE4E7ED
SwitchToThread.KERNEL32 ref: 00007FF8BEE4E7F4

Strings

short, xrefs: 00007FF8BEE4E787
\ExplorerPatcher\ep_gui.dll, xrefs: 00007FF8BEE4E599
<toast scenario="reminder" activationType="protocol" launch="%s" duration="%s"><visual><binding template="ToastGeneric">, xrefs: 00007FF8BEE4E680

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Resource$Load$Free$InfoLibraryLocalLocaleQueryStringThreadValue$AllocCloseCreateFindFolderLanguagesLockPathPreferredSizeofSwitch_invalid_parameter_noinfo
String ID: <toast scenario="reminder" activationType="protocol" launch="%s" duration="%s"><visual><binding template="ToastGeneric">$\ExplorerPatcher\ep_gui.dll$short
API String ID: 2536480284-1480496686
Opcode ID: 546dd401a5a785c6189ead9ee2808d47ca486de53805b17c410101108a167512
Instruction ID: 7ca0f4758b93dd131d62cdb92c9e1530c16dd64e718a500c053e8508767a72c2
Opcode Fuzzy Hash: 546dd401a5a785c6189ead9ee2808d47ca486de53805b17c410101108a167512
Instruction Fuzzy Hash: 3A816E72A18B828AE710DF29D8402EA6760FB89BC4F409235DF4D57B65EF7CD689C700

Function 00007FF8BEE48A50 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 179comwindowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF8BEE48A9D
FindWindowExW.USER32 ref: 00007FF8BEE48AB3
FindWindowExW.USER32 ref: 00007FF8BEE48AD1
GetCursorPos.USER32 ref: 00007FF8BEE48AF0
MonitorFromPoint.USER32 ref: 00007FF8BEE48B09
FindWindowExW.USER32 ref: 00007FF8BEE48B2F
MonitorFromWindow.USER32 ref: 00007FF8BEE48B40
FindWindowExW.USER32 ref: 00007FF8BEE48B80
MonitorFromWindow.USER32 ref: 00007FF8BEE48B91
GetMonitorInfoW.USER32 ref: 00007FF8BEE48B9E
GetWindowRect.USER32 ref: 00007FF8BEE48BB0
CoCreateInstance.OLE32 ref: 00007FF8BEE48C16

Strings

Shell_TrayWnd, xrefs: 00007FF8BEE48AA8, 00007FF8BEE48B75
Start, xrefs: 00007FF8BEE48AC5
Shell_SecondaryTrayWnd, xrefs: 00007FF8BEE48B23

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Window$FindMonitor$From$CreateCursorInfoInstanceMessagePointRectSend
String ID: Shell_SecondaryTrayWnd$Shell_TrayWnd$Start
API String ID: 3957573836-2175658619
Opcode ID: 573fc64ee00478b95f05a34165616ccb99621e87a27078ec0dff16ef2da4c20c
Instruction ID: 9bad4c6f8bcf05c985de021202e91021677223c7e02da73040cf7562248f78d7
Opcode Fuzzy Hash: 573fc64ee00478b95f05a34165616ccb99621e87a27078ec0dff16ef2da4c20c
Instruction Fuzzy Hash: 96811A36B0AA428EEB04DF69E8546AD27B1FB49BC8F444436DE0E53B54DFB8E509C344

Function 00007FF8BEE1E860 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 173synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF8BEE1E8A0
OpenProcessToken.ADVAPI32 ref: 00007FF8BEE1E8B2
GetTokenInformation.ADVAPI32 ref: 00007FF8BEE1E8D8
GetLastError.KERNEL32 ref: 00007FF8BEE1E8E6
GetTokenInformation.ADVAPI32 ref: 00007FF8BEE1E923
GetLengthSid.ADVAPI32 ref: 00007FF8BEE1E936
CopySid.ADVAPI32 ref: 00007FF8BEE1E95D
DeriveAppContainerSidFromAppContainerName.USERENV ref: 00007FF8BEE1E986
SetEntriesInAclW.ADVAPI32 ref: 00007FF8BEE1EA19
InitializeSecurityDescriptor.ADVAPI32 ref: 00007FF8BEE1EA42
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF8BEE1EA5B
LocalFree.KERNEL32 ref: 00007FF8BEE1EA7D
CreateMutexW.KERNEL32 ref: 00007FF8BEE1EAB2
FreeSid.ADVAPI32 ref: 00007FF8BEE1EAE7

Strings

Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy, xrefs: 00007FF8BEE1E97F
[SMA] Advertising successful animations patching., xrefs: 00007FF8BEE1EABD
EPStart10_AnimationsPatched_{A6EA9C2D-4982-4827-9204-0AC532959F6D}, xrefs: 00007FF8BEE1EA95

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Token$ContainerDescriptorFreeInformationProcessSecurity$CopyCreateCurrentDaclDeriveEntriesErrorFromInitializeLastLengthLocalMutexNameOpen
String ID: EPStart10_AnimationsPatched_{A6EA9C2D-4982-4827-9204-0AC532959F6D}$Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy$[SMA] Advertising successful animations patching.
API String ID: 2912553727-3824306247
Opcode ID: 67a4896977f1f6b5f01e95a0108ce3667e873733a66159467d333c9119caa885
Instruction ID: 81011b44020113c65b809e52c62d907b02c4e6408f8a9354ffd0e2fb65337f6d
Opcode Fuzzy Hash: 67a4896977f1f6b5f01e95a0108ce3667e873733a66159467d333c9119caa885
Instruction Fuzzy Hash: 84711C22F09A428EFB509FA594403BD33A2BB45BD8F045539DF4D27A99DFBCE8858340

Function 00007FF8BEE22FD0 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 193registrylibrarysynchronizationCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32 ref: 00007FF8BEE23073

Part of subcall function 00007FF8BEE67E1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE67E45

LoadLibraryW.KERNEL32 ref: 00007FF8BEE2309A
GetProcAddress.KERNEL32 ref: 00007FF8BEE230B2

Part of subcall function 00007FF8BEE2DA80: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,00007FF8BEE230C8), ref: 00007FF8BEE2DB03
Part of subcall function 00007FF8BEE2DA80: K32GetModuleInformation.KERNEL32(?,?,?,?,?,?,?,00007FF8BEE230C8), ref: 00007FF8BEE2DB1A

WaitForSingleObject.KERNEL32 ref: 00007FF8BEE2322E
WaitForSingleObject.KERNEL32 ref: 00007FF8BEE23251
CloseHandle.KERNEL32 ref: 00007FF8BEE2325E
RegCreateKeyExW.ADVAPI32 ref: 00007FF8BEE232A8
RegCloseKey.ADVAPI32 ref: 00007FF8BEE232B7
Sleep.KERNEL32 ref: 00007FF8BEE232E0
CreateThread.KERNEL32 ref: 00007FF8BEE232FF
CoCreateInstance.OLE32 ref: 00007FF8BEE2331D

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\ImmersiveShell, xrefs: 00007FF8BEE2319C
DllGetClassObject, xrefs: 00007FF8BEE230A8
\ExplorerPatcher\pnidui.dll, xrefs: 00007FF8BEE23079
Control Panel\Quick Actions\Control Center\QuickActionsStateCapture\ExplorerPatcher, xrefs: 00007FF8BEE2327A
UseWin32BatteryFlyout, xrefs: 00007FF8BEE23185

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Create$CloseObjectSingleWait$AddressCurrentFolderHandleInformationInstanceLibraryLoadModulePathProcProcessSleepThread_invalid_parameter_noinfo
String ID: Control Panel\Quick Actions\Control Center\QuickActionsStateCapture\ExplorerPatcher$DllGetClassObject$SOFTWARE\Microsoft\Windows\CurrentVersion\ImmersiveShell$UseWin32BatteryFlyout$\ExplorerPatcher\pnidui.dll
API String ID: 1967696875-3120677660
Opcode ID: 76deef73a58d889c98fb0fe58a42bdb190874f7b1166fc5dcd388d57ab8f2e9f
Instruction ID: 8277c1d983c705231230ce52c302b6c49d49e706adb1475a5344694f2472fe0d
Opcode Fuzzy Hash: 76deef73a58d889c98fb0fe58a42bdb190874f7b1166fc5dcd388d57ab8f2e9f
Instruction Fuzzy Hash: A6912B31A08A438AEB609F69E89027AB7A1BF85BD5F404136DB4D477A4DFBCE545CB00

Function 00007FF8BEE13EF0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 147registrywindowCOMMON

Download Yara Rule

APIs

LoadKeyboardLayoutW.USER32 ref: 00007FF8BEE13F45
FindWindowW.USER32 ref: 00007FF8BEE13F57
PostMessageW.USER32 ref: 00007FF8BEE13F6B
RegOpenKeyExW.ADVAPI32 ref: 00007FF8BEE13FD2
RegQueryInfoKeyW.ADVAPI32 ref: 00007FF8BEE1401C
RegEnumKeyExW.ADVAPI32 ref: 00007FF8BEE14066
RegGetValueW.ADVAPI32 ref: 00007FF8BEE140D0
RegCloseKey.ADVAPI32 ref: 00007FF8BEE1413F

Strings

SimpleWindowSwitcher_{BEA057BB-66C7-4758-A610-FAE6013E9F98}, xrefs: 00007FF8BEE13F4D, 00007FF8BEE14117
%08x, xrefs: 00007FF8BEE13F27
Layout Id, xrefs: 00007FF8BEE14097
%04x, xrefs: 00007FF8BEE13F76, 00007FF8BEE13F97
SYSTEM\CurrentControlSet\Control\Keyboard Layouts, xrefs: 00007FF8BEE13FC4

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CloseEnumFindInfoKeyboardLayoutLoadMessageOpenPostQueryValueWindow
String ID: %04x$%08x$Layout Id$SYSTEM\CurrentControlSet\Control\Keyboard Layouts$SimpleWindowSwitcher_{BEA057BB-66C7-4758-A610-FAE6013E9F98}
API String ID: 3475777497-1477449099
Opcode ID: 9132b0ccc15526fe416643b61408110445139b31093ed296b2f54ec961a5aa36
Instruction ID: 58667db5bee2f5210da028ed73380acab44fb69a1818a895943753846104eb2e
Opcode Fuzzy Hash: 9132b0ccc15526fe416643b61408110445139b31093ed296b2f54ec961a5aa36
Instruction Fuzzy Hash: 56613A32B18A418EE760CBA9E8502AE73B5FB88788F804135DB4D53A98DFBCD545C741

Function 00007FF8BEE1DEA0 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 127sleepregistryCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF8BEE1DEE6
GetClassNameW.USER32 ref: 00007FF8BEE1DEFA
Sleep.KERNEL32 ref: 00007FF8BEE1DF3F
GetForegroundWindow.USER32 ref: 00007FF8BEE1DF57
GetClassNameW.USER32 ref: 00007FF8BEE1DF6B
GetForegroundWindow.USER32 ref: 00007FF8BEE1DFB7
GetClassNameW.USER32 ref: 00007FF8BEE1DFCE
RegDeleteTreeW.ADVAPI32 ref: 00007FF8BEE1E0AE
Sleep.KERNEL32 ref: 00007FF8BEE1E0BE

Strings

Ended "Check foreground window" thread., xrefs: 00007FF8BEE1E0C4
Windows.UI.Core.CoreWindow, xrefs: 00007FF8BEE1DF0C
Control Panel\Quick Actions\Control Center\QuickActionsStateCapture\ExplorerPatcher, xrefs: 00007FF8BEE1E0A0
Started "Check foreground window" thread., xrefs: 00007FF8BEE1DEC6

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ClassForegroundNameWindow$Sleep$DeleteTree
String ID: Control Panel\Quick Actions\Control Center\QuickActionsStateCapture\ExplorerPatcher$Ended "Check foreground window" thread.$Started "Check foreground window" thread.$Windows.UI.Core.CoreWindow
API String ID: 2021506011-749137266
Opcode ID: 1808324265e1b4f00a334f618b225b2f6f3dd276802baf1ad187983293bd0fd5
Instruction ID: c159a808439e8fbd407f45a37554d8fc201021308e1c3518bb07c7d3f659fca8
Opcode Fuzzy Hash: 1808324265e1b4f00a334f618b225b2f6f3dd276802baf1ad187983293bd0fd5
Instruction Fuzzy Hash: EC518425A08A5285E7A49B1DE4502BA7761FF85FE0F844331EB6E022E8DFBCE5D5C701

Function 00007FF8BEE1BFA0 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 124windowsleepcomCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00007FF8BEE1BFC7
CoInitialize.OLE32 ref: 00007FF8BEE1BFDB
GetStockObject.GDI32 ref: 00007FF8BEE1C025
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE1C035
LoadCursorW.USER32 ref: 00007FF8BEE1C059
RegisterClassW.USER32 ref: 00007FF8BEE1C06F
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE1C077
CoCreateInstance.OLE32 ref: 00007FF8BEE1C0F9
ShowWindow.USER32 ref: 00007FF8BEE1C125
GetMessageW.USER32 ref: 00007FF8BEE1C182
TranslateMessage.USER32 ref: 00007FF8BEE1C198
DispatchMessageW.USER32 ref: 00007FF8BEE1C1A6
GetMessageW.USER32 ref: 00007FF8BEE1C1BC

Strings

Started "Archive menu" thread., xrefs: 00007FF8BEE1BFCD
Ended "Archive menu" thread., xrefs: 00007FF8BEE1C1C6
ArchiveMenuWindowExplorer, xrefs: 00007FF8BEE1C03B

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Message$HandleModule$ClassCreateCursorDispatchInitializeInstanceLoadObjectRegisterShowSleepStockTranslateWindow
String ID: ArchiveMenuWindowExplorer$Ended "Archive menu" thread.$Started "Archive menu" thread.
API String ID: 3032281874-998171920
Opcode ID: 4d74fd6a2cf0da61cd4a5a624b44ad2ef64646f31e6ffc1b7f6495a8bcd5a8a7
Instruction ID: eeb17a78341e3c2d373b10149af66aa03e8989fbc201d723e1593688fce03ab6
Opcode Fuzzy Hash: 4d74fd6a2cf0da61cd4a5a624b44ad2ef64646f31e6ffc1b7f6495a8bcd5a8a7
Instruction Fuzzy Hash: 07511F32A1CB9586E7648F29F8543AA77B4FB89B84F404136DB8D83A68DF7CD055CB01

Function 00007FF8BEE22C20 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 177registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF8BEE22C9F
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE22CD9
RegCloseKey.ADVAPI32 ref: 00007FF8BEE22CE6
RegOpenKeyExW.ADVAPI32 ref: 00007FF8BEE22D1D
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE22D57
RegCloseKey.ADVAPI32 ref: 00007FF8BEE22D64
#410.COMCTL32 ref: 00007FF8BEE22DEB
#410.COMCTL32 ref: 00007FF8BEE22E20
#410.COMCTL32 ref: 00007FF8BEE22E42
LoadLibraryW.KERNEL32 ref: 00007FF8BEE22E9E
GetProcAddress.KERNEL32 ref: 00007FF8BEE22EAC
DwmSetWindowAttribute.DWMAPI ref: 00007FF8BEE22EE9

Strings

uxtheme.dll, xrefs: 00007FF8BEE22E97
SOFTWARE\Classes\CLSID\{056440FD-8568-48e7-A632-72157243B55B}\InProcServer32, xrefs: 00007FF8BEE22C8C, 00007FF8BEE22D0F
%x %x, xrefs: 00007FF8BEE22C65

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: #410$CloseOpenQueryValue$AddressAttributeLibraryLoadProcWindow
String ID: %x %x$SOFTWARE\Classes\CLSID\{056440FD-8568-48e7-A632-72157243B55B}\InProcServer32$uxtheme.dll
API String ID: 632063587-1665220535
Opcode ID: 8809ad294020f8f06136afa753102ba5cd89006bdd11ff1725bd4fad45c707f4
Instruction ID: 285920ab9f167966381fe2ad5197bac028655ae6751a1cdba861c5e17012ce51
Opcode Fuzzy Hash: 8809ad294020f8f06136afa753102ba5cd89006bdd11ff1725bd4fad45c707f4
Instruction Fuzzy Hash: AF818F31A19A428AEB608F59F88067973A1FF897D4F401136EB4E03BA4DFBCE445C700

Function 00007FF8BEE75E9C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF8BEE75EEA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE76556
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE766CC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE7698A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE76BAA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE76DE7
memcpy_s.LIBCPMT ref: 00007FF8BEE76EC2
memcpy_s.LIBCPMT ref: 00007FF8BEE76F6D
memcpy_s.LIBCPMT ref: 00007FF8BEE7703C

Strings

1#QNAN, xrefs: 00007FF8BEE76003
1#INF, xrefs: 00007FF8BEE76013
1#SNAN, xrefs: 00007FF8BEE75FFA
1#IND, xrefs: 00007FF8BEE75FD7

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: f88eb4196e8c090f5eb5e315b2a1c7141e7dd7be7d0b1abaa8dd61c5c7a18be6
Instruction ID: 12578c42ac2de4d99fd20653a300030ed47877ccf3f2a0d353796e9feb71514a
Opcode Fuzzy Hash: f88eb4196e8c090f5eb5e315b2a1c7141e7dd7be7d0b1abaa8dd61c5c7a18be6
Instruction Fuzzy Hash: FEB2AF72A182938FE7658F68D5807FD3BA1FB547C8F545135DB0E57A88DBB8AA00CB40

Function 00007FF8BEE12F60 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32 ref: 00007FF8BEE12F9B
SelectObject.GDI32 ref: 00007FF8BEE12FAA
CreateDIBSection.GDI32 ref: 00007FF8BEE13027
SelectObject.GDI32 ref: 00007FF8BEE13036
SetTextColor.GDI32 ref: 00007FF8BEE13050
SetBkColor.GDI32 ref: 00007FF8BEE1305B
SetBkMode.GDI32 ref: 00007FF8BEE13069
DrawTextW.USER32 ref: 00007FF8BEE13085
SelectObject.GDI32 ref: 00007FF8BEE1311D
SelectObject.GDI32 ref: 00007FF8BEE13133
DeleteDC.GDI32 ref: 00007FF8BEE1313C

Strings

(, xrefs: 00007FF8BEE13003

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ObjectSelect$ColorCreateText$CompatibleDeleteDrawModeSection
String ID: (
API String ID: 2711897886-3887548279
Opcode ID: d5834477a4f53630a89a527a8ccb016ae9399af608a247e866421f7ec8bb69b7
Instruction ID: 19338993e3d7c18e9f061cc168d7a5f75ad5315c4a6089c92708557b6182e551
Opcode Fuzzy Hash: d5834477a4f53630a89a527a8ccb016ae9399af608a247e866421f7ec8bb69b7
Instruction Fuzzy Hash: 8651C472A197818AE7548F19B45072ABBA1FBC6BD1F145139EF8A07B68CE7CD445CB00

Function 00007FF8BEE1DCF0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 87processCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FF8BEE1DD1E

Part of subcall function 00007FF8BEE67E1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE67E45

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF8BEE1DD5E
Process32FirstW.KERNEL32 ref: 00007FF8BEE1DD6F
OpenProcess.KERNEL32 ref: 00007FF8BEE1DDE1
QueryFullProcessImageNameW.KERNEL32 ref: 00007FF8BEE1DE0F
TerminateProcess.KERNEL32 ref: 00007FF8BEE1DE33
CloseHandle.KERNEL32 ref: 00007FF8BEE1DE41
Process32NextW.KERNEL32 ref: 00007FF8BEE1DE4F
CloseHandle.KERNEL32 ref: 00007FF8BEE1DE76

Strings

ShellExperienceHost.exe, xrefs: 00007FF8BEE1DD86
\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe, xrefs: 00007FF8BEE1DD24

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Process$CloseHandleProcess32$CreateDirectoryFirstFullImageNameNextOpenQuerySnapshotTerminateToolhelp32Windows_invalid_parameter_noinfo
String ID: ShellExperienceHost.exe$\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
API String ID: 2097983625-1597348990
Opcode ID: e77504712daa658222e008976812c4fb319a79a22b6bac21e37dec3d71f4fc77
Instruction ID: 951d1174af7a7aa37b0b275e58750bfe3f37c5d668804a7eb1a6cd03c07ce7f4
Opcode Fuzzy Hash: e77504712daa658222e008976812c4fb319a79a22b6bac21e37dec3d71f4fc77
Instruction Fuzzy Hash: 04419D61A0CA828AEB609B19E4443BA77A1FBD9B85F844131C74D53758DFBCD486C740

Function 00007FF8BEE120D0 Relevance: 16.6, APIs: 11, Instructions: 131registrywindowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjectsEx.USER32 ref: 00007FF8BEE1212E
PeekMessageW.USER32 ref: 00007FF8BEE12164
TranslateMessage.USER32 ref: 00007FF8BEE12173
DispatchMessageW.USER32 ref: 00007FF8BEE1217E
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE121A5
RegNotifyChangeKeyValue.ADVAPI32 ref: 00007FF8BEE121D2
RegQueryValueExW.ADVAPI32 ref: 00007FF8BEE12221
RegNotifyChangeKeyValue.ADVAPI32 ref: 00007FF8BEE1224F
GetLastError.KERNEL32 ref: 00007FF8BEE1227B
GetLastError.KERNEL32 ref: 00007FF8BEE12296
GetLastError.KERNEL32 ref: 00007FF8BEE122B1

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Value$ErrorLastMessage$ChangeNotifyQuery$DispatchMultipleObjectsPeekTranslateWait
String ID:
API String ID: 2018483580-0
Opcode ID: 5ed66558bf058ff837d0e89b5ba0056c682b7bb908da017999200782fc814397
Instruction ID: 807d0f0ccf2fcacbe79733509e1773b0305951bc78121455396b892ac4633f5f
Opcode Fuzzy Hash: 5ed66558bf058ff837d0e89b5ba0056c682b7bb908da017999200782fc814397
Instruction Fuzzy Hash: 44515B31A18A428AEBA09F39A85073E23A1FF49BC4F404535EB4D877A8DE7CD484D712

Function 00007FF8BEE49620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comserviceCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00007FF8BEE49697
IUnknown_QueryService.SHLWAPI ref: 00007FF8BEE4975A

Strings

TwinUIPatches.cpp, xrefs: 00007FF8BEE496AA, 00007FF8BEE496ED, 00007FF8BEE49785, 00007FF8BEE497E2, 00007FF8BEE49810
Shell_TrayWnd, xrefs: 00007FF8BEE4979D
IsAutoHideEnabled, xrefs: 00007FF8BEE497AF

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CreateInstanceQueryServiceUnknown_
String ID: IsAutoHideEnabled$Shell_TrayWnd$TwinUIPatches.cpp
API String ID: 2021386587-823477751
Opcode ID: 0d4cf4251d629bd5bcdbda7a598c23087cc7563604198a71409a10a2d132eceb
Instruction ID: 66bcb5aefd17b1544b521b54e80bff8662af00a91a3036ce7575009947a000f8
Opcode Fuzzy Hash: 0d4cf4251d629bd5bcdbda7a598c23087cc7563604198a71409a10a2d132eceb
Instruction Fuzzy Hash: 0C912726B05B0389EB11CFA9E8946AD27B0BB88BD8F545036DF0DA3B54DFB9D549C300

Function 00007FF8BEE4FCC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50sleepprocessCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00007FF8BEE4FCDE
GetWindowsDirectoryW.KERNEL32 ref: 00007FF8BEE4FCF1

Part of subcall function 00007FF8BEE67E1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE67E45

CreateProcessW.KERNEL32 ref: 00007FF8BEE4FD85
FreeConsole.KERNEL32 ref: 00007FF8BEE4FD8B
GetCurrentProcessId.KERNEL32 ref: 00007FF8BEE4FD91
OpenProcess.KERNEL32 ref: 00007FF8BEE4FDA1
TerminateProcess.KERNEL32 ref: 00007FF8BEE4FDAC

Strings

h, xrefs: 00007FF8BEE4FD13
\explorer.exe, xrefs: 00007FF8BEE4FCF7

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Process$ConsoleCreateCurrentDirectoryFreeOpenSleepTerminateWindows_invalid_parameter_noinfo
String ID: \explorer.exe$h
API String ID: 3466857667-2845133803
Opcode ID: cda5308915a13d06574020189d6d7aaf6b8acdb0efb87abf90eed449b8d0d85b
Instruction ID: 4f9b13e8eeebb5163bb931b9798fd550c577597f781eaa096bb78cfe245d136b
Opcode Fuzzy Hash: cda5308915a13d06574020189d6d7aaf6b8acdb0efb87abf90eed449b8d0d85b
Instruction Fuzzy Hash: 7521972291DBC187E360CB24F8943AA77A1FBD9384F515235D78D42A69EFBCD194CB00

Function 00007FF8BEE6B518 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BEE6B0FC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE6B13D
Part of subcall function 00007FF8BEE6B0FC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE6B1BB
Part of subcall function 00007FF8BEE6B0FC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE6B20C

CreateFileW.KERNEL32 ref: 00007FF8BEE6B61E
CreateFileW.KERNEL32 ref: 00007FF8BEE6B66E
GetLastError.KERNEL32 ref: 00007FF8BEE6B69E
GetFileType.KERNEL32 ref: 00007FF8BEE6B6B3
GetLastError.KERNEL32 ref: 00007FF8BEE6B6BD
CloseHandle.KERNEL32 ref: 00007FF8BEE6B6F0
CloseHandle.KERNEL32 ref: 00007FF8BEE6B853
CreateFileW.KERNEL32 ref: 00007FF8BEE6B888
GetLastError.KERNEL32 ref: 00007FF8BEE6B897

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: a1504f72b22edb44e8c50bebd93d8295a05326651a09e3343c6ef62df7a2d229
Instruction ID: c30adf1554c2e0d66bf6b1dd899119897d05d94f557958413bc0380ff7e9d503
Opcode Fuzzy Hash: a1504f72b22edb44e8c50bebd93d8295a05326651a09e3343c6ef62df7a2d229
Instruction Fuzzy Hash: 9BC1A036B28A418DEB10DFA9C4906AC3B61FB49BD8F014236DB1E5B794CF78E455C300

Function 00007FF8BEE23DA0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 50windowCOMMON

Download Yara Rule

APIs

FindWindowExW.USER32 ref: 00007FF8BEE23DD5
FindWindowExW.USER32 ref: 00007FF8BEE23DEF
FindWindowExW.USER32 ref: 00007FF8BEE23E09

Part of subcall function 00007FF8BEE48A50: SendMessageW.USER32 ref: 00007FF8BEE48A9D

SendMessageW.USER32 ref: 00007FF8BEE23E33

Strings

Shell_TrayWnd, xrefs: 00007FF8BEE23DCA
RebarWindow32, xrefs: 00007FF8BEE23DE3
MSTaskSwWClass, xrefs: 00007FF8BEE23DFD

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: FindWindow$MessageSend
String ID: MSTaskSwWClass$RebarWindow32$Shell_TrayWnd
API String ID: 1134572027-589293716
Opcode ID: 041a2b3641cbbbdc03d7a3709040c67ee58bbf39816446afd8bc18b7eef93851
Instruction ID: 9d747d6af8851e0276c29d1bbbfbabe5aa1d21e906d7513a29100dade928109e
Opcode Fuzzy Hash: 041a2b3641cbbbdc03d7a3709040c67ee58bbf39816446afd8bc18b7eef93851
Instruction Fuzzy Hash: DC110A22F0974348FB64DF5AB500579A790AFA9BE0F484535DF2D13794DEBCE405C600

Function 00007FF8BEE1D920 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49fileCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FF8BEE1D96D
FindFirstFileW.KERNEL32 ref: 00007FF8BEE1D999
FindClose.KERNEL32 ref: 00007FF8BEE1D9A8

Part of subcall function 00007FF8BEE12890: GetModuleHandleW.KERNEL32 ref: 00007FF8BEE128AF
Part of subcall function 00007FF8BEE12890: GetProcAddress.KERNEL32 ref: 00007FF8BEE128C8
Part of subcall function 00007FF8BEE12890: RegOpenKeyExW.KERNEL32 ref: 00007FF8BEE1293F
Part of subcall function 00007FF8BEE12890: RegQueryValueExW.KERNEL32 ref: 00007FF8BEE1296F

GetWindowsDirectoryW.KERNEL32 ref: 00007FF8BEE1D9D8

Part of subcall function 00007FF8BEE67E1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE67E45

FindFirstFileW.KERNEL32 ref: 00007FF8BEE1DA04

Strings

\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll, xrefs: 00007FF8BEE1D9DE
\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI.dll, xrefs: 00007FF8BEE1D973

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Find$DirectoryFileFirstWindows$AddressCloseHandleModuleOpenProcQueryValue_invalid_parameter_noinfo
String ID: \SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI.dll$\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll
API String ID: 658624814-2596525942
Opcode ID: 6c5b868dc1bf34b6c28b3f7524fa1cf5bfe44591df538ab63d43f70cc730ed1d
Instruction ID: 54712a5bfd640673c95555b058f97ee2cd7ba89f4169ebb51e704b9386d6a3e4
Opcode Fuzzy Hash: 6c5b868dc1bf34b6c28b3f7524fa1cf5bfe44591df538ab63d43f70cc730ed1d
Instruction Fuzzy Hash: 65212761A1C946CAEB60DB28E8953BA2360FB857A4F801636C36D425E9DFBCE54DC700

Function 00007FF8BEE2C7A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FF8BEE2C87F
VirtualProtect.KERNEL32 ref: 00007FF8BEE2C8AD
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE2C8B5

Part of subcall function 00007FF8BEE1D290: GetModuleHandleExW.KERNEL32 ref: 00007FF8BEE1D2C6
Part of subcall function 00007FF8BEE1D290: ImageDirectoryEntryToDataEx.DBGHELP ref: 00007FF8BEE1D2F9
Part of subcall function 00007FF8BEE1D290: FreeLibrary.KERNEL32 ref: 00007FF8BEE1D32F

IsOS.SHLWAPI ref: 00007FF8BEE2C8EF

Strings

IsOS, xrefs: 00007FF8BEE2C8C2
api-ms-win-shcore-sysinfo-l1-1-0.dll, xrefs: 00007FF8BEE2C8CC

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: HandleModuleProtectVirtual$DataDirectoryEntryFreeImageLibrary
String ID: IsOS$api-ms-win-shcore-sysinfo-l1-1-0.dll
API String ID: 2091478098-2234916554
Opcode ID: 6b358573e863f66accf665c2514cb36af2d49b1e3ec548bedf7df8385c2d80db
Instruction ID: 4afa85665e9494792082dc572082444204e56f3326f1b4e550bf643f681ce2e7
Opcode Fuzzy Hash: 6b358573e863f66accf665c2514cb36af2d49b1e3ec548bedf7df8385c2d80db
Instruction Fuzzy Hash: 4B31C061E2874A4AFF549B6CE45027E63A0AB9A7C0F401136EF8E87755EE7CF485C700

Function 00007FF8BEE51DC0 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8BEE51DDC
RtlCaptureContext.KERNEL32 ref: 00007FF8BEE51E09
RtlLookupFunctionEntry.NTDLL ref: 00007FF8BEE51E23
RtlVirtualUnwind.NTDLL ref: 00007FF8BEE51E64
IsDebuggerPresent.KERNEL32 ref: 00007FF8BEE51EB8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8BEE51ED5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8BEE51EE0

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 0ff271a4c701bbf6033e5704cb7c6d0518fb9b611d7ee93b3fd0d8e4a3c14bc8
Instruction ID: 372d43c2ac57068df3cc19d06a36abafef0a698f5d12c79946b21b15a7d68032
Opcode Fuzzy Hash: 0ff271a4c701bbf6033e5704cb7c6d0518fb9b611d7ee93b3fd0d8e4a3c14bc8
Instruction Fuzzy Hash: A3315072619F818AEB609F64E8903ED77A4FB85788F44403ADB4E47B98EF78D548C710

Function 00007FF8BEE6BC98 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF8BEE6BD11
RtlLookupFunctionEntry.NTDLL ref: 00007FF8BEE6BD29
RtlVirtualUnwind.NTDLL ref: 00007FF8BEE6BD64
IsDebuggerPresent.KERNEL32 ref: 00007FF8BEE6BD9D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8BEE6BDA7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8BEE6BDB2

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 0d78a5eae3021c1939b228a5a7ab56fae872cbbac2d3b6b93bf4593b7becebcd
Instruction ID: bcda87ed6c7126679783b5afb599f4913b7c302dac1c6b4b4d9259684de98dec
Opcode Fuzzy Hash: 0d78a5eae3021c1939b228a5a7ab56fae872cbbac2d3b6b93bf4593b7becebcd
Instruction Fuzzy Hash: 00316132618F818ADB60CF29E8802AE77A4FB89798F540135EB8D47B99DF7CD555CB00

Function 00007FF8BEE1DAC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32 ref: 00007FF8BEE1DB30

Part of subcall function 00007FF8BEE67E1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE67E45

FindFirstFileW.KERNEL32 ref: 00007FF8BEE1DB71
FindClose.KERNEL32 ref: 00007FF8BEE1DB83

Strings

\ExplorerPatcher\, xrefs: 00007FF8BEE1DB36

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Find$CloseFileFirstFolderPath_invalid_parameter_noinfo
String ID: \ExplorerPatcher\
API String ID: 409097378-431723071
Opcode ID: 8fc8b2df31c4937a697d720ca40b4ab76ec30407b439dca915a33157f5641370
Instruction ID: e07d1f51bc6f0e8c24f9ae614dd83a2b30f91b10d2e6dbb2f58d47f4f3759b41
Opcode Fuzzy Hash: 8fc8b2df31c4937a697d720ca40b4ab76ec30407b439dca915a33157f5641370
Instruction Fuzzy Hash: DA21BA74A19A8389FBA09B18E4857A62350FF853A4F404335D76D466D5EFBCE4448B01

Function 00007FF8BEE75A00 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF8BEE75A66
memcpy_s.LIBCPMT ref: 00007FF8BEE75A91

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 6ece3bf2e3de7ac94e8577948797fb429e9ad7f61c3a20ff0b65188140a0a1e3
Instruction ID: 9cdf747a432b850463dc610ffbfdde1a9f6cdb509adbb5ebf2cf353544016a03
Opcode Fuzzy Hash: 6ece3bf2e3de7ac94e8577948797fb429e9ad7f61c3a20ff0b65188140a0a1e3
Instruction Fuzzy Hash: FAC10472B186868BEB24CF59A08867ABB91F788BC4F449134DB5E47784DB7DF805CB40

Function 00007FF8BEE33F20 Relevance: 4.7, APIs: 3, Instructions: 203threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF8BEE3403E
IsDebuggerPresent.KERNEL32 ref: 00007FF8BEE34158
OutputDebugStringW.KERNEL32 ref: 00007FF8BEE341CC

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CurrentDebugDebuggerOutputPresentStringThread
String ID:
API String ID: 4268342597-0
Opcode ID: 24a735b4c34a409f7b606dd159bc0e4cbe70d88125f6b84e8338d42fd8f7ba12
Instruction ID: e43f60da7422aec6705dc49668dda39ee0e7a0c72b76f7b17b1681adda317655
Opcode Fuzzy Hash: 24a735b4c34a409f7b606dd159bc0e4cbe70d88125f6b84e8338d42fd8f7ba12
Instruction Fuzzy Hash: 39913B22A49B8689EB669F29A44037977E0FF59B84F088039DF8D47795DFBCE840C750

Function 00007FF8BEE79CA8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF8BEE79EF7
RaiseException.KERNEL32 ref: 00007FF8BEE79F08

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 33b5f88446811188be24c7ee3ece16ab8b6728ac5aa6439a19ff987fd023b6f6
Instruction ID: 98bba4e2db1fd07531e9ff28a8c569739c4d507546d4f656d8f18474c66c76c7
Opcode Fuzzy Hash: 33b5f88446811188be24c7ee3ece16ab8b6728ac5aa6439a19ff987fd023b6f6
Instruction Fuzzy Hash: 4BB11A73604B898EEB59CF2DC8863687BE0FB84B88F158925DB5D877A4CB7AD451C700

Function 00007FF8BEE64D94 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF8BEE64F02
, xrefs: 00007FF8BEE65144

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 7f7f0f120929ccdea9899b2c338e7cbab634a7cd6eadc8fc6190f4c66d452753
Instruction ID: bf5884e5a49c49689678ee9ac39062971f150e377018410678f7470fb775c824
Opcode Fuzzy Hash: 7f7f0f120929ccdea9899b2c338e7cbab634a7cd6eadc8fc6190f4c66d452753
Instruction Fuzzy Hash: 4FE1BC32A08A468EEB688F2D855053D37A1FF45BC8F241635DB0E0B794DFAAF856C750

Function 00007FF8BEE6EF24 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF8BEE6F0AE
e+000, xrefs: 00007FF8BEE6F031

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 330854c9a08150cabfdab81a219396c3ebe50cfdec1984435696eeed99272720
Instruction ID: fd7ab8cef4bf999f45416a2d54789d3fca53a85116157bfdb5eaba629056dda7
Opcode Fuzzy Hash: 330854c9a08150cabfdab81a219396c3ebe50cfdec1984435696eeed99272720
Instruction Fuzzy Hash: 12514862B186C54EE7648E39D9007697B91E744BD4F48D232CBA84BAD9CFBEE444C700

Function 00007FF8BEE3AFA0 Relevance: 2.6, APIs: 2, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF8BEE3AFEA
HeapFree.KERNEL32 ref: 00007FF8BEE3AFF7

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 397cc0cfb075c3a398c8066f0586cc517b594cbddd4d4c54da37e61c28dd83eb
Instruction ID: f988cc095ca5b802632dacf777f4e07dfcb36d523b918f79b96a860b73b82180
Opcode Fuzzy Hash: 397cc0cfb075c3a398c8066f0586cc517b594cbddd4d4c54da37e61c28dd83eb
Instruction Fuzzy Hash: 40110832E487418EE6629F3D54443792350DF85BD4F184234EF5D47289CF6DEC818B80

Function 00007FF8BEE73B58 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f6bc96b91ddc7bbe43804159f79f8a365c0aa0f865d8c690f71511676f0bc2b
Instruction ID: 663be1a22cd11d5f73137baf16d2e51fbff2c6178dd5b5c771d8af657f482f54
Opcode Fuzzy Hash: 0f6bc96b91ddc7bbe43804159f79f8a365c0aa0f865d8c690f71511676f0bc2b
Instruction Fuzzy Hash: EB51B122B087928DEB609F7AA8806AE7FA1EB447D4F144235EF5C67A99DF7CD4418700

Function 00007FF8BEE2A710 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SHBindToObject.SHELL32 ref: 00007FF8BEE2A729

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: BindObject
String ID:
API String ID: 761158930-0
Opcode ID: 77a18afadecf556dd972eab470cb3ef452f33122fe4faea18eb19b1da19a4fb6
Instruction ID: c2cc404a96886774c0a9329b39a13c7b1926d0180452dd7be6231149f7d3db09
Opcode Fuzzy Hash: 77a18afadecf556dd972eab470cb3ef452f33122fe4faea18eb19b1da19a4fb6
Instruction Fuzzy Hash: A3C01221A1499086D714AF2CE80159533A0FB44344FE00236D74D01634CF3CD226CA04

Function 00007FF8BEE6EA90 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF8BEE6EDD2

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 979d1181f7594ebf822099a0a5612bbac61939aaab7f8b04981634fabc0f27c1
Instruction ID: 000bd6a467390671428936e3aa33ae48f9b9959ac303f5e2b81d247f1f79a129
Opcode Fuzzy Hash: 979d1181f7594ebf822099a0a5612bbac61939aaab7f8b04981634fabc0f27c1
Instruction Fuzzy Hash: F1A11262A087C68EEB21CF29A4107BA7B91AB54BC4F059132DB8D477E5EE7DF601C701

Function 00007FF8BEE62584 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

, xrefs: 00007FF8BEE62760

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 17984e1ebf6f52c5a0321db0bad31f3c03a934e62f99aea7f1152076bbda42fb
Instruction ID: d7cc7ca57a27bea077c83cbc9b983fe5e3ffe6432d6bac01a413701ef93e8232
Opcode Fuzzy Hash: 17984e1ebf6f52c5a0321db0bad31f3c03a934e62f99aea7f1152076bbda42fb
Instruction Fuzzy Hash: B8B16B729087868EEB648F2D845427C3BA0EB4DB88F285139CB8E47395DFB9F441C705

Function 00007FF8BEE648D0 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2178eea6b8680db749bb71d76538e559eb16e91ce432e8ec1b5271ec405486a
Instruction ID: 8685307cce5a7a17d9cb2a45c3e3091fbe979aea97a0c0ab61c84a8d2106b773
Opcode Fuzzy Hash: e2178eea6b8680db749bb71d76538e559eb16e91ce432e8ec1b5271ec405486a
Instruction Fuzzy Hash: CFE19C26A082428EEA689E2DC14423D37A1FF45BD8F149235DB0E47799EFB9F941C320

Function 00007FF8BEE64094 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 340e75f0266e0d378c05b22f1ee62917085b474022d0ce01ce1f1d12fdc76c93
Instruction ID: 3c9d556c5ff4f2501b6b74d5190a2ef7fd0db73700f7a4ae256f405c777de0bf
Opcode Fuzzy Hash: 340e75f0266e0d378c05b22f1ee62917085b474022d0ce01ce1f1d12fdc76c93
Instruction Fuzzy Hash: 67E1AD32A086528EEB648E2CC55537D27A2FB55BD8F248235CF5D076D9CFA9F881C720

Function 00007FF8BEE56740 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f39e5ef37c5b5414bb101979ca6f9e1c30a57f72a5c07a720c26a61298b48f2
Instruction ID: 01a6be2bbe71596ec9ec67dfc2645d6c2ab2b8f1eccef0535c3df80eede9fb5c
Opcode Fuzzy Hash: 4f39e5ef37c5b5414bb101979ca6f9e1c30a57f72a5c07a720c26a61298b48f2
Instruction Fuzzy Hash: 35E1CCF2A2865B8AFBA48B19D494A7933E1EF117D4F51453AD74E026D0DFACF885C700

Function 00007FF8BEE62908 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 345ccf8cd4252f3a55f576e31a2e5bc1095e2b1d812b81be06e85700c894eb1b
Instruction ID: 2a3a681e520ba7e2f7dd516179e518e4ea083b4c0b1ac23127b0affdc5e2aa1c
Opcode Fuzzy Hash: 345ccf8cd4252f3a55f576e31a2e5bc1095e2b1d812b81be06e85700c894eb1b
Instruction Fuzzy Hash: 3BB16D72A08B868EE7658F3DC05427D3BA4EB49B88F244136CB4E47399DFB9E841D744

Function 00007FF8BEE6F5A4 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e032b8ac060ad56d4cc3c79350da94d72eac8fb95de0a81529a25f1222c0719d
Instruction ID: cf02af93e831aebff6e9185ed7ee7a898598aa20f44b28a880b546661e0f557a
Opcode Fuzzy Hash: e032b8ac060ad56d4cc3c79350da94d72eac8fb95de0a81529a25f1222c0719d
Instruction Fuzzy Hash: 2381BF72A0C7818EEA648F2DA48136A7A91FB857D4F144235DB8D4BB99CEBDF440DB00

Function 00007FF8BEE6AE7C Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 52bbc561e8fe88e190a298857a924aceae854a114574bbb2491837d3f5a802fc
Instruction ID: a6ef3c9ea8bc68d25771c25af488cd8474c5fc94ee4ea3588f291e70cd9ef886
Opcode Fuzzy Hash: 52bbc561e8fe88e190a298857a924aceae854a114574bbb2491837d3f5a802fc
Instruction Fuzzy Hash: 1161C562E186828EFBB48D6C84506796A81AF507E0F144739DB6D836CADFFDF8408641

Function 00007FF8BEE60C24 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f485472bae5642d5470b27c5e078dd4e8eb73021fab2440680da5292189602a
Instruction ID: ac7730a031e1a11c76c78ab5ea799d8f47851cc70099e6b3f3159d70e0798f23
Opcode Fuzzy Hash: 2f485472bae5642d5470b27c5e078dd4e8eb73021fab2440680da5292189602a
Instruction Fuzzy Hash: 325160729286668EEB758E2CD4047B837A0EF557A8F145231DF4E166D5CFBAF842C700

Function 00007FF8BEE605E0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 439f276b1413397f7f142482712c9eeee927416365c9294a628622bddf7bd18c
Instruction ID: 9be5cb1e5ccca7118c8a5f1fd6445302197be48ee33f4cadfe22ef019dd986d6
Opcode Fuzzy Hash: 439f276b1413397f7f142482712c9eeee927416365c9294a628622bddf7bd18c
Instruction Fuzzy Hash: 8C5181729286668EE7749E2CD0047B823A0EF547A8F145131EF5E0A6D5CFBEF842DB00

Function 00007FF8BEE6105C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12618e01884bb422ffe44993d2c0e325e5b76a32ee4f8b2e108ee2c27f4fb0fd
Instruction ID: 9b339fee57936561075fbcbc73b397768dd4c682e52e7630456f5e85978c5ee3
Opcode Fuzzy Hash: 12618e01884bb422ffe44993d2c0e325e5b76a32ee4f8b2e108ee2c27f4fb0fd
Instruction Fuzzy Hash: 6F515176A186918EEB658F2DC05422837B1EF45B98F248131EB4D577A4CBBAFC43C740

Function 00007FF8BEE60A18 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16c516e3a0276565f87fe481db8a8bcb5e444f78a4791365d5a28fcd3f107c61
Instruction ID: f1a971fdeea0818e1024dbbfdaea4a38068a686870ab09d5b67eed39ab9a261c
Opcode Fuzzy Hash: 16c516e3a0276565f87fe481db8a8bcb5e444f78a4791365d5a28fcd3f107c61
Instruction Fuzzy Hash: 77515176A286618EE7348F2DC05462937A1EB54BE8F248131DF4E177D4DBBAF842C780

Function 00007FF8BEE60E58 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3b021623e9cd736667b84619bb56e45e40fad27f771f98220594c04ecd20f52
Instruction ID: e31117165e127042b9dbd2551b8d1faacb27c89829d9c658134bb2f7597f8b12
Opcode Fuzzy Hash: e3b021623e9cd736667b84619bb56e45e40fad27f771f98220594c04ecd20f52
Instruction Fuzzy Hash: AE519F36A186658EEB758F2DC04033937A0EB54B98F285131DF4E577A9DBBAF842C740

Function 00007FF8BEE60814 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b0c69970595cca4d2fb942626faf43534a998a3ca76b9535475eda3edb5b80b
Instruction ID: 3cc28b8d82a6ea97517a6cbd4c079cc9c99b8d9774e7398ceeb40f1896349869
Opcode Fuzzy Hash: 3b0c69970595cca4d2fb942626faf43534a998a3ca76b9535475eda3edb5b80b
Instruction Fuzzy Hash: F4514F76A186618EE7358F2DC04423977A1EB84B98F249131CB8E57795CBBAFC52C780

Function 00007FF8BEE6CDBC Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4558579b3b747d72a223f50ebb4469eec35441a5fc377fded0730746195cd657
Instruction ID: 05ef5f6f972e35ee06c7aee2aba788aff4e0f0c501f48be1fe5910c60afb7992
Opcode Fuzzy Hash: 4558579b3b747d72a223f50ebb4469eec35441a5fc377fded0730746195cd657
Instruction Fuzzy Hash: 0D41F132714A548AEF48CF6ED95426973A1BB48FC0F48A036EF0D97B58DE7CE4428300

Function 00007FF8BEE5EF08 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a81995dc725e745c91ef68e5add537126b3069e5817d0a70891599fc14a6951d
Instruction ID: ac331ad4e12ef5fcc5a32d5bf77c3a432628e213c1a8f7a362eb6a2082b14a6f
Opcode Fuzzy Hash: a81995dc725e745c91ef68e5add537126b3069e5817d0a70891599fc14a6951d
Instruction Fuzzy Hash: DC316DB2618B858ADB608F29E0406BD77A5F788B88F644135DB8C4B760DF7AE092D704

Function 00007FF8BEE5F014 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dd18c2af8978401385c3a4d18cc3c4cea6f6c2de30805c37561c0fbe2471736
Instruction ID: 6fa3fdfac8356fe44fb1d70584352ec35be4fc783ab7c885b7b9844b39da2b73
Opcode Fuzzy Hash: 2dd18c2af8978401385c3a4d18cc3c4cea6f6c2de30805c37561c0fbe2471736
Instruction Fuzzy Hash: 2A316DB36087498ADB608F29E4406BD77A4F788B8CF244135DB8C0B755DB7AE492D704

Function 00007FF8BEE5EDFC Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cea8fc9d3c35b4ba6e35f22513a86051617c937147c9f35d60e5822ca5229d8
Instruction ID: bf17af3cc09604985a4074372901b82310c80c6bbc2603a467a492e91d55b508
Opcode Fuzzy Hash: 2cea8fc9d3c35b4ba6e35f22513a86051617c937147c9f35d60e5822ca5229d8
Instruction Fuzzy Hash: 9A3170B2518A95C9DB648F69E0406AD77E1F788B88F244135DB8C4B761DF7AE092C704

Function 00007FF8BEE5ECF0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0be54d3e76ecebf5695559a9301ce031daf8649420322fd1321f7c4f9ba610e9
Instruction ID: c7839f72a19a4b36d59252ef9eb69186483bb97e7bf9797c6a6e24d3f21d2bb1
Opcode Fuzzy Hash: 0be54d3e76ecebf5695559a9301ce031daf8649420322fd1321f7c4f9ba610e9
Instruction Fuzzy Hash: 033181B3608A958ADB648F29D4402AD7BE1F789B8CF245135DB8C4B761DF7AE052CB04

Function 00007FF8BEE5F54C Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b32a0ec8867fd1847959522346067af6a5e452e3e1d64f74d91d8c4bfa1493
Instruction ID: 77df917b5c1d1106cf25e223b2c95a88174b18f17018867459e234e6617c701f
Opcode Fuzzy Hash: a4b32a0ec8867fd1847959522346067af6a5e452e3e1d64f74d91d8c4bfa1493
Instruction Fuzzy Hash: CD3181B2609A45CADB208F2DE09026D77A0F788B88F244135DF8C4B761DF7AE452D704

Function 00007FF8BEE5F658 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18b6748ca6a6a0d51e118e82d35fb9f5821d58e468e74478334e5de39f486265
Instruction ID: 2d0414ea3e57127e74541c1e549d6f1bfc09fcb0bcc2ed81e8220ff5e60673c9
Opcode Fuzzy Hash: 18b6748ca6a6a0d51e118e82d35fb9f5821d58e468e74478334e5de39f486265
Instruction Fuzzy Hash: 2E3172B2518685CADB608F29E0406BD77E0FB58B8CF24413ADB4C4B761DF7AE092D704

Function 00007FF8BEE79AF0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e6cd7a5ca9aa2f8d717932288529d01fc50208ed9f3249ca50f6731b483e81c
Instruction ID: 330a5460af728fa7c8d463ba1ec356edb11e82b08b2e1374e5b7ced90b9ceffc
Opcode Fuzzy Hash: 6e6cd7a5ca9aa2f8d717932288529d01fc50208ed9f3249ca50f6731b483e81c
Instruction Fuzzy Hash: 0DF0FF71A196958EDBA88F3CB8426697BA1F7483C4F908139D78D83B14DA7D94618F04

Function 00007FF8BEE196F0 Relevance: 64.9, APIs: 36, Strings: 1, Instructions: 195synchronizationwindowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF8BEE19777
CloseHandle.KERNEL32 ref: 00007FF8BEE19784
CloseHandle.KERNEL32 ref: 00007FF8BEE197A3
CloseHandle.KERNEL32 ref: 00007FF8BEE197AD
CloseHandle.KERNEL32 ref: 00007FF8BEE197B7
CloseHandle.KERNEL32 ref: 00007FF8BEE197C0
FreeLibrary.KERNEL32 ref: 00007FF8BEE197CA
#386.COMCTL32 ref: 00007FF8BEE19860
UnhookWinEvent.USER32 ref: 00007FF8BEE19875
DestroyWindow.USER32 ref: 00007FF8BEE1987F
SetEvent.KERNEL32 ref: 00007FF8BEE19890
WaitForSingleObject.KERNEL32 ref: 00007FF8BEE198A2
CloseHandle.KERNEL32 ref: 00007FF8BEE198AF
CloseHandle.KERNEL32 ref: 00007FF8BEE198BC
SetEvent.KERNEL32 ref: 00007FF8BEE198C9
WaitForSingleObject.KERNEL32 ref: 00007FF8BEE198DB
CloseHandle.KERNEL32 ref: 00007FF8BEE198E8
CloseHandle.KERNEL32 ref: 00007FF8BEE198F5
BufferedPaintUnInit.UXTHEME ref: 00007FF8BEE198FB
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE19903
UnregisterClassW.USER32 ref: 00007FF8BEE19913
DeleteObject.GDI32 ref: 00007FF8BEE19920
DeleteObject.GDI32 ref: 00007FF8BEE1992D
DeleteObject.GDI32 ref: 00007FF8BEE1993A
DeleteObject.GDI32 ref: 00007FF8BEE19947
CloseThemeData.UXTHEME ref: 00007FF8BEE19954
GdiplusShutdown.GDIPLUS ref: 00007FF8BEE19961
DestroyIcon.USER32 ref: 00007FF8BEE1997F
FreeLibrary.KERNEL32 ref: 00007FF8BEE19998
FreeLibrary.KERNEL32 ref: 00007FF8BEE199B1
FreeLibrary.KERNEL32 ref: 00007FF8BEE199CA
FreeLibrary.KERNEL32 ref: 00007FF8BEE199E3
FreeLibrary.KERNEL32 ref: 00007FF8BEE199FC
FreeLibrary.KERNEL32 ref: 00007FF8BEE19A15
RoUninitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF8BEE19A46
CoUninitialize.OLE32 ref: 00007FF8BEE19A52

Strings

SimpleWindowSwitcher_{BEA057BB-66C7-4758-A610-FAE6013E9F98}, xrefs: 00007FF8BEE1990C

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CloseHandle$FreeLibrary$Object$Delete$DestroyEvent$SingleUninitializeWaitWindow$#386BufferedClassDataGdiplusIconInitModulePaintShutdownThemeUnhookUnregister
String ID: SimpleWindowSwitcher_{BEA057BB-66C7-4758-A610-FAE6013E9F98}
API String ID: 4090220598-648101266
Opcode ID: cf45190ffc6a625433c9a176bd6989e8bd087e80e78383ad2c7bfe856010b1c2
Instruction ID: e2902a93fa9ed4effc370416780f0de2fed28ed2be4224e426e88e981bcd4bd6
Opcode Fuzzy Hash: cf45190ffc6a625433c9a176bd6989e8bd087e80e78383ad2c7bfe856010b1c2
Instruction Fuzzy Hash: 1CB11736A19A828AEB44DF29E8942793370FF89FD5F044236DB0E57664CFADE495C310

Function 00007FF8BEE49CF0 Relevance: 56.4, APIs: 12, Strings: 20, Instructions: 369memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FF8BEE4A0FF
VirtualProtect.KERNEL32 ref: 00007FF8BEE4A120
VirtualProtect.KERNEL32 ref: 00007FF8BEE4A151
VirtualProtect.KERNEL32 ref: 00007FF8BEE4A172
VirtualProtect.KERNEL32 ref: 00007FF8BEE4A1A3
VirtualProtect.KERNEL32 ref: 00007FF8BEE4A1C4
VirtualProtect.KERNEL32 ref: 00007FF8BEE4A1F5
VirtualProtect.KERNEL32 ref: 00007FF8BEE4A216
VirtualProtect.KERNEL32 ref: 00007FF8BEE4A238
VirtualProtect.KERNEL32 ref: 00007FF8BEE4A258
VirtualProtect.KERNEL32 ref: 00007FF8BEE4A279
VirtualProtect.KERNEL32 ref: 00007FF8BEE4A299

Strings

[SMA] Not all offsets were found, cannot perform patch, xrefs: 00007FF8BEE4A2E1
[SMA] matchHideA in CStartExperienceManager::Hide() = %llX, xrefs: 00007FF8BEE49FAD, 00007FF8BEE4A025
[SMA] matchHideB in CStartExperienceManager::Hide() = %llX, xrefs: 00007FF8BEE4A069
[SMA] matchVtable = %llX, xrefs: 00007FF8BEE49D69
[SMA] CExperienceManagerAnimationHelper::End() = %llX, xrefs: 00007FF8BEE49F76
xxxxxx????x????xxxx, xrefs: 00007FF8BEE49EF9
xx????xx?xxxx, xrefs: 00007FF8BEE49E1C
xxxx????xxxx, xrefs: 00007FF8BEE49EBB
[SMA] CExperienceManagerAnimationHelper::Begin() = %llX, xrefs: 00007FF8BEE49F35
xxx????xxxxxxxxx, xrefs: 00007FF8BEE49D7B
[SMA] matchTransitioningToCortanaField = %llX, +0x%X, xrefs: 00007FF8BEE49E4A
xxxxxxxxxx, xrefs: 00007FF8BEE49F44
Failed to hook CStartExperienceManager::GetMonitorInformation(). rv = %d, xrefs: 00007FF8BEE4A2CE
xx?x????x?xxxx????xxx?x, xrefs: 00007FF8BEE49E6A
[SMA] CStartExperienceManager::GetMonitorInformation() = %llX, xrefs: 00007FF8BEE49EA5
xxxxxxx????xxxxxxxxx, xrefs: 00007FF8BEE49D18
[SMA] matchAnimationHelperFields = %llX, +0x%X, +0x%X, xrefs: 00007FF8BEE49DF0
[SMA] matchSingleViewShellExperienceFields = %llX, xrefs: 00007FF8BEE49DBC
x??xxxxxx, xrefs: 00007FF8BEE49F85, 00007FF8BEE49FBF, 00007FF8BEE49FFD, 00007FF8BEE4A03E
xxx????xx????xxxx, xrefs: 00007FF8BEE49DD1

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ProtectVirtual
String ID: Failed to hook CStartExperienceManager::GetMonitorInformation(). rv = %d$[SMA] CExperienceManagerAnimationHelper::Begin() = %llX$[SMA] CExperienceManagerAnimationHelper::End() = %llX$[SMA] CStartExperienceManager::GetMonitorInformation() = %llX$[SMA] Not all offsets were found, cannot perform patch$[SMA] matchAnimationHelperFields = %llX, +0x%X, +0x%X$[SMA] matchHideA in CStartExperienceManager::Hide() = %llX$[SMA] matchHideB in CStartExperienceManager::Hide() = %llX$[SMA] matchSingleViewShellExperienceFields = %llX$[SMA] matchTransitioningToCortanaField = %llX, +0x%X$[SMA] matchVtable = %llX$x??xxxxxx$xx????xx?xxxx$xx?x????x?xxxx????xxx?x$xxx????xx????xxxx$xxx????xxxxxxxxx$xxxx????xxxx$xxxxxx????x????xxxx$xxxxxxx????xxxxxxxxx$xxxxxxxxxx
API String ID: 544645111-3813412712
Opcode ID: db2ca1c07523192c2754963d3045411d7dae5b8228bd13c46922be45f88285eb
Instruction ID: 602124d1d8ecad7b4c927c5d76422a0229c5bdd5bfd58e19b5066807b0b35a5b
Opcode Fuzzy Hash: db2ca1c07523192c2754963d3045411d7dae5b8228bd13c46922be45f88285eb
Instruction Fuzzy Hash: A3028F75B19A439AEA50CF69E8446BA63A0FF847D4F444036DB4E07BA4EFBDE549C300

Function 00007FF8BEE3DE10 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 291COMMON

Download Yara Rule

APIs

WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE3DF66
WindowsCreateString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE3DF80
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE3DFBF
WindowsCreateString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE3DFDF
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE3E010
WindowsCreateString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE3E02A

Strings

StartUnpin, xrefs: 00007FF8BEE3E023
StartTileData.dll, xrefs: 00007FF8BEE3E0C7
StartPin, xrefs: 00007FF8BEE3DF79
Segoe Fluent Icons, xrefs: 00007FF8BEE3E169
StartMenuSettings.cpp, xrefs: 00007FF8BEE3DEA7, 00007FF8BEE3DEEA, 00007FF8BEE3DF43, 00007FF8BEE3DF97, 00007FF8BEE3DFFA, 00007FF8BEE3E041, 00007FF8BEE3E0A0, 00007FF8BEE3E18B, 00007FF8BEE3E1B1, 00007FF8BEE3E20A, 00007FF8BEE3E257, 00007FF8BEE3E2A1

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: StringWindows$CreateDelete
String ID: Segoe Fluent Icons$StartMenuSettings.cpp$StartPin$StartTileData.dll$StartUnpin
API String ID: 2860812039-2445808327
Opcode ID: daadf6d07ec153a719abb3e733125f686cc5486d9d144e8a72000cd9387bcf49
Instruction ID: 24ef9933ef021262dcd00fec511836304a0c48585cc146b1e21e745326cc19b2
Opcode Fuzzy Hash: daadf6d07ec153a719abb3e733125f686cc5486d9d144e8a72000cd9387bcf49
Instruction Fuzzy Hash: E3D1633AB09B429AE7669B69E4902B923A4FF94BD4F404132CF4D937A4DFBCE455C301

Function 00007FF8BEE2BC00 Relevance: 37.0, APIs: 12, Strings: 9, Instructions: 208memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FF8BEE2BC87
VirtualProtect.KERNEL32 ref: 00007FF8BEE2BCAB
VirtualProtect.KERNEL32 ref: 00007FF8BEE2BCED
VirtualProtect.KERNEL32 ref: 00007FF8BEE2BD3B
VirtualProtect.KERNEL32 ref: 00007FF8BEE2BD5F
VirtualProtect.KERNEL32 ref: 00007FF8BEE2BD9D
VirtualProtect.KERNEL32 ref: 00007FF8BEE2BDC1
VirtualProtect.KERNEL32 ref: 00007FF8BEE2BE68
VirtualProtect.KERNEL32 ref: 00007FF8BEE2BE88

Part of subcall function 00007FF8BEE12890: GetModuleHandleW.KERNEL32 ref: 00007FF8BEE128AF
Part of subcall function 00007FF8BEE12890: GetProcAddress.KERNEL32 ref: 00007FF8BEE128C8
Part of subcall function 00007FF8BEE12890: RegOpenKeyExW.KERNEL32 ref: 00007FF8BEE1293F
Part of subcall function 00007FF8BEE12890: RegQueryValueExW.KERNEL32 ref: 00007FF8BEE1296F

VirtualProtect.KERNEL32 ref: 00007FF8BEE2BEF4
VirtualProtect.KERNEL32 ref: 00007FF8BEE2BF3E
VirtualProtect.KERNEL32 ref: 00007FF8BEE2BF61

Strings

xx?xxxx?xxxx, xrefs: 00007FF8BEE2BE3A
xx??xx??x, xrefs: 00007FF8BEE2BC59, 00007FF8BEE2BCB4
xxxxxxxxxx, xrefs: 00007FF8BEE2BEBC
xx?xxx??x, xrefs: 00007FF8BEE2BDF6
xx?xxx??xx, xrefs: 00007FF8BEE2BE11
xx?xx?xx?x, xrefs: 00007FF8BEE2BDCA
xxxxxxx????x, xrefs: 00007FF8BEE2BF10
xx??xxx????xxxxxx????xx??x, xrefs: 00007FF8BEE2BD0D
xx??xxxxxxxx????x????xx??x, xrefs: 00007FF8BEE2BD68

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ProtectVirtual$AddressHandleModuleOpenProcQueryValue
String ID: xx??xx??x$xx??xxx????xxxxxx????xx??x$xx??xxxxxxxx????x????xx??x$xx?xx?xx?x$xx?xxx??x$xx?xxx??xx$xx?xxxx?xxxx$xxxxxxx????x$xxxxxxxxxx
API String ID: 1029361184-2251541617
Opcode ID: 044f627935ff8de0bb0f6f9492407accd689d468dc5f7e90265df4163516b2eb
Instruction ID: 034ac2386f7dbd762b400de7b7b798b57c211d84091c9936d17616f2a5bf9316
Opcode Fuzzy Hash: 044f627935ff8de0bb0f6f9492407accd689d468dc5f7e90265df4163516b2eb
Instruction Fuzzy Hash: EDA17F31A09A4B99FB20DF69E4506EA6390EF84BC4F94403ADB4D0B795DFBCE549C740

Function 00007FF8BEE139F0 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 265COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32 ref: 00007FF8BEE13A38
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE13A91
LoadStringW.USER32 ref: 00007FF8BEE13AAF
SetWindowTextW.USER32 ref: 00007FF8BEE13E8F
NotifyWinEvent.USER32 ref: 00007FF8BEE13EAA

Strings

ExplorerFrame.dll, xrefs: 00007FF8BEE13A8A
\rundll32.exe, xrefs: 00007FF8BEE13AE7
Desktop, xrefs: 00007FF8BEE13ABA
%s - 1 running window, xrefs: 00007FF8BEE13DCC
%s - %d running windows, xrefs: 00007FF8BEE13DC3
%s: %d of %d, xrefs: 00007FF8BEE13E65

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: TextWindow$EventHandleLoadModuleNotifyString
String ID: %s - %d running windows$%s - 1 running window$%s: %d of %d$Desktop$ExplorerFrame.dll$\rundll32.exe
API String ID: 686194620-3935714908
Opcode ID: 83b225e071095df5bde25635167391e81d8112e19932fd42b0c9defca7b3e116
Instruction ID: 8dd3e55f0bc88657066b2e873ddeebc5448e2890a1d3e4d84aaeef8eb8a422d4
Opcode Fuzzy Hash: 83b225e071095df5bde25635167391e81d8112e19932fd42b0c9defca7b3e116
Instruction Fuzzy Hash: 8BD18572B08B818AEBA4DF28D4843BA6760FB84BC5F414136DB4E476A4DFBCD589C741

Function 00007FF8BEE30B00 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 107registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BEE305A0: SetProcessDpiAwarenessContext.USER32 ref: 00007FF8BEE305CF
Part of subcall function 00007FF8BEE305A0: GetModuleFileNameW.KERNEL32 ref: 00007FF8BEE30612
Part of subcall function 00007FF8BEE305A0: GetCurrentDirectoryW.KERNEL32 ref: 00007FF8BEE30637
Part of subcall function 00007FF8BEE305A0: GetModuleHandleW.KERNEL32 ref: 00007FF8BEE30643

GetModuleFileNameW.KERNEL32 ref: 00007FF8BEE30B3D
GetLastError.KERNEL32 ref: 00007FF8BEE30B47
RegOpenKeyW.ADVAPI32 ref: 00007FF8BEE30B66
RegDeleteTreeW.ADVAPI32 ref: 00007FF8BEE30BBC
RegCloseKey.ADVAPI32 ref: 00007FF8BEE30BC9
RegDeleteTreeW.ADVAPI32 ref: 00007FF8BEE30BE1
PathRemoveExtensionW.SHLWAPI ref: 00007FF8BEE30BEC
PathRemoveExtensionW.SHLWAPI ref: 00007FF8BEE30BF7
RegOpenKeyW.ADVAPI32 ref: 00007FF8BEE30C26
RegDeleteTreeW.ADVAPI32 ref: 00007FF8BEE30C54
RegCloseKey.ADVAPI32 ref: 00007FF8BEE30C61
RegDeleteTreeW.ADVAPI32 ref: 00007FF8BEE30C7D
RegOpenKeyW.ADVAPI32 ref: 00007FF8BEE30C96
RegDeleteTreeW.ADVAPI32 ref: 00007FF8BEE30CB3
RegCloseKey.ADVAPI32 ref: 00007FF8BEE30CC0
RegDeleteTreeW.ADVAPI32 ref: 00007FF8BEE30CDC

Strings

SOFTWARE\WOW6432Node\Classes\CLSID\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FF8BEE30C1F, 00007FF8BEE30C6F
SOFTWARE\Classes\Drive\shellex\FolderExtensions\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FF8BEE30C8F, 00007FF8BEE30CCE
SOFTWARE\Classes\CLSID\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FF8BEE30B5F, 00007FF8BEE30BD3
.IA-32.dll, xrefs: 00007FF8BEE30BFD

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: DeleteTree$CloseModuleOpen$ExtensionFileNamePathRemove$AwarenessContextCurrentDirectoryErrorHandleLastProcess
String ID: .IA-32.dll$SOFTWARE\Classes\CLSID\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}$SOFTWARE\Classes\Drive\shellex\FolderExtensions\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}$SOFTWARE\WOW6432Node\Classes\CLSID\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}
API String ID: 3360383582-326433317
Opcode ID: f64e4be203137b9e086229eeb70c6ba62c2093a0a25a6fe8a7ec120515eced2d
Instruction ID: e89ad5a9567a58652e011463f84d1821f8301cd7ecb7cbebb1eeda74585c3d5b
Opcode Fuzzy Hash: f64e4be203137b9e086229eeb70c6ba62c2093a0a25a6fe8a7ec120515eced2d
Instruction Fuzzy Hash: AD514F65A1CB438AEB209B69E89437573A1FF847E4F405235DB5E427E8DFBCE509C600

Function 00007FF8BEE14910 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 219COMMON

Download Yara Rule

APIs

DwmSetWindowAttribute.DWMAPI ref: 00007FF8BEE149A4
DwmExtendFrameIntoClientArea.DWMAPI ref: 00007FF8BEE149BA
DwmSetWindowAttribute.DWMAPI ref: 00007FF8BEE14A19
DwmSetWindowAttribute.DWMAPI ref: 00007FF8BEE14A4B
GetWindowLongPtrW.USER32 ref: 00007FF8BEE14AE2
SetWindowLongPtrW.USER32 ref: 00007FF8BEE14B09
DeleteObject.GDI32 ref: 00007FF8BEE14C60
CreateSolidBrush.GDI32 ref: 00007FF8BEE14C80
DeleteObject.GDI32 ref: 00007FF8BEE14C99
CreateSolidBrush.GDI32 ref: 00007FF8BEE14CAF

Strings

Grid_backgroundPercent, xrefs: 00007FF8BEE14A95
[sws] Refreshing theme: %d, xrefs: 00007FF8BEE1497C
, xrefs: 00007FF8BEE14B1A
_, xrefs: 00007FF8BEE14A89
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MultitaskingView\AltTabViewHost, xrefs: 00007FF8BEE14AB5
&, xrefs: 00007FF8BEE149EF

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Window$Attribute$BrushCreateDeleteLongObjectSolid$AreaClientExtendFrameInto
String ID: $&$Grid_backgroundPercent$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MultitaskingView\AltTabViewHost$[sws] Refreshing theme: %d$_
API String ID: 97799080-1950453067
Opcode ID: 9393b053c4d075cf8f99e8848a50bc2322899e3625217ffce7b706919a739f9a
Instruction ID: 444a98f5066bfd1b32656a2be99c72650b4617fda0b91de668cb75c006dd4be6
Opcode Fuzzy Hash: 9393b053c4d075cf8f99e8848a50bc2322899e3625217ffce7b706919a739f9a
Instruction Fuzzy Hash: B4B16772B05A428DEB50CF69E8846AD33A1FB44B98F140136CE0E6B798DFBCD985C750

Function 00007FF8BEE2D5C0 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 124libraryloaderCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32 ref: 00007FF8BEE2D62B

Part of subcall function 00007FF8BEE67E1C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE67E45

LoadLibraryW.KERNEL32 ref: 00007FF8BEE2D667
LoadLibraryExW.KERNEL32 ref: 00007FF8BEE2D677
GetProcAddress.KERNEL32 ref: 00007FF8BEE2D6B5
GetProcAddress.KERNEL32 ref: 00007FF8BEE2D6E1
GetProcAddress.KERNEL32 ref: 00007FF8BEE2D748
GetProcAddress.KERNEL32 ref: 00007FF8BEE2D762
FreeLibrary.KERNEL32 ref: 00007FF8BEE2D7C8
FreeLibrary.KERNEL32 ref: 00007FF8BEE2D7E7

Strings

[TB] Using '%s', xrefs: 00007FF8BEE2D787
SetImmersiveMenuFunctions, xrefs: 00007FF8BEE2D758
[TB] '%s' not found, xrefs: 00007FF8BEE2D688
[TB] Failed to hook TrayUI_CreateInstance(), xrefs: 00007FF8BEE2D7B9
EP_TrayUI_CreateInstance, xrefs: 00007FF8BEE2D6CF
[TB] '%s' with version %d is not compatible, xrefs: 00007FF8BEE2D7D5
\ExplorerPatcher\, xrefs: 00007FF8BEE2D631
CopyExplorerSymbols, xrefs: 00007FF8BEE2D73E
GetVersion, xrefs: 00007FF8BEE2D6AB

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: AddressLibraryProc$FreeLoad$FolderPath_invalid_parameter_noinfo
String ID: CopyExplorerSymbols$EP_TrayUI_CreateInstance$GetVersion$SetImmersiveMenuFunctions$[TB] '%s' not found$[TB] '%s' with version %d is not compatible$[TB] Failed to hook TrayUI_CreateInstance()$[TB] Using '%s'$\ExplorerPatcher\
API String ID: 1805524761-1356000006
Opcode ID: 1705b4b008712e1c0c71abb03680cc93c227db6ce33f5a991fa1471fc99d2c22
Instruction ID: a3447f779bd265eaf64a2ae48c3a1d9d24db730ca786ae35ed9e8fe688272787
Opcode Fuzzy Hash: 1705b4b008712e1c0c71abb03680cc93c227db6ce33f5a991fa1471fc99d2c22
Instruction Fuzzy Hash: 45513B64A1AA438DFB909B6DEC943BA23A1AF897C0F444535DB0E466A5DEBCF449C700

Function 00007FF8BEE12A90 Relevance: 30.1, APIs: 20, Instructions: 145windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF8BEE12AB4
GetWindowLongPtrW.USER32 ref: 00007FF8BEE12ACA
GetWindow.USER32 ref: 00007FF8BEE12ADB
IsWindow.USER32 ref: 00007FF8BEE12AE7
GetWindowRect.USER32 ref: 00007FF8BEE12AF9
IsWindowVisible.USER32 ref: 00007FF8BEE12B02
IsRectEmpty.USER32 ref: 00007FF8BEE12B14
GetWindowRect.USER32 ref: 00007FF8BEE12B3E
IsWindowVisible.USER32 ref: 00007FF8BEE12B47
IsRectEmpty.USER32 ref: 00007FF8BEE12B5A
GetWindow.USER32 ref: 00007FF8BEE12B97
GetWindowLongPtrW.USER32 ref: 00007FF8BEE12BA8
GetWindow.USER32 ref: 00007FF8BEE12BCB
GetWindowLongPtrW.USER32 ref: 00007FF8BEE12BDC
GetWindowLongPtrW.USER32 ref: 00007FF8BEE12BEE
GetWindowLongPtrW.USER32 ref: 00007FF8BEE12C00
GetWindow.USER32 ref: 00007FF8BEE12C30
GetWindowLongPtrW.USER32 ref: 00007FF8BEE12C48
IsWindowVisible.USER32 ref: 00007FF8BEE12C5E
GetWindow.USER32 ref: 00007FF8BEE12C7E

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Window$Long$Rect$Visible$Empty
String ID:
API String ID: 2906060442-0
Opcode ID: 66cc9ca4c79e996306753c0dd50f51a4686b0854f08af43f0c4547588e5d6ee5
Instruction ID: ef0377e972b51cc72c970af49908094b3b2185e76501f8c39027fb544d9deb72
Opcode Fuzzy Hash: 66cc9ca4c79e996306753c0dd50f51a4686b0854f08af43f0c4547588e5d6ee5
Instruction Fuzzy Hash: 50513124B0DA038AFF949B2DAC5423A6695AF8ABD0F044034EF4E47794EFBCE585D305

Function 00007FF8BEE328F0 Relevance: 29.9, APIs: 2, Strings: 15, Instructions: 174windowthreadCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32 ref: 00007FF8BEE32A25
GetCurrentThreadId.KERNEL32 ref: 00007FF8BEE32AA6

Strings

[%hs], xrefs: 00007FF8BEE32B66
[%hs(%hs)], xrefs: 00007FF8BEE32B4D
%hs(%d) tid(%x) %08X %ws, xrefs: 00007FF8BEE32AC8
CallContext:[%hs] , xrefs: 00007FF8BEE32B26
LogHr, xrefs: 00007FF8BEE3298A
Msg:[%ws] , xrefs: 00007FF8BEE32B0B
Exception, xrefs: 00007FF8BEE329B6
LogNt, xrefs: 00007FF8BEE32991
ReturnHr, xrefs: 00007FF8BEE329A2
%hs(%u)\%hs!%p: , xrefs: 00007FF8BEE32A5A
ReturnNt, xrefs: 00007FF8BEE329A9
(caller: %p) , xrefs: 00007FF8BEE32A91
, xrefs: 00007FF8BEE32AF0
%hs!%p: , xrefs: 00007FF8BEE32A73
FailFast, xrefs: 00007FF8BEE3297D

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CurrentFormatMessageThread
String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%u)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$LogNt$Msg:[%ws] $ReturnHr$ReturnNt$[%hs(%hs)]$[%hs]
API String ID: 2411632146-1363043106
Opcode ID: 36d649823e87f82759339c66bbeb98b13633b0336a965d9817c984a93a51ef7b
Instruction ID: 6701efeec847719d551846d990e24b5499b7f209d7f9912c4fa6089eed8422f8
Opcode Fuzzy Hash: 36d649823e87f82759339c66bbeb98b13633b0336a965d9817c984a93a51ef7b
Instruction Fuzzy Hash: AE719B25A09B8289EB66CFA9A4406B963A4FF4CBC4F448536DF8D17768DFBCE541C340

Function 00007FF8BEE150A0 Relevance: 27.1, APIs: 18, Instructions: 148registrykeyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyExW.USER32 ref: 00007FF8BEE150C1
MapVirtualKeyW.USER32 ref: 00007FF8BEE150CE
RegisterHotKey.USER32 ref: 00007FF8BEE150EC
GetLastError.KERNEL32 ref: 00007FF8BEE150F6
RegisterHotKey.USER32 ref: 00007FF8BEE1512E
GetLastError.KERNEL32 ref: 00007FF8BEE15138
RegisterHotKey.USER32 ref: 00007FF8BEE15166
GetLastError.KERNEL32 ref: 00007FF8BEE15170
RegisterHotKey.USER32 ref: 00007FF8BEE151A8
GetLastError.KERNEL32 ref: 00007FF8BEE151B2
RegisterHotKey.USER32 ref: 00007FF8BEE151DD
GetLastError.KERNEL32 ref: 00007FF8BEE151E7
RegisterHotKey.USER32 ref: 00007FF8BEE1521F
GetLastError.KERNEL32 ref: 00007FF8BEE15229
RegisterHotKey.USER32 ref: 00007FF8BEE15257
GetLastError.KERNEL32 ref: 00007FF8BEE15261
RegisterHotKey.USER32 ref: 00007FF8BEE15299
GetLastError.KERNEL32 ref: 00007FF8BEE152A3

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ErrorLastRegister$Virtual
String ID:
API String ID: 270683995-0
Opcode ID: f250d1fb01da1be5f6057db7c8c30dccb8d4b538fcd040e7f71cd891657f74d4
Instruction ID: f9db54d312092a82fdb400d76aadf20553ffd8d8b8253aeb9da0217c28d23bf5
Opcode Fuzzy Hash: f250d1fb01da1be5f6057db7c8c30dccb8d4b538fcd040e7f71cd891657f74d4
Instruction Fuzzy Hash: F0515A24B09B438EF7A55BAA958033626A5BF55BD5F104138DB0D87790EFACE8988312

Function 00007FF8BEE22680 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 129COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FF8BEE226B4
GetAncestor.USER32 ref: 00007FF8BEE226C2
MapWindowPoints.USER32 ref: 00007FF8BEE226DB
GetParent.USER32 ref: 00007FF8BEE226F4
GetWindowTextW.USER32 ref: 00007FF8BEE22708

Part of subcall function 00007FF8BEE68004: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE68021

RemovePropW.USER32 ref: 00007FF8BEE22740
GetAncestor.USER32 ref: 00007FF8BEE22778
GetPropW.USER32 ref: 00007FF8BEE22789
FindWindowExW.USER32 ref: 00007FF8BEE227A9
DwmExtendFrameIntoClientArea.DWMAPI ref: 00007FF8BEE227BE
SetPropW.USER32 ref: 00007FF8BEE227D4
DwmSetWindowAttribute.DWMAPI ref: 00007FF8BEE2286A

Strings

FloatingWindow, xrefs: 00007FF8BEE2270E
Windows.UI.Composition.DesktopWindowContentBridge, xrefs: 00007FF8BEE2279D
EP_METB, xrefs: 00007FF8BEE22736, 00007FF8BEE227CA

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Window$Prop$Ancestor$AreaAttributeClientExtendFindFrameIntoParentPointsRectRemoveText_invalid_parameter_noinfo
String ID: EP_METB$FloatingWindow$Windows.UI.Composition.DesktopWindowContentBridge
API String ID: 1583271118-1647979291
Opcode ID: 53a8d3eddcce35e28cf9eb01f76bac162330d67d7152c2c4d55feb973546e689
Instruction ID: 6fc7e2c0e33a94c148add28dfeb0950adb4975f38b7b3a783ca48852646c2e9f
Opcode Fuzzy Hash: 53a8d3eddcce35e28cf9eb01f76bac162330d67d7152c2c4d55feb973546e689
Instruction Fuzzy Hash: 28514D75B0DA428AFB64CB29E89466E23A1FB897C0F504135DB4E43698EFBCE945C700

Function 00007FF8BEE146F0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 118windowCOMMON

Download Yara Rule

APIs

FindWindowExW.USER32 ref: 00007FF8BEE14758
PostMessageW.USER32 ref: 00007FF8BEE1476C
GetWindow.USER32 ref: 00007FF8BEE147E8
GetLastActivePopup.USER32 ref: 00007FF8BEE147F8
GetWindow.USER32 ref: 00007FF8BEE1484B
GetClassNameW.USER32 ref: 00007FF8BEE1485F
GetWindow.USER32 ref: 00007FF8BEE1488D
GetLastActivePopup.USER32 ref: 00007FF8BEE1489D
IsWindowVisible.USER32 ref: 00007FF8BEE148A9
SwitchToThisWindow.USER32 ref: 00007FF8BEE148CA
ShowWindow.USER32 ref: 00007FF8BEE148DE

Strings

[sws] Owner of window: %s, xrefs: 00007FF8BEE1486A
Shell_TrayWnd, xrefs: 00007FF8BEE14741
[sws] Last active popup: %s, xrefs: 00007FF8BEE1482B
[sws] Chosen window: %s, xrefs: 00007FF8BEE147C5

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Window$ActiveLastPopup$ClassFindMessageNamePostShowSwitchThisVisible
String ID: Shell_TrayWnd$[sws] Chosen window: %s$[sws] Last active popup: %s$[sws] Owner of window: %s
API String ID: 4254927367-3099396148
Opcode ID: 71ecf7340710745a63d3532cf271a1c267407e0aedfcf4d78fc2a0db5710b184
Instruction ID: 12ba4e8216d66197c4d2ec5c546e9f3c20598da46e211352e8564328e8e821d1
Opcode Fuzzy Hash: 71ecf7340710745a63d3532cf271a1c267407e0aedfcf4d78fc2a0db5710b184
Instruction Fuzzy Hash: EF514C65705B428AEF64DB19F8D836A63A0FB89BC5F440139CB4E07764EEBCE586C740

Function 00007FF8BEE29CC0 Relevance: 25.6, APIs: 17, Instructions: 134COMMON

Download Yara Rule

APIs

DrawThemeTextEx.UXTHEME ref: 00007FF8BEE29D31
GetBkColor.GDI32 ref: 00007FF8BEE29D57
GetTextColor.GDI32 ref: 00007FF8BEE29D63
SetBkMode.GDI32 ref: 00007FF8BEE29D77
GetForegroundWindow.USER32 ref: 00007FF8BEE29D81
GetWindowTextW.USER32 ref: 00007FF8BEE29D98
GetSysColor.USER32 ref: 00007FF8BEE29DEF
SetTextColor.GDI32 ref: 00007FF8BEE29DFA
SystemParametersInfoW.USER32 ref: 00007FF8BEE29E1A
CreateFontIndirectW.GDI32 ref: 00007FF8BEE29E43
SelectObject.GDI32 ref: 00007FF8BEE29E61
DrawTextW.USER32 ref: 00007FF8BEE29E86
SelectObject.GDI32 ref: 00007FF8BEE29E92
DeleteObject.GDI32 ref: 00007FF8BEE29E9B
SetBkColor.GDI32 ref: 00007FF8BEE29EA7
SetTextColor.GDI32 ref: 00007FF8BEE29EB4
SetBkMode.GDI32 ref: 00007FF8BEE29EC1

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ColorText$Object$DrawModeSelectWindow$CreateDeleteFontForegroundIndirectInfoParametersSystemTheme
String ID:
API String ID: 112896650-0
Opcode ID: 28ea8d5eae088f08772c9eeea65bd47154936fb48cf4d2d88fb7ccf376b3ff1c
Instruction ID: 35611e770fd83f19b401e0af72892c9f96c039fd62b1efb75387c0a7cd76080a
Opcode Fuzzy Hash: 28ea8d5eae088f08772c9eeea65bd47154936fb48cf4d2d88fb7ccf376b3ff1c
Instruction Fuzzy Hash: 3C515C75A0D6868AE7609F59E5843BEB7A0FB85BD4F404035DF8A03B58DFBCD4458B04

Function 00007FF8BEE2AF50 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 112registryCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00007FF8BEE2AF99
SetRect.USER32 ref: 00007FF8BEE2AFC7
SetRect.USER32 ref: 00007FF8BEE2AFF0
GetSystemMetrics.USER32 ref: 00007FF8BEE2AFFD
SetRect.USER32 ref: 00007FF8BEE2B01D
GetSystemMetrics.USER32 ref: 00007FF8BEE2B02D
RegGetValueW.ADVAPI32 ref: 00007FF8BEE2B08E
MonitorFromRect.USER32 ref: 00007FF8BEE2B0B6
GetMonitorInfoW.USER32 ref: 00007FF8BEE2B0E0

Strings

0, xrefs: 00007FF8BEE2B09B
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StuckRectsLegacy, xrefs: 00007FF8BEE2B071
Settings, xrefs: 00007FF8BEE2B058
0, xrefs: 00007FF8BEE2B094
(, xrefs: 00007FF8BEE2B0D3

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Rect$MetricsSystem$Monitor$FromInfoValue
String ID: ($0$0$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StuckRectsLegacy$Settings
API String ID: 2079259257-2463101083
Opcode ID: e3ba2d1712aa69b05d0cc4412f6e31071aec3149e790a87a1d63a65abc919344
Instruction ID: a22704d6857dc35ea393786a4a22336116d25f9ec62469d637869f8a9c77f705
Opcode Fuzzy Hash: e3ba2d1712aa69b05d0cc4412f6e31071aec3149e790a87a1d63a65abc919344
Instruction Fuzzy Hash: E8514071A09A418AF7608F18A45077EB7A0FF89794F544239DB8D46694DFFDE884CB00

Function 00007FF8BEE22990 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

#412.COMCTL32 ref: 00007FF8BEE229CE
GetParent.USER32 ref: 00007FF8BEE229E2
GetWindowTextW.USER32 ref: 00007FF8BEE229F6
GetAncestor.USER32 ref: 00007FF8BEE22A2C
GetPropW.USER32 ref: 00007FF8BEE22A3D
FindWindowExW.USER32 ref: 00007FF8BEE22A56
#413.COMCTL32 ref: 00007FF8BEE22AFF

Strings

FloatingWindow, xrefs: 00007FF8BEE229FC
Windows.UI.Composition.DesktopWindowContentBridge, xrefs: 00007FF8BEE22A4A
ReBarWindow32, xrefs: 00007FF8BEE22AC1

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Window$#412#413AncestorFindParentPropText
String ID: FloatingWindow$ReBarWindow32$Windows.UI.Composition.DesktopWindowContentBridge
API String ID: 2039485610-463711336
Opcode ID: 369f8016e642424fef891f88ad728505f4c3c86f333c5f316952f8b682ccd038
Instruction ID: afcc04fbb7d4d1a651d31c4a73eaeb700637e605d29bbb2b7c959293d16143bc
Opcode Fuzzy Hash: 369f8016e642424fef891f88ad728505f4c3c86f333c5f316952f8b682ccd038
Instruction Fuzzy Hash: 0D413861E09A8389FB749F2DA8847BD27A1BF8ABD4F440131CB4E17A94DEFCE445C201

Function 00007FF8BEE43510 Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 290libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,?,?,?,00007FF8BEE3BF73), ref: 00007FF8BEE43575
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,?,?,?,00007FF8BEE3BF73), ref: 00007FF8BEE43584
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,?,?,?,00007FF8BEE3BF73), ref: 00007FF8BEE435BF
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,?,?,?,00007FF8BEE3BF73), ref: 00007FF8BEE435CE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8BEE4392E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8BEE43934

Strings

CoIncrementMTAUsage, xrefs: 00007FF8BEE435C7
RoGetActivationFactory, xrefs: 00007FF8BEE4357D
DllGetActivationFactory, xrefs: 00007FF8BEE437FF
combase.dll, xrefs: 00007FF8BEE4356E, 00007FF8BEE435B8

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: AddressLibraryLoadProc_invalid_parameter_noinfo_noreturn
String ID: CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll
API String ID: 3318250257-4036682018
Opcode ID: 2ecc028865c093250c9af15a2ab985205f9ffb97af506014a12143e8977ba3ce
Instruction ID: 35078173d3b9ce3e79dfcd7f4fd1dcec0350c06a806540fd0a7f1f65c3d4a7b4
Opcode Fuzzy Hash: 2ecc028865c093250c9af15a2ab985205f9ffb97af506014a12143e8977ba3ce
Instruction Fuzzy Hash: 4CC17DA2B04A5298FF10DF69D4542BC27B1AF48BD4F514136DF1E67B99EEBCE4848300

Function 00007FF8BEE3C660 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 248synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32 ref: 00007FF8BEE3C68C
CreateSemaphoreExW.KERNEL32 ref: 00007FF8BEE3C7F0
CreateSemaphoreExW.KERNEL32 ref: 00007FF8BEE3C8FC

Part of subcall function 00007FF8BEE3C660: GetLastError.KERNEL32 ref: 00007FF8BEE3C82C
Part of subcall function 00007FF8BEE3C660: GetLastError.KERNEL32 ref: 00007FF8BEE3C83B
Part of subcall function 00007FF8BEE3C660: CloseHandle.KERNEL32 ref: 00007FF8BEE3C846
Part of subcall function 00007FF8BEE3C660: SetLastError.KERNEL32 ref: 00007FF8BEE3C85E
Part of subcall function 00007FF8BEE3C660: GetLastError.KERNEL32 ref: 00007FF8BEE3C935
Part of subcall function 00007FF8BEE3C660: GetLastError.KERNEL32 ref: 00007FF8BEE3C945
Part of subcall function 00007FF8BEE3C660: CloseHandle.KERNEL32 ref: 00007FF8BEE3C950
Part of subcall function 00007FF8BEE3C660: SetLastError.KERNEL32 ref: 00007FF8BEE3C964

Strings

_p0, xrefs: 00007FF8BEE3C786
wil, xrefs: 00007FF8BEE3C814, 00007FF8BEE3C920

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ErrorLast$CloseCreateHandleSemaphore$MutexRelease
String ID: _p0$wil
API String ID: 2058776845-1814513734
Opcode ID: 0bbe0559d9e991cd5449ebe1a6f247e5b3b03628726d68834933351cc75b0c74
Instruction ID: 1e09e1eac215035920c4b3768a612daf9ca8600f1ee353c4d36d867d258f5968
Opcode Fuzzy Hash: 0bbe0559d9e991cd5449ebe1a6f247e5b3b03628726d68834933351cc75b0c74
Instruction Fuzzy Hash: B091B126B19B828AEF629F69A45437A63A0FF85BD4F554035DB0E43794EFBCE405C310

Function 00007FF8BEE1C6A0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 137networkfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET ref: 00007FF8BEE1C6DB
InternetConnectA.WININET ref: 00007FF8BEE1C728
HttpOpenRequestA.WININET ref: 00007FF8BEE1C763
HttpSendRequestA.WININET ref: 00007FF8BEE1C7A8
InternetReadFile.WININET ref: 00007FF8BEE1C814
InternetReadFile.WININET ref: 00007FF8BEE1C853
InternetCloseHandle.WININET ref: 00007FF8BEE1C886
InternetCloseHandle.WININET ref: 00007FF8BEE1C88F
InternetCloseHandle.WININET ref: 00007FF8BEE1C8A4

Strings

GET, xrefs: 00007FF8BEE1C73F
Content-Type: application/octet-stream;, xrefs: 00007FF8BEE1C79E
msdl.microsoft.com, xrefs: 00007FF8BEE1C6F2
Microsoft-Symbol-Server/10.0.10036.206, xrefs: 00007FF8BEE1C6C4

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSend
String ID: Content-Type: application/octet-stream;$GET$Microsoft-Symbol-Server/10.0.10036.206$msdl.microsoft.com
API String ID: 1354133546-1066975914
Opcode ID: 41f018024b2e1402be402bf47874eb35f41585cc902095506f4f1b62b090ebe7
Instruction ID: 2a50084624d3fe1a5873f15bd8a6e3cd12161cb192f2543be4437ddc4573e4f8
Opcode Fuzzy Hash: 41f018024b2e1402be402bf47874eb35f41585cc902095506f4f1b62b090ebe7
Instruction Fuzzy Hash: A751B321A0C7428AE765CF1AA49076A67A0FF89BD0F540035EF9D47B95DFBDE441CB01

Function 00007FF8BEE2B7F0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 101windowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BEE509E0: RegOpenKeyExW.KERNEL32(?,?,?,?,?,?,?,00007FF8BEE1E4B6), ref: 00007FF8BEE50A1D
Part of subcall function 00007FF8BEE509E0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00007FF8BEE1E4B6), ref: 00007FF8BEE50A31

GetParent.USER32 ref: 00007FF8BEE2B84C
GetPropW.USER32 ref: 00007FF8BEE2B85C
GetParent.USER32 ref: 00007FF8BEE2B86A
GetClassWord.USER32 ref: 00007FF8BEE2B878
RegisterWindowMessageW.USER32 ref: 00007FF8BEE2B888
GetParent.USER32 ref: 00007FF8BEE2B895
GetClassWord.USER32 ref: 00007FF8BEE2B8A3
RegisterWindowMessageW.USER32 ref: 00007FF8BEE2B8B3
GetMenuItemInfoW.USER32 ref: 00007FF8BEE2B937

Strings

Progman, xrefs: 00007FF8BEE2B8A9
P, xrefs: 00007FF8BEE2B91F
DesktopWindow, xrefs: 00007FF8BEE2B855
WorkerW, xrefs: 00007FF8BEE2B87E

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Parent$ClassMessageRegisterWindowWord$CloseInfoItemMenuOpenProp
String ID: DesktopWindow$P$Progman$WorkerW
API String ID: 441032011-3530101500
Opcode ID: d55ce2ffcf2a4f3241980fd005d1ca55513be418a9bb4b15c64a6e555f1f0545
Instruction ID: 26b0660c05d5763b00faa5b4d92ce57b598dd3c11421653e99bfab163ed6e8a6
Opcode Fuzzy Hash: d55ce2ffcf2a4f3241980fd005d1ca55513be418a9bb4b15c64a6e555f1f0545
Instruction Fuzzy Hash: 66416035E0D6868AFB609B29A89077977A0BF85BC5F400139EF4E42B95DFBCE845C700

Function 00007FF8BEE46910 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 191registrylibraryloaderCOMMON

Download Yara Rule

APIs

WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE4695B
RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF8BEE46978
RegGetValueW.ADVAPI32 ref: 00007FF8BEE46A0B
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE46A42
GetProcAddress.KERNEL32 ref: 00007FF8BEE46A55
RegGetValueW.ADVAPI32 ref: 00007FF8BEE46AD5

Strings

Taskbar10.cpp, xrefs: 00007FF8BEE4698A, 00007FF8BEE469B6
WindowsUdk.UI.Themes.SystemVisualTheme, xrefs: 00007FF8BEE46954
dcomp.dll, xrefs: 00007FF8BEE46A3B
EnableTransparency, xrefs: 00007FF8BEE46AC0
SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize, xrefs: 00007FF8BEE469FD, 00007FF8BEE46AC7
ColorPrevalence, xrefs: 00007FF8BEE469F6

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Value$ActivationAddressCreateFactoryHandleModuleProcReferenceStringWindows
String ID: ColorPrevalence$EnableTransparency$SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize$Taskbar10.cpp$WindowsUdk.UI.Themes.SystemVisualTheme$dcomp.dll
API String ID: 342590677-1899219526
Opcode ID: eee946c798044d8251f7ca42235a50e41222e666ccdf69a85a8b8b51cb7d667b
Instruction ID: ae1a6e85c3d717329256821ac771921ec155bb2e33bfdc9cd476156f8e285f8a
Opcode Fuzzy Hash: eee946c798044d8251f7ca42235a50e41222e666ccdf69a85a8b8b51cb7d667b
Instruction Fuzzy Hash: F4913632A08A439EEB108FA9E4902AD33B5FB54788F408536DB4D57B94EFBCE558C750

Function 00007FF8BEE29060 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 175COMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF8BEE290A8
GetParent.USER32 ref: 00007FF8BEE290B1
GetAncestor.USER32 ref: 00007FF8BEE29209
GetClassNameW.USER32 ref: 00007FF8BEE29220
GetClassNameW.USER32 ref: 00007FF8BEE292E9

Strings

Shell_TrayWnd, xrefs: 00007FF8BEE292F7
CabinetWClass, xrefs: 00007FF8BEE29231
NotifyIconOverflowWindow, xrefs: 00007FF8BEE29127
SysTreeView32, xrefs: 00007FF8BEE291AE
SysListView32, xrefs: 00007FF8BEE29171
TrayNotifyWnd, xrefs: 00007FF8BEE290DD
ReBarWindow32, xrefs: 00007FF8BEE2929A

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ClassName$AncestorParent
String ID: CabinetWClass$NotifyIconOverflowWindow$ReBarWindow32$Shell_TrayWnd$SysListView32$SysTreeView32$TrayNotifyWnd
API String ID: 1386181033-4244482235
Opcode ID: ca88c2902e2076327cf4a345692ff7557c46ff9891392714a1ec89a9b70076fd
Instruction ID: 6e77c8d7899e4d51cb625a7bcc52af4398280fb26a54c6eb5d430aee32b778c0
Opcode Fuzzy Hash: ca88c2902e2076327cf4a345692ff7557c46ff9891392714a1ec89a9b70076fd
Instruction Fuzzy Hash: F8717152A085568AEAB49F1D94102BD33A1FB55FE0FC49132EF4D122D9EFBDDD85C201

Function 00007FF8BEE25770 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 122windowCOMMON

Download Yara Rule

APIs

TryEnterCriticalSection.KERNEL32 ref: 00007FF8BEE257A8
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE25843
LoadStringW.USER32 ref: 00007FF8BEE25861
SendMessageW.USER32 ref: 00007FF8BEE258B3
LeaveCriticalSection.KERNEL32 ref: 00007FF8BEE258CD
LeaveCriticalSection.KERNEL32 ref: 00007FF8BEE258DF
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE258F9
LoadStringW.USER32 ref: 00007FF8BEE25912
SendMessageW.USER32 ref: 00007FF8BEE2596C

Strings

pnidui.dll, xrefs: 00007FF8BEE2583C
(null), xrefs: 00007FF8BEE25826
H, xrefs: 00007FF8BEE2592B

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CriticalSection$HandleLeaveLoadMessageModuleSendString$Enter
String ID: (null)$H$pnidui.dll
API String ID: 3318607081-2376156319
Opcode ID: debec5b285005d5d4150191b1c7d40711cec09eeb1870b0a598bb594af1ce006
Instruction ID: ba331d7d4c112a08dad2a36057f3967c0d47e19587ade6278dc8de050942986a
Opcode Fuzzy Hash: debec5b285005d5d4150191b1c7d40711cec09eeb1870b0a598bb594af1ce006
Instruction Fuzzy Hash: E2514E32A19B818AEB508F29F48026A77A0FB89B84F544136DB8D43B64DFBDE545CB00

Function 00007FF8BEE215C0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32 ref: 00007FF8BEE215F4
FindWindowExW.USER32 ref: 00007FF8BEE21610
MonitorFromWindow.USER32 ref: 00007FF8BEE21621
MonitorFromPoint.USER32 ref: 00007FF8BEE2163B
GetMonitorInfoW.USER32 ref: 00007FF8BEE21649
FindWindowExW.USER32 ref: 00007FF8BEE21662
MonitorFromWindow.USER32 ref: 00007FF8BEE21673
GetMonitorInfoW.USER32 ref: 00007FF8BEE21681
GetWindowRect.USER32 ref: 00007FF8BEE21692

Strings

Shell_TrayWnd, xrefs: 00007FF8BEE21657
(, xrefs: 00007FF8BEE215E4
Shell_SecondaryTrayWnd, xrefs: 00007FF8BEE21604

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Monitor$Window$From$FindInfoPoint$Rect
String ID: ($Shell_SecondaryTrayWnd$Shell_TrayWnd
API String ID: 1776394408-174554928
Opcode ID: 6d46088ce248ca7634d0e92b99f1a14fa79c9da0a1fe91aab654d17432cdedd6
Instruction ID: f68ad7971bddec095ed255e23a61e034dd29cf492494a4cbd6ff1f42cdc827de
Opcode Fuzzy Hash: 6d46088ce248ca7634d0e92b99f1a14fa79c9da0a1fe91aab654d17432cdedd6
Instruction Fuzzy Hash: 1341E331B1D6418AEB608F29F90467E67A1EF89BD0F144135EE4E43B45DEFCE9858700

Function 00007FF8BEE1F530 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 92librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF8BEE1F547
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE1F560

Part of subcall function 00007FF8BEE1F230: RegGetValueW.KERNEL32 ref: 00007FF8BEE1F287

GetProcAddress.KERNEL32 ref: 00007FF8BEE1F59A

Part of subcall function 00007FF8BEE1F170: GetCurrentProcess.KERNEL32 ref: 00007FF8BEE1F190
Part of subcall function 00007FF8BEE1F170: K32GetModuleInformation.KERNEL32 ref: 00007FF8BEE1F1A7
Part of subcall function 00007FF8BEE1F170: VirtualProtect.KERNEL32 ref: 00007FF8BEE1F1F5
Part of subcall function 00007FF8BEE1F170: VirtualProtect.KERNEL32 ref: 00007FF8BEE1F214

WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE1F5CF
VirtualProtect.KERNEL32 ref: 00007FF8BEE1F63A
VirtualProtect.KERNEL32 ref: 00007FF8BEE1F671
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE1F692

Strings

Error in Windows11v22H2_combase_LoadLibraryExW on WindowsCreateStringReference, xrefs: 00007FF8BEE1F5D9
Error in Windows11v22H2_combase_LoadLibraryExW on DllGetActivationFactory, xrefs: 00007FF8BEE1F5A8
Windows.UI.Xaml.Hosting.WindowsXamlManager, xrefs: 00007FF8BEE1F5C8
Windows.UI.Xaml.dll, xrefs: 00007FF8BEE1F559
DllGetActivationFactory, xrefs: 00007FF8BEE1F582

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ProtectVirtual$ModuleStringWindows$AddressCreateCurrentDeleteHandleInformationLibraryLoadProcProcessReferenceValue
String ID: DllGetActivationFactory$Error in Windows11v22H2_combase_LoadLibraryExW on DllGetActivationFactory$Error in Windows11v22H2_combase_LoadLibraryExW on WindowsCreateStringReference$Windows.UI.Xaml.Hosting.WindowsXamlManager$Windows.UI.Xaml.dll
API String ID: 2113071911-1359692214
Opcode ID: f33fb8b91075de84eb5fc511b19a8dcb0b50f2b7fce2c8de30f4acace464332c
Instruction ID: aad044803ac936f580e3ee99c41ea4f7b84bba4ecde9f03b88b715334349e1e1
Opcode Fuzzy Hash: f33fb8b91075de84eb5fc511b19a8dcb0b50f2b7fce2c8de30f4acace464332c
Instruction Fuzzy Hash: 88417F26B19B4289EB90DF29F49016A6360FF89BC4F441032EB4E47B64DFBCE985C741

Function 00007FF8BEE3D6D0 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 334registryCOMMON

Download Yara Rule

APIs

RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF8BEE3D735
RegGetValueW.ADVAPI32 ref: 00007FF8BEE3D894
RegGetValueW.ADVAPI32 ref: 00007FF8BEE3D8EA
RegGetValueW.ADVAPI32 ref: 00007FF8BEE3D93A
RegGetValueW.ADVAPI32 ref: 00007FF8BEE3D9F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8BEE3DBDF

Strings

ShowFrequentList, xrefs: 00007FF8BEE3D864
VisiblePlaces, xrefs: 00007FF8BEE3D90D, 00007FF8BEE3D9D1
ShowRecentList, xrefs: 00007FF8BEE3D8BA
WindowsInternal.Shell.CDSProperties.StartGlobalProperties, xrefs: 00007FF8BEE3D6FF
SOFTWARE\Microsoft\Windows\CurrentVersion\Start, xrefs: 00007FF8BEE3D87B, 00007FF8BEE3D8D1, 00007FF8BEE3D927, 00007FF8BEE3D9E4

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Value$ActivationFactory_invalid_parameter_noinfo_noreturn
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Start$ShowFrequentList$ShowRecentList$VisiblePlaces$WindowsInternal.Shell.CDSProperties.StartGlobalProperties
API String ID: 3131312478-3545454060
Opcode ID: 90357dd1e44263d1c1741ab5e10f4e9b9e5c9bd5d94a6f9f79fd4c0e9e16146a
Instruction ID: cda954fddd2a3fba0084432082e60d988ed99bfa6c49e789dedf0b495b2a3855
Opcode Fuzzy Hash: 90357dd1e44263d1c1741ab5e10f4e9b9e5c9bd5d94a6f9f79fd4c0e9e16146a
Instruction Fuzzy Hash: CEF12672B09B069AEB119F69E4802ED33A5FB487C8F404136EB4D53B98EFB8E515C340

Function 00007FF8BEE29820 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 126registryCOMMON

Download Yara Rule

APIs

#328.COMCTL32 ref: 00007FF8BEE29923
OpenThemeDataForDpi.UXTHEME ref: 00007FF8BEE29939
#334.COMCTL32 ref: 00007FF8BEE29975
RegGetValueW.ADVAPI32 ref: 00007FF8BEE299C5
OpenThemeDataForDpi.UXTHEME ref: 00007FF8BEE29A19

Strings

TrayNotifyFlyout, xrefs: 00007FF8BEE299DE
Taskband2, xrefs: 00007FF8BEE298D0
TaskbarPearl, xrefs: 00007FF8BEE29859
TaskbarSD, xrefs: 00007FF8BEE2999B
TaskbarShowDesktop, xrefs: 00007FF8BEE29889
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF8BEE299B2

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: DataOpenTheme$#328#334Value
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced$Taskband2$TaskbarPearl$TaskbarSD$TaskbarShowDesktop$TrayNotifyFlyout
API String ID: 1534390305-1782666386
Opcode ID: f7a95dd60248838b5c2f8b5c4e0e5b8f0d60dec5600c5041dd50f3fbc17f3f28
Instruction ID: 4008b2ec2f7fe63e1994c40fd2a00c8c7a80cc8d62920d3ea6e77665bfb5ba6b
Opcode Fuzzy Hash: f7a95dd60248838b5c2f8b5c4e0e5b8f0d60dec5600c5041dd50f3fbc17f3f28
Instruction Fuzzy Hash: 8A518361A0865689FB689F19945027D73B0FF45FE0F885535EB4E426A8EFBDA881C210

Function 00007FF8BEE1FA30 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 96windowCOMMON

Download Yara Rule

APIs

LoadMenuW.USER32 ref: 00007FF8BEE1FA53
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE1FA5E
GetSubMenu.USER32 ref: 00007FF8BEE1FA94
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE1FACF
LoadStringW.USER32 ref: 00007FF8BEE1FAE6
GetMenuItemCount.USER32 ref: 00007FF8BEE1FB9F
InsertMenuItemW.USER32 ref: 00007FF8BEE1FBB6

Strings

ExplorerFrame.dll, xrefs: 00007FF8BEE1FAC8
b, xrefs: 00007FF8BEE1FB74
P, xrefs: 00007FF8BEE1FB6C
D/, xrefs: 00007FF8BEE1FB7D

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Menu$HandleItemLoadModule$CountInsertString
String ID: D/$ExplorerFrame.dll$P$b
API String ID: 1491413557-2753148976
Opcode ID: 8da2e0ef13cb1ac62032a24ed978333d563a1b7812b734e6865a6b43ed5f8496
Instruction ID: 528f040f4072544e4ea8ad6082b5a1d1a510386bbd1bf5efc15228660a9fe85d
Opcode Fuzzy Hash: 8da2e0ef13cb1ac62032a24ed978333d563a1b7812b734e6865a6b43ed5f8496
Instruction Fuzzy Hash: 6B418331A09B458AEB609F19E45476A73E0FF84B90F444139DB9D47B94EFBCE845CB40

Function 00007FF8BEE19560 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 86synchronizationwindowCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF8BEE19596
QueryPerformanceFrequency.KERNEL32 ref: 00007FF8BEE195D1
QueryPerformanceCounter.KERNEL32 ref: 00007FF8BEE195E0
GetTickCount.KERNEL32 ref: 00007FF8BEE195FB
QueryPerformanceFrequency.KERNEL32 ref: 00007FF8BEE19610
QueryPerformanceCounter.KERNEL32 ref: 00007FF8BEE1961F
GetTickCount.KERNEL32 ref: 00007FF8BEE19637
IsWindowVisible.USER32 ref: 00007FF8BEE19655
DwmSetWindowAttribute.DWMAPI ref: 00007FF8BEE19677
WaitForSingleObject.KERNEL32 ref: 00007FF8BEE19689

Strings

[sws] Delayed showing by %lld ms due to: user configuration., xrefs: 00007FF8BEE19642

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: PerformanceQuery$CountCounterFrequencyObjectSingleTickWaitWindow$AttributeVisible
String ID: [sws] Delayed showing by %lld ms due to: user configuration.
API String ID: 3340259983-850836316
Opcode ID: 93e57d240382d36971298e2f6fb32d0303e8c1185e93da05c63cb8323c29d6c8
Instruction ID: f6bc1ba817bd10f5db765e231140532e0d96d1f8072ff5bf3054b7d3408fce6c
Opcode Fuzzy Hash: 93e57d240382d36971298e2f6fb32d0303e8c1185e93da05c63cb8323c29d6c8
Instruction Fuzzy Hash: A0319322B0DA428AEB90DF29F49422A77A0FF85BD4F140135EB4E466A8DF7DE481C711

Function 00007FF8BEE2B990 Relevance: 19.3, APIs: 4, Strings: 7, Instructions: 62registryCOMMON

Download Yara Rule

APIs

RegGetValueW.ADVAPI32 ref: 00007FF8BEE2BA39
GetDpiForSystem.USER32 ref: 00007FF8BEE2BA5F
MulDiv.KERNEL32 ref: 00007FF8BEE2BA6F
GetSystemMetrics.USER32 ref: 00007FF8BEE2BA79

Strings

&, xrefs: 00007FF8BEE2B9EC
9, xrefs: 00007FF8BEE2BA4F
IconVerticalSpacing, xrefs: 00007FF8BEE2B9FD
Control Panel\Desktop\WindowMetrics, xrefs: 00007FF8BEE2BA18
IconSpacing, xrefs: 00007FF8BEE2B9F1
MinWidth, xrefs: 00007FF8BEE2B9E5
', xrefs: 00007FF8BEE2B9FA

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: System$MetricsValue
String ID: &$'$9$Control Panel\Desktop\WindowMetrics$IconSpacing$IconVerticalSpacing$MinWidth
API String ID: 1597967150-2735893900
Opcode ID: 191fad97566844dbb047568bc1ee29499f238f3586eeef47a5e0cc9316608776
Instruction ID: 1c4b4aa33c54c4ff6aa4a332135c61141ba2c89b4c66629ebe4420e284061680
Opcode Fuzzy Hash: 191fad97566844dbb047568bc1ee29499f238f3586eeef47a5e0cc9316608776
Instruction Fuzzy Hash: 70215171A0CB86CAEB608F18E4883AE73A0BF94790F900139D75D466A5DFBDE9488700

Function 00007FF8BEE1F6F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 137registrywindowtimeCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32 ref: 00007FF8BEE1F747
GetMessagePos.USER32 ref: 00007FF8BEE1F765
MonitorFromPoint.USER32 ref: 00007FF8BEE1F784
GetMonitorInfoW.USER32 ref: 00007FF8BEE1F7AC
RegGetValueW.ADVAPI32 ref: 00007FF8BEE1F881
RegSetKeyValueW.ADVAPI32 ref: 00007FF8BEE1F8BB
SetTimer.USER32 ref: 00007FF8BEE1F8DB

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF8BEE1F868, 00007FF8BEE1F8AD
TaskbarAl, xrefs: 00007FF8BEE1F851, 00007FF8BEE1F8A3
(, xrefs: 00007FF8BEE1F7A5

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: MonitorValue$ClientFromInfoMessagePointScreenTimer
String ID: ($SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$TaskbarAl
API String ID: 2953988541-3876653080
Opcode ID: 3d9653568afe72a3fbe7615afc0000f37ab072ddf69813c96f66c3d7dc0f7a43
Instruction ID: 992d58c8440bf8af687070d6bd0feb8f03f12da56c493fc8bf7b810d61b22e7a
Opcode Fuzzy Hash: 3d9653568afe72a3fbe7615afc0000f37ab072ddf69813c96f66c3d7dc0f7a43
Instruction Fuzzy Hash: D6518B32F19A118EF750CB68E4846FE32A1FF44798F500236DB0D56A88DFBCA985C781

Function 00007FF8BEE29AC0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

GetThemeMargins.UXTHEME ref: 00007FF8BEE29B33
FindWindowExW.USER32 ref: 00007FF8BEE29BED
GetWindowLongW.USER32 ref: 00007FF8BEE29C08
SetWindowLongW.USER32 ref: 00007FF8BEE29C1F
SetWindowLongW.USER32 ref: 00007FF8BEE29C34
FindWindowExW.USER32 ref: 00007FF8BEE29C4F
GetWindowLongW.USER32 ref: 00007FF8BEE29C65
SetWindowLongW.USER32 ref: 00007FF8BEE29C7C

Strings

Shell_TrayWnd, xrefs: 00007FF8BEE29BE2
Shell_SecondaryTrayWnd, xrefs: 00007FF8BEE29C43

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Window$Long$Find$MarginsTheme
String ID: Shell_SecondaryTrayWnd$Shell_TrayWnd
API String ID: 3366318519-1433838494
Opcode ID: 82b878cdfae58637eeee74e4c7c7519577973b9c5241908f0a99c884d6322e1b
Instruction ID: abaded276972a7ad12ce826b4ec3199c9d48ac7d7ed55e37efec400e2c218429
Opcode Fuzzy Hash: 82b878cdfae58637eeee74e4c7c7519577973b9c5241908f0a99c884d6322e1b
Instruction Fuzzy Hash: 2951A1729097858AEB608F29E84427D7791FB45BE8F049135CF490B798EFBED845C700

Function 00007FF8BEE48EF0 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FF8BEE49062
VirtualProtect.KERNEL32 ref: 00007FF8BEE490A0

Strings

[TC] blockEnd = %llX, xrefs: 00007FF8BEE49034
xxx??xxx?xx, xrefs: 00007FF8BEE48F99
[TC] rcMonitorAssignment = %llX, xrefs: 00007FF8BEE48FBB
xxx??xxxx?xx, xrefs: 00007FF8BEE48F48
xxx??xxxx?xxx, xrefs: 00007FF8BEE48F1A
xxx??xxx?xxx, xrefs: 00007FF8BEE48F6A
[TC] blockBegin = %llX, xrefs: 00007FF8BEE48FF5
[TC] Patched!, xrefs: 00007FF8BEE490A6

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ProtectVirtual
String ID: [TC] Patched!$[TC] blockBegin = %llX$[TC] blockEnd = %llX$[TC] rcMonitorAssignment = %llX$xxx??xxx?xx$xxx??xxx?xxx$xxx??xxxx?xx$xxx??xxxx?xxx
API String ID: 544645111-3560911239
Opcode ID: 8536186f3ccecee405d877c6a376b0fd8946795391bdb4ec87c6d0f1bbc39c2e
Instruction ID: 18dbcb8306ba7adfbbe54243f1b75ae06782b78c79ef2150446794808b76b8aa
Opcode Fuzzy Hash: 8536186f3ccecee405d877c6a376b0fd8946795391bdb4ec87c6d0f1bbc39c2e
Instruction Fuzzy Hash: C5519F61B096838CFB11DBAAE4542BE63A0AF44BD4F444132EB4C0779AEFBDE549C750

Function 00007FF8BEE535E0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF8BEE53616
GetMappedFileNameA.PSAPI ref: 00007FF8BEE5362D
GetModuleHandleExA.KERNEL32 ref: 00007FF8BEE536BD
GetCurrentProcess.KERNEL32 ref: 00007FF8BEE5374C

Strings

-> func %p in %.*s, xrefs: 00007FF8BEE5377C
func %p is in %.*s, xrefs: 00007FF8BEE53643
%, xrefs: 00007FF8BEE53684
relative jump to %p, xrefs: 00007FF8BEE53660
indirect jump to addresss at %p, xrefs: 00007FF8BEE53692
-> func %p, xrefs: 00007FF8BEE53790

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CurrentProcess$FileHandleMappedModuleName
String ID: -> func %p$ -> func %p in %.*s$ func %p is in %.*s$ indirect jump to addresss at %p$ relative jump to %p$%
API String ID: 3110908827-1828122181
Opcode ID: ca0a6748e9d3360911cfff6dcc7a3067248eed72ea2ca0493127803f5e3392c1
Instruction ID: 34266f57420d345edfd76de4884487da0a94d555b3c780201fe48829e4caa231
Opcode Fuzzy Hash: ca0a6748e9d3360911cfff6dcc7a3067248eed72ea2ca0493127803f5e3392c1
Instruction Fuzzy Hash: 9D5192E2E0968A99FF608B19A4503BA67E0AF49BC5F484039DB4D07799DFBCF4418700

Function 00007FF8BEE20C20 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 74windowCOMMON

Download Yara Rule

APIs

#412.COMCTL32 ref: 00007FF8BEE20C55
#413.COMCTL32 ref: 00007FF8BEE20C66
FindWindowW.USER32 ref: 00007FF8BEE20CAA
FindWindowW.USER32 ref: 00007FF8BEE20CD8
FindWindowExW.USER32 ref: 00007FF8BEE20D18
FindWindowExW.USER32 ref: 00007FF8BEE20D29
PostMessageW.USER32 ref: 00007FF8BEE20D43

Strings

Windows.UI.Core.CoreWindow, xrefs: 00007FF8BEE20CD1
Shell_TrayWnd, xrefs: 00007FF8BEE20D01
ClockFlyoutWindow, xrefs: 00007FF8BEE20CA3

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: FindWindow$#412#413MessagePost
String ID: ClockFlyoutWindow$Shell_TrayWnd$Windows.UI.Core.CoreWindow
API String ID: 103836485-3485964848
Opcode ID: 9364a2b72bd7c163b7fe69fec9ecf0bf22491a923e0361172d4ea33bd59ce873
Instruction ID: a6e6e129f774c222f69cc768793b309692fa8c9ce5cc4dff06bba48b602fd2d5
Opcode Fuzzy Hash: 9364a2b72bd7c163b7fe69fec9ecf0bf22491a923e0361172d4ea33bd59ce873
Instruction Fuzzy Hash: 9F318D74E0D6028EFB609F29A89567D2B61AF95BD0F544036CB0E126D5DEECF4858700

Function 00007FF8BEE29F10 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 65COMMON

Download Yara Rule

APIs

CompareStringOrdinal.KERNEL32 ref: 00007FF8BEE29F95
CompareStringOrdinal.KERNEL32 ref: 00007FF8BEE29FE2

Strings

::{BB06C0E4-D293-4F75-8A90-CB05B6477EEE}, xrefs: 00007FF8BEE29F32
::{7007ACC7-3202-11D1-AAD2-00805FC1270E}, xrefs: 00007FF8BEE29F65
::{7B81BE6A-CE2B-4676-A29E-EB907A5126C5}, xrefs: 00007FF8BEE29F24
::{A8A91A66-3A7D-4424-8D24-04E180695C7A}, xrefs: 00007FF8BEE29F7B
Advanced, xrefs: 00007FF8BEE29F70
::{8E908FC9-BECC-40F6-915B-F4CA0E70D03D}, xrefs: 00007FF8BEE29F5A
::{D450A8A1-9568-45C7-9C0E-B4F9FB4537BD}, xrefs: 00007FF8BEE29F39
::{17CD9488-1228-4B2F-88CE-4298E93E0966}, xrefs: 00007FF8BEE29F4B

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CompareOrdinalString
String ID: ::{17CD9488-1228-4B2F-88CE-4298E93E0966}$::{7007ACC7-3202-11D1-AAD2-00805FC1270E}$::{7B81BE6A-CE2B-4676-A29E-EB907A5126C5}$::{8E908FC9-BECC-40F6-915B-F4CA0E70D03D}$::{A8A91A66-3A7D-4424-8D24-04E180695C7A}$::{BB06C0E4-D293-4F75-8A90-CB05B6477EEE}$::{D450A8A1-9568-45C7-9C0E-B4F9FB4537BD}$Advanced
API String ID: 2409332303-3644713213
Opcode ID: 3a128c15991b5f54e83503e02f1281c5f4841b565b0b582a6547265550964596
Instruction ID: 6950332f6e494095af44cf270cbb28258d6a72e4cf7b6f33b17a5852691cb2a9
Opcode Fuzzy Hash: 3a128c15991b5f54e83503e02f1281c5f4841b565b0b582a6547265550964596
Instruction Fuzzy Hash: 10315A32A08B8289EB618F14E8842AD33A9FB487D0F550236DB9C27765DF7DE906C740

Function 00007FF8BEE4A7F0 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

TwinUIPatches.cpp, xrefs: 00007FF8BEE4A85D, 00007FF8BEE4A930, 00007FF8BEE4AA44, 00007FF8BEE4AB41, 00007FF8BEE4AC5C, 00007FF8BEE4AC87
VerticalAlign, xrefs: 00007FF8BEE4AAC7
Position, xrefs: 00007FF8BEE4A8A9
HorizontalAlign, xrefs: 00007FF8BEE4A9C6

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID:
String ID: HorizontalAlign$Position$TwinUIPatches.cpp$VerticalAlign
API String ID: 0-1987525340
Opcode ID: 86c452996285e88f0f32f2e0bd98455b9e5865fe2c50332be65b1a5cd41143f1
Instruction ID: b6b9cf7fd72b7a5dd323b75a1e0bc0e65b820528151c996372214b5b9d63b59e
Opcode Fuzzy Hash: 86c452996285e88f0f32f2e0bd98455b9e5865fe2c50332be65b1a5cd41143f1
Instruction Fuzzy Hash: BEF13336B18A468EF711CBBAD4506AD23B5AB89BD8F110536DF0DA7B94EE78D405C340

Function 00007FF8BEE46BD0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 272keyboardCOMMON

Download Yara Rule

APIs

AccessibleObjectFromWindow.OLEACC ref: 00007FF8BEE46C2B
AccessibleChildren.OLEACC ref: 00007FF8BEE46C71
SetPropW.USER32 ref: 00007FF8BEE46D36
GetKeyState.USER32 ref: 00007FF8BEE46F90
GetForegroundWindow.USER32 ref: 00007FF8BEE46F9B
SetPropW.USER32 ref: 00007FF8BEE46FCD
GetKeyState.USER32 ref: 00007FF8BEE46FDD
GetForegroundWindow.USER32 ref: 00007FF8BEE46FE8

Strings

EPTBLEN, xrefs: 00007FF8BEE46D2C, 00007FF8BEE46FC3

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Window$AccessibleForegroundPropState$ChildrenFromObject
String ID: EPTBLEN
API String ID: 242652104-515233689
Opcode ID: 19cb3f8b9309dde4596a65705deaba03d942f6790faeb5ebccd69a687ac3a77b
Instruction ID: f90416dd17aeb5182f4c9f4380a41c13d28c100d8495182a4765f1e5beac247b
Opcode Fuzzy Hash: 19cb3f8b9309dde4596a65705deaba03d942f6790faeb5ebccd69a687ac3a77b
Instruction Fuzzy Hash: 23D13B72A08B428AE714CF7DD4402AD77B1FB84798F605226EF8D57A68DF78E845CB00

Function 00007FF8BEE3CB70 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 237COMMON

Download Yara Rule

APIs

OpenSemaphoreW.KERNEL32 ref: 00007FF8BEE3CC73
GetLastError.KERNEL32 ref: 00007FF8BEE3CC86
OpenSemaphoreW.KERNEL32 ref: 00007FF8BEE3CD6F
CloseHandle.KERNEL32 ref: 00007FF8BEE3CDD7

Part of subcall function 00007FF8BEE3C9C0: WaitForSingleObject.KERNEL32 ref: 00007FF8BEE3C9E1

CloseHandle.KERNEL32 ref: 00007FF8BEE3CDF4
CloseHandle.KERNEL32 ref: 00007FF8BEE3CE22
CloseHandle.KERNEL32 ref: 00007FF8BEE3CE9C

Strings

_p0, xrefs: 00007FF8BEE3CC2E
wil, xrefs: 00007FF8BEE3CC9D, 00007FF8BEE3CCDC, 00007FF8BEE3CD8A, 00007FF8BEE3CDBD

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CloseHandle$OpenSemaphore$ErrorLastObjectSingleWait
String ID: _p0$wil
API String ID: 2347786691-1814513734
Opcode ID: 658d5da5be2d65d0a64760a8879232775a89bfe2652ae95c89e781813dd5dcb1
Instruction ID: 000fda7847b9bebc9d830b3af0ce784241ac928cb34c4a8e65224fee08e7d756
Opcode Fuzzy Hash: 658d5da5be2d65d0a64760a8879232775a89bfe2652ae95c89e781813dd5dcb1
Instruction Fuzzy Hash: AE919462B49B8289EF229F69E4542BA63A1FF84BC0F944536DB4D57794EF7CE401C310

Function 00007FF8BEE3E520 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 226COMMON

Download Yara Rule

APIs

WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE3E565
RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF8BEE3E582

Strings

WindowsInternal.Shell.UnifiedTile.CuratedTileCollections.CuratedTileCollectionManager, xrefs: 00007FF8BEE3E55E
StartPin, xrefs: 00007FF8BEE3E69F
StartMenuSettings.cpp, xrefs: 00007FF8BEE3E595, 00007FF8BEE3E5D1, 00007FF8BEE3E636, 00007FF8BEE3E671, 00007FF8BEE3E73F
Start.TileGrid, xrefs: 00007FF8BEE3E607

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ActivationCreateFactoryReferenceStringWindows
String ID: Start.TileGrid$StartMenuSettings.cpp$StartPin$WindowsInternal.Shell.UnifiedTile.CuratedTileCollections.CuratedTileCollectionManager
API String ID: 1966789792-2245281551
Opcode ID: 297cdcd0fa5751e38f8b4173c2d1ca68ead3741c106d6d747828a76f02c1754f
Instruction ID: 634bb7ec8e1825c843baab7170faa5277123cd968b150055a7066e4e311bbee8
Opcode Fuzzy Hash: 297cdcd0fa5751e38f8b4173c2d1ca68ead3741c106d6d747828a76f02c1754f
Instruction Fuzzy Hash: D3913B36B54B428AFB118BB9D8906AD27B4FB88BC8F501432DF0DA3B68DF78D5458350

Function 00007FF8BEE3C9C0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF8BEE3C9E1

Strings

wil, xrefs: 00007FF8BEE3C9F1, 00007FF8BEE3CA42, 00007FF8BEE3CAA7, 00007FF8BEE3CB02, 00007FF8BEE3CB34

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ObjectSingleWait
String ID: wil
API String ID: 24740636-1589926490
Opcode ID: 9a694e2a68fb19814e29b835e14bc2a27ed7f3b8424e4511df6a7ded76c7c385
Instruction ID: 7e2e97966dbc3a09ed910c66c6d65f2677501d77f65ac00a7cbb5463ebe2568f
Opcode Fuzzy Hash: 9a694e2a68fb19814e29b835e14bc2a27ed7f3b8424e4511df6a7ded76c7c385
Instruction Fuzzy Hash: 7341A231A8CA438AF7619B2DF8442BA6391EF847C8F204531DB4F82A94EEBCE5458710

Function 00007FF8BEE2CC00 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FF8BEE2CC22

Part of subcall function 00007FF8BEE1D290: GetModuleHandleExW.KERNEL32 ref: 00007FF8BEE1D2C6
Part of subcall function 00007FF8BEE1D290: ImageDirectoryEntryToDataEx.DBGHELP ref: 00007FF8BEE1D2F9
Part of subcall function 00007FF8BEE1D290: FreeLibrary.KERNEL32 ref: 00007FF8BEE1D32F

GetCurrentProcess.KERNEL32 ref: 00007FF8BEE2CC79
K32GetModuleInformation.KERNEL32 ref: 00007FF8BEE2CC90

Strings

StartTileData.dll, xrefs: 00007FF8BEE2CC1B
api-ms-win-core-winrt-l1-1-0.dll, xrefs: 00007FF8BEE2CC3C
StartMenuSettings.cpp, xrefs: 00007FF8BEE2CC9F
xxxxxxxxxxxxxxxxx?xxx????xxx????xxxxxxxxx?xx?xx?xx?xxx, xrefs: 00007FF8BEE2CCB6
Failed to hook UnifiedTilePinUnpinVerbProvider::GetVerbs(). rv = %d, xrefs: 00007FF8BEE2CD04
RoGetActivationFactory, xrefs: 00007FF8BEE2CC32

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: LibraryModule$CurrentDataDirectoryEntryFreeHandleImageInformationLoadProcess
String ID: Failed to hook UnifiedTilePinUnpinVerbProvider::GetVerbs(). rv = %d$RoGetActivationFactory$StartMenuSettings.cpp$StartTileData.dll$api-ms-win-core-winrt-l1-1-0.dll$xxxxxxxxxxxxxxxxx?xxx????xxx????xxxxxxxxx?xx?xx?xx?xxx
API String ID: 2511907732-536516541
Opcode ID: 4f4503dd63b28e12f0db4223783623e8cc06f67312a36792264eb7e77a43a89b
Instruction ID: fdb8b65deb601e33941d6aa2a353cb45eed652def0ac338ee64518d40fe874d2
Opcode Fuzzy Hash: 4f4503dd63b28e12f0db4223783623e8cc06f67312a36792264eb7e77a43a89b
Instruction Fuzzy Hash: 01317C60A09A479AEB509F69E8901BA23A0BF847C4F504236DB0E577A5EFFCE545C780

Function 00007FF8BEE2CB00 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FF8BEE2CB1C
GetCurrentProcess.KERNEL32 ref: 00007FF8BEE2CB25
K32GetModuleInformation.KERNEL32 ref: 00007FF8BEE2CB3C

Part of subcall function 00007FF8BEE1D460: GetModuleHandleExW.KERNEL32 ref: 00007FF8BEE1D494
Part of subcall function 00007FF8BEE1D460: VirtualProtect.KERNEL32 ref: 00007FF8BEE1D538
Part of subcall function 00007FF8BEE1D460: VirtualProtect.KERNEL32 ref: 00007FF8BEE1D55B
Part of subcall function 00007FF8BEE1D460: FreeLibrary.KERNEL32 ref: 00007FF8BEE1D566

Strings

x?xxxx????xxx, xrefs: 00007FF8BEE2CB63
CAppResolverCacheBuilder::_AddUserPinnedShortcutToStart() = %llX, xrefs: 00007FF8BEE2CB9B
api-ms-win-core-winrt-l1-1-0.dll, xrefs: 00007FF8BEE2CB53
RoGetActivationFactory, xrefs: 00007FF8BEE2CB4C
AppResolver.dll, xrefs: 00007FF8BEE2CB15
Failed to hook CAppResolverCacheBuilder::_AddUserPinnedShortcutToStart(). rv = %d, xrefs: 00007FF8BEE2CBDC

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: LibraryModuleProtectVirtual$CurrentFreeHandleInformationLoadProcess
String ID: AppResolver.dll$CAppResolverCacheBuilder::_AddUserPinnedShortcutToStart() = %llX$Failed to hook CAppResolverCacheBuilder::_AddUserPinnedShortcutToStart(). rv = %d$RoGetActivationFactory$api-ms-win-core-winrt-l1-1-0.dll$x?xxxx????xxx
API String ID: 1174645330-3507426587
Opcode ID: 49c857abb259f8ab9d2353d70d94a63c221da5e82275cd52eb6cd3e6f3a37cca
Instruction ID: ced70ca3748850267279b13f4f486ec757d5cb9a1285e21954e506e168b453dd
Opcode Fuzzy Hash: 49c857abb259f8ab9d2353d70d94a63c221da5e82275cd52eb6cd3e6f3a37cca
Instruction Fuzzy Hash: 8C213C60E19A4B99EA409B6CE8952F633A0BF847D4F944136D70E4B3A5EEBCF545C340

Function 00007FF8BEE68FB8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE68FFB
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE693E8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE69684

Strings

-, xrefs: 00007FF8BEE69091
p, xrefs: 00007FF8BEE69125
p, xrefs: 00007FF8BEE690AD
f, xrefs: 00007FF8BEE6911D
:, xrefs: 00007FF8BEE691B4

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: fe036fb941fb11473cd2be1db92a5320d12a8278ca9cccc6ab9bb90505469060
Instruction ID: 74c95e08b428e17494bd42ca091525da029dbfbf628e587ee07f41289b2f0ed3
Opcode Fuzzy Hash: fe036fb941fb11473cd2be1db92a5320d12a8278ca9cccc6ab9bb90505469060
Instruction Fuzzy Hash: 3C128261A0C2838EFB249E1CE0542BA77A1FB407D4F944135D79A476D8DFBEF8808B14

Function 00007FF8BEE5FA58 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE5FA98
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE5FE60
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE600FF

Strings

f, xrefs: 00007FF8BEE5FB30
f, xrefs: 00007FF8BEE5FCE5
p, xrefs: 00007FF8BEE5FB3D
p, xrefs: 00007FF8BEE5FBA2
f, xrefs: 00007FF8BEE5FB9A

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 5aec86bda318b381c8cda5d7efe2f57a5f961980edc2432a172610ea84918a7a
Instruction ID: c82050057ef12a030e68e7e1f34d5852ea35f7409ee3077e2e7cc2307018c19f
Opcode Fuzzy Hash: 5aec86bda318b381c8cda5d7efe2f57a5f961980edc2432a172610ea84918a7a
Instruction Fuzzy Hash: 9F1294A2E0C1578EFB609E18D0547B976A2FB417D4F944435EB9A4A6C8DFBCF880DB10

Function 00007FF8BEE14CF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 214COMMON

Download Yara Rule

APIs

StretchDIBits.GDI32 ref: 00007FF8BEE14E0C
StretchDIBits.GDI32 ref: 00007FF8BEE14E68
StretchDIBits.GDI32 ref: 00007FF8BEE14EC2
StretchDIBits.GDI32 ref: 00007FF8BEE14F69
StretchDIBits.GDI32 ref: 00007FF8BEE14FC3
StretchDIBits.GDI32 ref: 00007FF8BEE15015
StretchDIBits.GDI32 ref: 00007FF8BEE15065

Strings

, xrefs: 00007FF8BEE1501B

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: BitsStretch
String ID:
API String ID: 350495539-3916222277
Opcode ID: 88013bc2f38c8630722a96bcdcbf496357a59567b54d77f66b0e4f362f12a11e
Instruction ID: 3032af873494123cae5df416cb77f75c85b746f027fd1a80ae8c0d36629f8ddc
Opcode Fuzzy Hash: 88013bc2f38c8630722a96bcdcbf496357a59567b54d77f66b0e4f362f12a11e
Instruction Fuzzy Hash: D1A120B26187C08ED7108F65F48465EBBB4F789398F205329EA8963B68DB7DD055CF40

Function 00007FF8BEE217A0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 196windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BEE1D750: QueryPerformanceFrequency.KERNEL32 ref: 00007FF8BEE1D768
Part of subcall function 00007FF8BEE1D750: QueryPerformanceCounter.KERNEL32 ref: 00007FF8BEE1D777

GetClassNameW.USER32 ref: 00007FF8BEE21818
WindowFromPoint.USER32 ref: 00007FF8BEE218AA
GetClassNameW.USER32 ref: 00007FF8BEE218C1
GetCursorPos.USER32 ref: 00007FF8BEE2193D
EnumPropsA.USER32 ref: 00007FF8BEE21A34
TrackPopupMenuEx.USER32 ref: 00007FF8BEE21A84

Strings

Shell_TrayWnd, xrefs: 00007FF8BEE21842
Shell_SecondaryTrayWnd, xrefs: 00007FF8BEE21825, 00007FF8BEE218CF

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ClassNamePerformanceQuery$CounterCursorEnumFrequencyFromMenuPointPopupPropsTrackWindow
String ID: Shell_SecondaryTrayWnd$Shell_TrayWnd
API String ID: 1660317238-1433838494
Opcode ID: 83934b789d8973376879005c48091409ce3cd31c50c9371e15847954d8c5b21b
Instruction ID: 5a03b261d92fccf46465132affa61ba6209b1f0b3eabddf30bbf51ecbe53d4da
Opcode Fuzzy Hash: 83934b789d8973376879005c48091409ce3cd31c50c9371e15847954d8c5b21b
Instruction Fuzzy Hash: C6916462A086828AEB649F1DE44027E77A1FF85BD0F844136FF4E12694DFBCE985C741

Function 00007FF8BEE40040 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 125synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF8BEE4006F
CreateMutexExW.KERNEL32 ref: 00007FF8BEE400AC
CloseHandle.KERNEL32 ref: 00007FF8BEE400CE
WaitForSingleObjectEx.KERNEL32 ref: 00007FF8BEE40115
ReleaseMutex.KERNEL32 ref: 00007FF8BEE401DE

Part of subcall function 00007FF8BEE3C3F0: GetLastError.KERNEL32 ref: 00007FF8BEE3C3FB

Strings

wil, xrefs: 00007FF8BEE40162, 00007FF8BEE4017E, 00007FF8BEE4019A, 00007FF8BEE40218
Local\SM0:%lu:%lu:%hs, xrefs: 00007FF8BEE40085
x, xrefs: 00007FF8BEE4007D

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Mutex$CloseCreateCurrentErrorHandleLastObjectProcessReleaseSingleWait
String ID: Local\SM0:%lu:%lu:%hs$wil$x
API String ID: 908355122-984673096
Opcode ID: 0eed1a0e6b6fa06b2c0e89e7213f101d1d7421deb94518413f30a7118700e111
Instruction ID: 29bbfc5a1e09c4e19ceabc7f28b71804d94b72206f6647ed595c9a1f000dd0f4
Opcode Fuzzy Hash: 0eed1a0e6b6fa06b2c0e89e7213f101d1d7421deb94518413f30a7118700e111
Instruction Fuzzy Hash: 4C51903660DA8289FB619B69F4547BE63A1EF84BD0F504131DB4E93B99DEBCE4018701

Function 00007FF8BEE4FA80 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73threadtimeCOMMON

Download Yara Rule

APIs

FindWindowW.USER32 ref: 00007FF8BEE4FAB7
GetWindowThreadProcessId.USER32 ref: 00007FF8BEE4FACB
K32EnumProcesses.KERNEL32 ref: 00007FF8BEE4FAEB
OpenProcess.KERNEL32 ref: 00007FF8BEE4FB26
K32GetProcessImageFileNameW.KERNEL32 ref: 00007FF8BEE4FB45
GetProcessTimes.KERNEL32 ref: 00007FF8BEE4FB67
CloseHandle.KERNEL32 ref: 00007FF8BEE4FB82

Strings

Shell_TrayWnd, xrefs: 00007FF8BEE4FAB0

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Process$Window$CloseEnumFileFindHandleImageNameOpenProcessesThreadTimes
String ID: Shell_TrayWnd
API String ID: 205820467-2988720461
Opcode ID: f023992688c57101c561ed79959dc3c03ba5d458641acb0f4f1228131208a279
Instruction ID: c79331d15b271158bbb71cd511f11a01f7f184a928572c845254a7b52cf45e7d
Opcode Fuzzy Hash: f023992688c57101c561ed79959dc3c03ba5d458641acb0f4f1228131208a279
Instruction Fuzzy Hash: E6319C32609B829AE760CF59E49809A73A0FB89BD0F441135EF9E07B58EF7CD546CB00

Function 00007FF8BEE3A500 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE3A553
RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF8BEE3A56C
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE3A773

Strings

WindowsUdk.UI.Shell.TaskbarLayout, xrefs: 00007FF8BEE3A543
[Positioning] Changed settings for monitor: %p : %d, xrefs: 00007FF8BEE3A6DE
[Positioning] Added settings for monitor %p : %d, xrefs: 00007FF8BEE3A66B
[Positioning] Removed settings for monitor: %p, xrefs: 00007FF8BEE3A725

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: StringWindows$ActivationCreateDeleteFactoryReference
String ID: WindowsUdk.UI.Shell.TaskbarLayout$[Positioning] Added settings for monitor %p : %d$[Positioning] Changed settings for monitor: %p : %d$[Positioning] Removed settings for monitor: %p
API String ID: 2243136672-1634499889
Opcode ID: fb3fc62111603dd1745c8325917876a59311e979fe064d816b692d01f6d50eee
Instruction ID: abc92e7c756a0c64945452fd0698934c9e02d4e657330e2aeef343cd86314611
Opcode Fuzzy Hash: fb3fc62111603dd1745c8325917876a59311e979fe064d816b692d01f6d50eee
Instruction Fuzzy Hash: AF813736B49A028AEB158BA9E8901AC33B1FF44BD8F554036DF4E57B64DFBCE4958340

Function 00007FF8BEE40510 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 159libraryloaderCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8BEE40548
LoadLibraryW.KERNEL32 ref: 00007FF8BEE4058F
GetProcAddress.KERNEL32 ref: 00007FF8BEE4059E
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF8BEE406C7
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF8BEE406D2

Strings

RoGetAgileReference, xrefs: 00007FF8BEE40597
combase.dll, xrefs: 00007FF8BEE40588

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ExclusiveLock$Release$AcquireAddressLibraryLoadProc
String ID: RoGetAgileReference$combase.dll
API String ID: 1925124437-3498391780
Opcode ID: 191cc1bba3cdddc2a570c09a664181a4c98cecfbcb7b12238b7ca1c8183499ae
Instruction ID: 01c9c71be0c0333be1262f01864f31948eb5fbbdfa4ef2c720db9f58cd6d1f8b
Opcode Fuzzy Hash: 191cc1bba3cdddc2a570c09a664181a4c98cecfbcb7b12238b7ca1c8183499ae
Instruction Fuzzy Hash: B8614922A09B1689FB50DBA9E8906BC23B4AF84BC4F454435DF0E17B65EFB8E951C301

Function 00007FF8BEE4BB60 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 157COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF8BEE4BB91
RoInitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF8BEE4BB9C
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE4BBBE
RoActivateInstance.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF8BEE4BBD4

Strings

Windows.Data.Xml.Dom.XmlDocument, xrefs: 00007FF8BEE4BBB7
updates.cpp, xrefs: 00007FF8BEE4BBE7, 00007FF8BEE4BC22, 00007FF8BEE4BC6F, 00007FF8BEE4BCF2

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Initialize$ActivateCreateInstanceReferenceStringWindows
String ID: Windows.Data.Xml.Dom.XmlDocument$updates.cpp
API String ID: 2774375269-421020656
Opcode ID: c17de4a74663ae1334d4dc68cb615cf5464bcc9af81c3d8218caca80331b9e32
Instruction ID: e967316788ce4cb8e71da183da7e2894a8cba1847cd6f98b09a08c8ff158c9cf
Opcode Fuzzy Hash: c17de4a74663ae1334d4dc68cb615cf5464bcc9af81c3d8218caca80331b9e32
Instruction Fuzzy Hash: 5C611566B04B4689EB109BB9D8905ED27B0FB89BD8F544532CF0DA3B98DFBCE4458350

Function 00007FF8BEE2D800 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FF8BEE2D96A
VirtualProtect.KERNEL32 ref: 00007FF8BEE2D990
VirtualProtect.KERNEL32 ref: 00007FF8BEE2D9AA
VirtualProtect.KERNEL32 ref: 00007FF8BEE2D9D3

Strings

[SSO] pguidTarget = %llX, xrefs: 00007FF8BEE2D8D9
[SSO] pssoEntryTarget = %llX, xrefs: 00007FF8BEE2D933
.rdata, xrefs: 00007FF8BEE2D87B

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ProtectVirtual
String ID: .rdata$[SSO] pguidTarget = %llX$[SSO] pssoEntryTarget = %llX
API String ID: 544645111-3803262335
Opcode ID: 5b9935208d114720107a600c19d56df1f3ab6656fc1db0a15f77e1c048a1198f
Instruction ID: 2227acf9f7fda338588e3720a731e2ae0e73dc6fc66b2db47ab34f6218103366
Opcode Fuzzy Hash: 5b9935208d114720107a600c19d56df1f3ab6656fc1db0a15f77e1c048a1198f
Instruction Fuzzy Hash: 5351A632B0864699EB209F69E54027DA3A0FB44BC4F448136EB8E57798DFFCE549C710

Function 00007FF8BEE6DE28 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF8BEE6E14E), ref: 00007FF8BEE6DFA4
GetProcAddress.KERNEL32(?,?,?,00007FF8BEE6E14E), ref: 00007FF8BEE6DFB0

Strings

api-ms-, xrefs: 00007FF8BEE6DEEE
ext-ms-, xrefs: 00007FF8BEE6DF01

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: d4e28a9fedf3677cfce40951c100994421983aba29285a1f03a61ac34610fe8e
Instruction ID: 8cebfe8b28098d5ff274ccbce24fc1ca7dd9f60bc9d61421cb8758be013c03ae
Opcode Fuzzy Hash: d4e28a9fedf3677cfce40951c100994421983aba29285a1f03a61ac34610fe8e
Instruction Fuzzy Hash: 0441F121B1AA428DFB16EF1E98005762391BF45BE4F894539EF1D87B88EEBCF4459300

Function 00007FF8BEE20060 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 81windowregistrytimeCOMMON

Download Yara Rule

APIs

RegisterWindowMessageW.USER32 ref: 00007FF8BEE200C0
FindWindowW.USER32 ref: 00007FF8BEE200D1
PostMessageW.USER32 ref: 00007FF8BEE200E2
GetDoubleClickTime.USER32 ref: 00007FF8BEE20149

Part of subcall function 00007FF8BEE1FBE0: CoCreateInstance.OLE32 ref: 00007FF8BEE1FC85
Part of subcall function 00007FF8BEE1FBE0: GetClassNameW.USER32 ref: 00007FF8BEE1FD74
Part of subcall function 00007FF8BEE1FBE0: IsWindow.USER32 ref: 00007FF8BEE1FD7F

CallNextHookEx.USER32 ref: 00007FF8BEE20192

Strings

Windows11ContextMenu_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FF8BEE200AF
Shell_TrayWnd, xrefs: 00007FF8BEE200C8

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Window$Message$CallClassClickCreateDoubleFindHookInstanceNameNextPostRegisterTime
String ID: Shell_TrayWnd$Windows11ContextMenu_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}
API String ID: 1587758685-4164012455
Opcode ID: 4a94d0f5b2144612d70103909825023d10e6d7e11548533633b21430fc8d6477
Instruction ID: fc70b9ee01cd287a797e33f19e50202086ff76b123af88d75f9b930f5615aa77
Opcode Fuzzy Hash: 4a94d0f5b2144612d70103909825023d10e6d7e11548533633b21430fc8d6477
Instruction Fuzzy Hash: C831F330E0DA478DFBA09F6DA89477A23A1AF457C0F040135EB4E426E6DFBDB481D601

Function 00007FF8BEE228A0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetAncestor.USER32 ref: 00007FF8BEE228F6
GetPropW.USER32 ref: 00007FF8BEE22907
FindWindowExW.USER32 ref: 00007FF8BEE22920
#412.COMCTL32 ref: 00007FF8BEE22951

Strings

Windows.UI.Composition.DesktopWindowContentBridge, xrefs: 00007FF8BEE22914
DarkMode, xrefs: 00007FF8BEE228D3
NavbarComposited, xrefs: 00007FF8BEE2292A

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: #412AncestorFindPropWindow
String ID: DarkMode$NavbarComposited$Windows.UI.Composition.DesktopWindowContentBridge
API String ID: 341881220-2358444603
Opcode ID: b92026126a59136a9fa017cb57680c02266db8fe866fa5fef45f75a8e4542f46
Instruction ID: 8523be385d1a4f8493def9a4aeb569fca4eaa1b535f094a905a05faf702547b3
Opcode Fuzzy Hash: b92026126a59136a9fa017cb57680c02266db8fe866fa5fef45f75a8e4542f46
Instruction Fuzzy Hash: 93214D21B09B8389FB209F1AA8402A967A1BF89BC4F584435DF4D47B59DEBCE556C300

Function 00007FF8BEE2AB70 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 46memorystringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 00007FF8BEE2AB9E
VirtualProtect.KERNEL32 ref: 00007FF8BEE2ABBB
lstrcpyW.KERNEL32 ref: 00007FF8BEE2ABCF
VirtualProtect.KERNEL32 ref: 00007FF8BEE2ABE7
OpenRegStream.SHELL32 ref: 00007FF8BEE2ABF9

Strings

TaskbarWinEP, xrefs: 00007FF8BEE2ABC5
TaskbarWinXP, xrefs: 00007FF8BEE2AB8E

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ProtectVirtual$OpenStreamlstrcmpilstrcpy
String ID: TaskbarWinEP$TaskbarWinXP
API String ID: 3070759360-188097361
Opcode ID: 885aa519be0ac16dc9c4f2ce9ba4c8813ddacbb61ad6c77d6aca215c77959592
Instruction ID: ebc6423726e407aac990a7d953a6cb6e4973d92cfed27a929e2349b78f2b64f4
Opcode Fuzzy Hash: 885aa519be0ac16dc9c4f2ce9ba4c8813ddacbb61ad6c77d6aca215c77959592
Instruction Fuzzy Hash: 00016D61B09B468AFA209F1ABC505696760AF8AFD4F844135DE0E17B54EE7CE549C700

Function 00007FF8BEE3E8C0 Relevance: 12.1, APIs: 8, Instructions: 76COMMON

Download Yara Rule

APIs

WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE3E951
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE3E965
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE3E979
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE3E98D
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE3E99E
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE3E9AC
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE3E9BA
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FF8BEE3E9C8

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: DeleteStringWindows
String ID:
API String ID: 3152741638-0
Opcode ID: 67f1ce15685d295fff3aeada26a4c3f3d4cb06d9198a5746176b713a9cdb96ef
Instruction ID: 42146268176749c5a23564ff3e96f382587b3d9ce4a1afd02d4f989388aef0a9
Opcode Fuzzy Hash: 67f1ce15685d295fff3aeada26a4c3f3d4cb06d9198a5746176b713a9cdb96ef
Instruction Fuzzy Hash: 3331E532A15B468AEB41AF79E8952693364FF85FC4F484035DB4E47B69CFB8D856C300

Function 00007FF8BEE5B774 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF8BEE5B7D1

Part of subcall function 00007FF8BEE5DAD8: __GetUnwindTryBlock.LIBCMT ref: 00007FF8BEE5DB1B
Part of subcall function 00007FF8BEE5DAD8: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF8BEE5DB40

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF8BEE5B8A9
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF8BEE5BAF7

Strings

csm, xrefs: 00007FF8BEE5B852
csm, xrefs: 00007FF8BEE5B8CC
csm, xrefs: 00007FF8BEE5B7EB

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchState
String ID: csm$csm$csm
API String ID: 1826822863-393685449
Opcode ID: 06d37747ec23b99cccc750839291a7387a34138ff8a4e3128607efae63cc54a1
Instruction ID: a4fac1a61680e2972f4d047bc16f75a071533c390cafd6988e7100000c72b5da
Opcode Fuzzy Hash: 06d37747ec23b99cccc750839291a7387a34138ff8a4e3128607efae63cc54a1
Instruction Fuzzy Hash: 57D16EA290874A8AEB60DB6994453AD77E0FB457D8F100136EF4D57B9ADFB8F181C700

Function 00007FF8BEE70FD8 Relevance: 10.8, APIs: 7, Instructions: 290COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE71405

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9951ac33629f3783a2efaf7b1665c919d801720656d2e50ddd4d57e51d070b78
Instruction ID: c13e9dc22fce55be43e2b6e65e811dfececb16ba51c10793bef016a6c56df5b8
Opcode Fuzzy Hash: 9951ac33629f3783a2efaf7b1665c919d801720656d2e50ddd4d57e51d070b78
Instruction Fuzzy Hash: D3C1EE22A0C78699EB609F1D94902BE7FA5EF90BC0F550235EB4E43795DEFDE8498300

Function 00007FF8BEE3ACC0 Relevance: 10.7, APIs: 7, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF8BEE3AD9D
GetProcessHeap.KERNEL32 ref: 00007FF8BEE3AE16
HeapFree.KERNEL32 ref: 00007FF8BEE3AE23
GetProcessHeap.KERNEL32 ref: 00007FF8BEE3AE51
HeapFree.KERNEL32 ref: 00007FF8BEE3AE60
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE3AED6

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Heap$Process$Free$_invalid_parameter_noinfo
String ID:
API String ID: 1838106010-0
Opcode ID: b594837bcafa6114a58da30faa14e04c973ed6eea13c8fea0de63908e2e9a346
Instruction ID: 4566a4033751079fb732fbc11d0f5f2249a87452922ad842405dc13fac7d761b
Opcode Fuzzy Hash: b594837bcafa6114a58da30faa14e04c973ed6eea13c8fea0de63908e2e9a346
Instruction Fuzzy Hash: 3F81BD72B48B428EEA669F5EE44017973A0EF84BD1F594136DB4C077A6DFBDE8818300

Function 00007FF8BEE4A5B0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 154COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32 ref: 00007FF8BEE4A5E1
GetMonitorInfoW.USER32 ref: 00007FF8BEE4A628

Strings

TwinUIPatches.cpp, xrefs: 00007FF8BEE4A5F4, 00007FF8BEE4A636, 00007FF8BEE4A672, 00007FF8BEE4A6C0, 00007FF8BEE4A703, 00007FF8BEE4A74E, 00007FF8BEE4A77B
(, xrefs: 00007FF8BEE4A60A

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Monitor$FromInfoPoint
String ID: ($TwinUIPatches.cpp
API String ID: 1349325158-3972200677
Opcode ID: 6248ba3d4a6800285093143097960151aa4c59b11e281124f03f80a7d9bad0e2
Instruction ID: 06faf2294d5e3dc2fefb02bc636278ee4dc406fd35e808527f19c2f78ff9a44b
Opcode Fuzzy Hash: 6248ba3d4a6800285093143097960151aa4c59b11e281124f03f80a7d9bad0e2
Instruction Fuzzy Hash: 93614E26F04B0689FB218BAAE4542BD27B1BF89BE8F105132DF0D53B54EEBCD5498340

Function 00007FF8BEE24090 Relevance: 10.6, APIs: 7, Instructions: 142COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FF8BEE240CC
GetWindowRect.USER32 ref: 00007FF8BEE240E5

Part of subcall function 00007FF8BEE215C0: MonitorFromPoint.USER32 ref: 00007FF8BEE215F4
Part of subcall function 00007FF8BEE215C0: FindWindowExW.USER32 ref: 00007FF8BEE21610
Part of subcall function 00007FF8BEE215C0: MonitorFromWindow.USER32 ref: 00007FF8BEE21621
Part of subcall function 00007FF8BEE215C0: FindWindowExW.USER32 ref: 00007FF8BEE21662
Part of subcall function 00007FF8BEE215C0: MonitorFromWindow.USER32 ref: 00007FF8BEE21673
Part of subcall function 00007FF8BEE215C0: GetMonitorInfoW.USER32 ref: 00007FF8BEE21681
Part of subcall function 00007FF8BEE215C0: GetWindowRect.USER32 ref: 00007FF8BEE21692

MonitorFromPoint.USER32 ref: 00007FF8BEE2413E
GetMonitorInfoW.USER32 ref: 00007FF8BEE2415B
MonitorFromPoint.USER32 ref: 00007FF8BEE241D3
GetMonitorInfoW.USER32 ref: 00007FF8BEE241EC
SetWindowPos.USER32 ref: 00007FF8BEE24240

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: MonitorWindow$From$InfoPointRect$Find
String ID:
API String ID: 2969468792-0
Opcode ID: e990e4b1540854c73ea75753fca5cebc977366d4440490979d1a3de8ce620f80
Instruction ID: 1ccdae899f23b1a676b5117dfccf509e060f5fd11fd01eeba213f1c69a6f2e01
Opcode Fuzzy Hash: e990e4b1540854c73ea75753fca5cebc977366d4440490979d1a3de8ce620f80
Instruction Fuzzy Hash: D8510533B089129EE714CF7DD8846AC37B1EB88788F455535DE08A7B48DEB9E9058B80

Function 00007FF8BEE5E02C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF8BEE5E233,?,?,?,00007FF8BEE5AD46,?,?,?,00007FF8BEE5AD01), ref: 00007FF8BEE5E0B1
GetLastError.KERNEL32(?,?,00000000,00007FF8BEE5E233,?,?,?,00007FF8BEE5AD46,?,?,?,00007FF8BEE5AD01), ref: 00007FF8BEE5E0BF
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF8BEE5E233,?,?,?,00007FF8BEE5AD46,?,?,?,00007FF8BEE5AD01), ref: 00007FF8BEE5E0E9
FreeLibrary.KERNEL32(?,?,00000000,00007FF8BEE5E233,?,?,?,00007FF8BEE5AD46,?,?,?,00007FF8BEE5AD01), ref: 00007FF8BEE5E157
GetProcAddress.KERNEL32(?,?,00000000,00007FF8BEE5E233,?,?,?,00007FF8BEE5AD46,?,?,?,00007FF8BEE5AD01), ref: 00007FF8BEE5E163

Strings

api-ms-, xrefs: 00007FF8BEE5E0D1

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 599aa7cf843937970ddcceeced45eda2783968fedc2164453d608f002cc62442
Instruction ID: 49815f7092a639014cb899f47115ac5d212383947d63b65ee37c90edf956df10
Opcode Fuzzy Hash: 599aa7cf843937970ddcceeced45eda2783968fedc2164453d608f002cc62442
Instruction Fuzzy Hash: 0C3101B1A1AB4689EE15DB1AA80017A27D4FF49BE0F590634DF1D0B7A4EFBCF4418301

Function 00007FF8BEE32BE0 Relevance: 10.6, APIs: 7, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF8BEE32C1C
HeapFree.KERNEL32 ref: 00007FF8BEE32C2A
GetProcessHeap.KERNEL32 ref: 00007FF8BEE32C4B
HeapAlloc.KERNEL32 ref: 00007FF8BEE32C5A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE32C87
GetProcessHeap.KERNEL32 ref: 00007FF8BEE32CB2
HeapFree.KERNEL32 ref: 00007FF8BEE32CC0

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Heap$Process$Free$Alloc_invalid_parameter_noinfo
String ID:
API String ID: 823393853-0
Opcode ID: 8c144cb2418d10e68452f3e411d94cff025c7d322b2be66c77ccad39f53e557e
Instruction ID: 6378d74f46f2f6977793f9c6d40fd4102aa632c0cb4415bb00af14ad5850d6b7
Opcode Fuzzy Hash: 8c144cb2418d10e68452f3e411d94cff025c7d322b2be66c77ccad39f53e557e
Instruction Fuzzy Hash: 6D31AD31A0AB428AEB15CF6AE54036977A0FF89BD0F188530EB9D03794DF7DE4128340

Function 00007FF8BEE12E80 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 62timeCOMMON

Download Yara Rule

APIs

GetPropW.USER32 ref: 00007FF8BEE12ED1
GetPropW.USER32 ref: 00007FF8BEE12EE6
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8BEE12F1B
#334.COMCTL32 ref: 00007FF8BEE12F43

Strings

valinet.ExplorerPatcher.ShellManagedWindow, xrefs: 00007FF8BEE12EDC
Microsoft.Windows.ShellManagedWindowAsNormalWindow, xrefs: 00007FF8BEE12EC7

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: PropTime$#334FileSystem
String ID: Microsoft.Windows.ShellManagedWindowAsNormalWindow$valinet.ExplorerPatcher.ShellManagedWindow
API String ID: 1774183415-1567022081
Opcode ID: 97238d729015d8dfd2b804d1bb3dafc32e9bfbc5c4abc83e114f203b59bb176e
Instruction ID: be53bcee02d328b4077e6778228f5010c440de9f67118218335c53e1d05490bf
Opcode Fuzzy Hash: 97238d729015d8dfd2b804d1bb3dafc32e9bfbc5c4abc83e114f203b59bb176e
Instruction Fuzzy Hash: FD212161B0DB428AEB959F69B84027963A0FF4DBC0F485534DB4E57794EFBCE4949300

Function 00007FF8BEE47E90 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

SetWindowLongPtrW.USER32 ref: 00007FF8BEE47EE5
DefWindowProcW.USER32 ref: 00007FF8BEE47EF6

Part of subcall function 00007FF8BEE1C200: GetCursorPos.USER32 ref: 00007FF8BEE1C25F
Part of subcall function 00007FF8BEE1C200: GetForegroundWindow.USER32 ref: 00007FF8BEE1C265
Part of subcall function 00007FF8BEE1C200: SetForegroundWindow.USER32 ref: 00007FF8BEE1C273
Part of subcall function 00007FF8BEE1C200: CreatePopupMenu.USER32 ref: 00007FF8BEE1C279
Part of subcall function 00007FF8BEE1C200: PathUnquoteSpacesW.SHLWAPI ref: 00007FF8BEE1C2BC
Part of subcall function 00007FF8BEE1C200: PathRemoveExtensionW.SHLWAPI ref: 00007FF8BEE1C2C6
Part of subcall function 00007FF8BEE1C200: PathStripPathW.SHLWAPI ref: 00007FF8BEE1C2D0
Part of subcall function 00007FF8BEE1C200: wsprintfW.USER32 ref: 00007FF8BEE1C2E8
Part of subcall function 00007FF8BEE1C200: InsertMenuW.USER32 ref: 00007FF8BEE1C30B
Part of subcall function 00007FF8BEE1C200: InsertMenuW.USER32 ref: 00007FF8BEE1C32E
Part of subcall function 00007FF8BEE1C200: TrackPopupMenu.USER32 ref: 00007FF8BEE1C388
Part of subcall function 00007FF8BEE1C200: SetForegroundWindow.USER32 ref: 00007FF8BEE1C3A8

DefWindowProcW.USER32 ref: 00007FF8BEE47F0F

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Window$MenuPath$Foreground$InsertPopupProc$CreateCursorExtensionLongRemoveSpacesStripTrackUnquotewsprintf
String ID:
API String ID: 1129523998-0
Opcode ID: 78930651f6e0dbf70c0a968884cc5667dec9041b8e6a20be2af9615704dcd25d
Instruction ID: d1d225b6841f6fda6013f880ce234cb0be11644701ce26b22ff44651b9a9c951
Opcode Fuzzy Hash: 78930651f6e0dbf70c0a968884cc5667dec9041b8e6a20be2af9615704dcd25d
Instruction Fuzzy Hash: 10319822B09B5389FA108B5EA84057DA7A5AF85FD0F184635EF5E13B95DEBCE8418340

Function 00007FF8BEE1B020 Relevance: 9.1, APIs: 6, Instructions: 72windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF8BEE1B042
DeleteObject.GDI32 ref: 00007FF8BEE1B04F
DwmUnregisterThumbnail.DWMAPI ref: 00007FF8BEE1B089
DestroyIcon.USER32 ref: 00007FF8BEE1B0BD
#329.COMCTL32 ref: 00007FF8BEE1B0CF
CoTaskMemFree.OLE32 ref: 00007FF8BEE1B0E1

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: DeleteObject$#329DestroyFreeIconTaskThumbnailUnregister
String ID:
API String ID: 3142863258-0
Opcode ID: 5b6668d6ae9ea2a99c552ac43f987bc3ae46d95cfd8ec898e4dde29fcaf8fde5
Instruction ID: 3b44f40f1e5c4a02ce37b38574f5f1416e9cf4ff5f32a54064fca0c0113b3aba
Opcode Fuzzy Hash: 5b6668d6ae9ea2a99c552ac43f987bc3ae46d95cfd8ec898e4dde29fcaf8fde5
Instruction Fuzzy Hash: E3312921B1AA42C9EFA49F6AE49427A2360FF84F80F084539DF5E07654CFBCE4918701

Function 00007FF8BEE259B0 Relevance: 9.1, APIs: 6, Instructions: 58windowCOMMON

Download Yara Rule

APIs

TryEnterCriticalSection.KERNEL32 ref: 00007FF8BEE259C7
IsWindowVisible.USER32 ref: 00007FF8BEE25A0D
GetForegroundWindow.USER32 ref: 00007FF8BEE25A17
LeaveCriticalSection.KERNEL32 ref: 00007FF8BEE25A63

Part of subcall function 00007FF8BEE24090: GetWindowRect.USER32 ref: 00007FF8BEE240CC
Part of subcall function 00007FF8BEE24090: GetWindowRect.USER32 ref: 00007FF8BEE240E5
Part of subcall function 00007FF8BEE24090: MonitorFromPoint.USER32 ref: 00007FF8BEE2413E
Part of subcall function 00007FF8BEE24090: GetMonitorInfoW.USER32 ref: 00007FF8BEE2415B
Part of subcall function 00007FF8BEE24090: SetWindowPos.USER32 ref: 00007FF8BEE24240

SwitchToThisWindow.USER32 ref: 00007FF8BEE25A56
LeaveCriticalSection.KERNEL32 ref: 00007FF8BEE25A7D

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Window$CriticalSection$LeaveMonitorRect$EnterForegroundFromInfoPointSwitchThisVisible
String ID:
API String ID: 16346285-0
Opcode ID: 3c5a7ed137fe8480b21572e18efabc9944883a76212bb524bd53722323f22adc
Instruction ID: 50fd9870e9f71dfe596e5687a5bc41a74e8e5d1aaeb24108e58c97735a9e9202
Opcode Fuzzy Hash: 3c5a7ed137fe8480b21572e18efabc9944883a76212bb524bd53722323f22adc
Instruction Fuzzy Hash: B221E961A19E0289EF459FAEE9D517827A1BF85BC0F085431CB1E87260DEEDE848C311

Function 00007FF8BEE17A80 Relevance: 9.1, APIs: 6, Instructions: 52threadtimewindowCOMMON

Download Yara Rule

APIs

SetThreadDesktop.USER32 ref: 00007FF8BEE17A91
IsHungAppWindow.USER32 ref: 00007FF8BEE17A9A
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8BEE17AC0
#339.COMCTL32 ref: 00007FF8BEE17AF3
EndTask.USER32 ref: 00007FF8BEE17B06
PostMessageW.USER32 ref: 00007FF8BEE17B27

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Time$#339DesktopFileHungMessagePostSystemTaskThreadWindow
String ID:
API String ID: 68357764-0
Opcode ID: 943034d36bd88e25aeef4a402e739434912df28a9ce11465c727bd468174bb2f
Instruction ID: b7d9aad7af95aed4835f221669a746cfa75c08eb19f053ceefa43c8bc8fd4cf5
Opcode Fuzzy Hash: 943034d36bd88e25aeef4a402e739434912df28a9ce11465c727bd468174bb2f
Instruction Fuzzy Hash: 41119022A09A418AEB50CF39E85467A33A1FB89FC4F144231CB1D877A4EF7CE8558300

Function 00007FF8BEE2AAF0 Relevance: 9.0, APIs: 2, Strings: 4, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpW.KERNEL32 ref: 00007FF8BEE2AB1A
lstrcmpW.KERNEL32 ref: 00007FF8BEE2AB37

Strings

StuckRectsLegacy, xrefs: 00007FF8BEE2AB3F
MMStuckRectsLegacy, xrefs: 00007FF8BEE2AB24
StuckRects3, xrefs: 00007FF8BEE2AB2D
MMStuckRects3, xrefs: 00007FF8BEE2AB0D

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: lstrcmp
String ID: MMStuckRects3$MMStuckRectsLegacy$StuckRects3$StuckRectsLegacy
API String ID: 1534048567-4175609545
Opcode ID: 8f35bc77936d02bd8bfb90192c4675876bf8a2cd4dcf7b6fb2d72930b64a54d9
Instruction ID: 17ea1e769216e0d70dae753332947a85557aed7dc9e8b50e8f3e119a65a02899
Opcode Fuzzy Hash: 8f35bc77936d02bd8bfb90192c4675876bf8a2cd4dcf7b6fb2d72930b64a54d9
Instruction Fuzzy Hash: BCF01961B18B81C9E7008F0AEC4006AA761BF45BC0F884436EF4D47779EFACD941C700

Function 00007FF8BEE2AA70 Relevance: 9.0, APIs: 2, Strings: 4, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrcmpW.KERNEL32 ref: 00007FF8BEE2AA9A
lstrcmpW.KERNEL32 ref: 00007FF8BEE2AAB7

Strings

StuckRectsLegacy, xrefs: 00007FF8BEE2AABF
MMStuckRectsLegacy, xrefs: 00007FF8BEE2AAA4
StuckRects3, xrefs: 00007FF8BEE2AAAD
MMStuckRects3, xrefs: 00007FF8BEE2AA8D

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: lstrcmp
String ID: MMStuckRects3$MMStuckRectsLegacy$StuckRects3$StuckRectsLegacy
API String ID: 1534048567-4175609545
Opcode ID: bdb7a762ec4028ff19773bdbe32e6051e40cddc4f4050542620de6a89180ad4a
Instruction ID: 883b92c0217aed4abd5a0fab2a3c799f349b0b6ecfd5726554fa90ec0555cd0f
Opcode Fuzzy Hash: bdb7a762ec4028ff19773bdbe32e6051e40cddc4f4050542620de6a89180ad4a
Instruction Fuzzy Hash: B1F01D71B18B81C9E7008F1AAC404697766BF45FC0F884531EB4E47729DFACE545C740

Function 00007FF8BEE1C8E0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 131memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF8BEE1C921
SymGetLineFromAddr64.DBGHELP ref: 00007FF8BEE1CA24

Strings

Memory pool exhausted., xrefs: 00007FF8BEE1C97C
(, xrefs: 00007FF8BEE1CA17
Allocation too large!, xrefs: 00007FF8BEE1C958

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Addr64AllocFromLineVirtual
String ID: ($Allocation too large!$Memory pool exhausted.
API String ID: 3708110707-2461089917
Opcode ID: 82671644744429d4bb92d67069d6a7788f83aa68fdde564f51c0551beeb17465
Instruction ID: 8fb2c9de72391b9bd176af8378c4e3833f237ec8b9f9197be917f82ae75e31f6
Opcode Fuzzy Hash: 82671644744429d4bb92d67069d6a7788f83aa68fdde564f51c0551beeb17465
Instruction Fuzzy Hash: 5F51A472A08A828AE754DF29E4902BA77A0FB88BD4F044135DB5D4779ADFBCE491C740

Function 00007FF8BEE498F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 130memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BEE49620: CoCreateInstance.OLE32 ref: 00007FF8BEE49697

VirtualProtect.KERNEL32 ref: 00007FF8BEE49A6E
VirtualProtect.KERNEL32 ref: 00007FF8BEE49A90
VirtualProtect.KERNEL32 ref: 00007FF8BEE49AB7
VirtualProtect.KERNEL32 ref: 00007FF8BEE49AD9

Strings

xxxx, xrefs: 00007FF8BEE499F5, 00007FF8BEE49A30

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ProtectVirtual$CreateInstance
String ID: xxxx
API String ID: 1177339427-1813341303
Opcode ID: b5191f9778e8723cfa23f8a8210c8aed8ac3987907ab5605c0ec9587bdf6d9f1
Instruction ID: f4b9b560312e22f40903669caa33f410c7b6b790aad012ca0ad0eeee3fe9c8bd
Opcode Fuzzy Hash: b5191f9778e8723cfa23f8a8210c8aed8ac3987907ab5605c0ec9587bdf6d9f1
Instruction Fuzzy Hash: A7519131B19A5389FB508F29E8806AD73A5EB89BE0F540236DB5D47B90DF7ED845C700

Function 00007FF8BEE1ED40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

RoInitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF8BEE1EDF2
EnumDisplayMonitors.USER32 ref: 00007FF8BEE1EEA2
RoUninitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF8BEE1EEB2

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FF8BEE1EDB5
TaskbarAl, xrefs: 00007FF8BEE1ED9E

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: DisplayEnumInitializeMonitorsUninitialize
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$TaskbarAl
API String ID: 3377822461-945323219
Opcode ID: b2532f4d77b0dfdbd43d4c7a74ebef4ee03557c86b55352911c67f019bd3c841
Instruction ID: abc389877c57572f3a9a99a8f9481f71f4fe9fd9c70239864ef5cdb938446b3b
Opcode Fuzzy Hash: b2532f4d77b0dfdbd43d4c7a74ebef4ee03557c86b55352911c67f019bd3c841
Instruction Fuzzy Hash: CA413332A0DB428AE791CF68E49426AB7A0FF847D4F54153AE78D476A4CFBDE444CB40

Function 00007FF8BEE2B510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 00007FF8BEE2B5A7
RegCreateKeyExW.ADVAPI32 ref: 00007FF8BEE2B63A
RegCreateKeyExW.ADVAPI32 ref: 00007FF8BEE2B69E

Part of subcall function 00007FF8BEE68004: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE68021

Strings

ShellFolder, xrefs: 00007FF8BEE2B5D9
Software\Classes\CLSID\{2cc5ca98-6485-489a-920e-b3e88a6ccce3}, xrefs: 00007FF8BEE2B547

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Create$_invalid_parameter_noinfo
String ID: ShellFolder$Software\Classes\CLSID\{2cc5ca98-6485-489a-920e-b3e88a6ccce3}
API String ID: 219255893-1186126643
Opcode ID: aed7e8650ed2a6a7fa3051a1e44cad45963077ced5e8af182ac4c206d37ed659
Instruction ID: 31932e4006a99bd7f661bff3054baaeed05666d28736a33cb34ac44a5d1833e2
Opcode Fuzzy Hash: aed7e8650ed2a6a7fa3051a1e44cad45963077ced5e8af182ac4c206d37ed659
Instruction Fuzzy Hash: 3941E936618B8189DB60CF1AB88076AB7A5FB88BD4F444135EB8D87B59DF7CD054CB00

Function 00007FF8BEE1F920 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72registrywindowCOMMON

Download Yara Rule

APIs

#412.COMCTL32 ref: 00007FF8BEE1F956
#413.COMCTL32 ref: 00007FF8BEE1F98F
GetClassWord.USER32 ref: 00007FF8BEE1F9C9
RegisterWindowMessageW.USER32 ref: 00007FF8BEE1F9D9

Strings

PeopleBand, xrefs: 00007FF8BEE1F9CF

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: #412#413ClassMessageRegisterWindowWord
String ID: PeopleBand
API String ID: 1253488571-1317317948
Opcode ID: 00bf1fe5e74ed78e86a5325a78d99c602c0b160c2fae4a4883b20bc22997a9d9
Instruction ID: f8d88305c49f4556dae30b95a350f9e540fb3408b8a0abbdc41bdb13c89ec037
Opcode Fuzzy Hash: 00bf1fe5e74ed78e86a5325a78d99c602c0b160c2fae4a4883b20bc22997a9d9
Instruction Fuzzy Hash: 3131B331E08642AEE7949B5DA58027A72A1FF487D0F040035DB5E57A94CFBCECE1D782

Function 00007FF8BEE20DB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32 ref: 00007FF8BEE20DE7
GetMenuItemInfoW.USER32 ref: 00007FF8BEE20E20
SetMenuItemInfoW.USER32 ref: 00007FF8BEE20E4C

Strings

[ROD]: Level %d Position %d/%d Status %d, xrefs: 00007FF8BEE20E55
P, xrefs: 00007FF8BEE20E05

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ItemMenu$Info$Count
String ID: P$[ROD]: Level %d Position %d/%d Status %d
API String ID: 4286743509-735391699
Opcode ID: e1e17733d45c5082e7cf109f97440a1acaccddaaf4d58eb13d68cb5c7e8099bd
Instruction ID: dc03eb157d1575093deafbafd70c71f142f501199521d282ae7ec980e4334fe4
Opcode Fuzzy Hash: e1e17733d45c5082e7cf109f97440a1acaccddaaf4d58eb13d68cb5c7e8099bd
Instruction Fuzzy Hash: 9F2192717186818AEB508F29E49076E77A0FB89BC4F405035EF8E87799DF7DE4458B40

Function 00007FF8BEE48CF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47registrystringCOMMON

Download Yara Rule

APIs

RegGetValueW.ADVAPI32 ref: 00007FF8BEE48D23
lstrcmpW.KERNEL32 ref: 00007FF8BEE48D35
SetEvent.KERNEL32 ref: 00007FF8BEE48D66
CloseHandle.KERNEL32 ref: 00007FF8BEE48D73

Strings

AltTabSettings, xrefs: 00007FF8BEE48D29

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CloseEventHandleValuelstrcmp
String ID: AltTabSettings
API String ID: 3692967019-1137623902
Opcode ID: 0afcefe90346c281578279029c8a8ded8b7faa482209d6a9f591e38616476c66
Instruction ID: 4a761f727a411d0fed8aae7d82d07f0f2645597696f860a37d0d1702edc095be
Opcode Fuzzy Hash: 0afcefe90346c281578279029c8a8ded8b7faa482209d6a9f591e38616476c66
Instruction Fuzzy Hash: 6D111C35A09B838AEB509B29F88422967A4FB98BD4F044536EB9D43B64DFBCD454CB04

Function 00007FF8BEE129E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF8BEE12A05
GetProcAddress.KERNEL32 ref: 00007FF8BEE12A1A

Strings

ntdll.dll, xrefs: 00007FF8BEE129FE
RtlGetVersion, xrefs: 00007FF8BEE12A10
)J, xrefs: 00007FF8BEE12A38

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: )J$RtlGetVersion$ntdll.dll
API String ID: 1646373207-687753697
Opcode ID: 40be109ccd2fee6e5b842ad493b5d4303245f2623818bb1acce2d90060769a0a
Instruction ID: 0eea33cb70b89bda93ab2ae0e4c00388aec4b1d810339ad78d1b0cb8307bbc99
Opcode Fuzzy Hash: 40be109ccd2fee6e5b842ad493b5d4303245f2623818bb1acce2d90060769a0a
Instruction Fuzzy Hash: B8115671E096428EFFB19B18D8643763290AF4C7C4F480035CB5D46399DFBCE5859612

Function 00007FF8BEE68988 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF8BEE689AD
GetProcAddress.KERNEL32 ref: 00007FF8BEE689C3
FreeLibrary.KERNEL32 ref: 00007FF8BEE689EA

Strings

CorExitProcess, xrefs: 00007FF8BEE689BC
mscoree.dll, xrefs: 00007FF8BEE689A4

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 80209b7930936a9e189f19b39c85d751dd38e10808ff28b9e7b9a83a32d31e9a
Instruction ID: 38426de5adbf2f8f2df93a054f2fdbd51a62efeb74fc090be17522a4ba061593
Opcode Fuzzy Hash: 80209b7930936a9e189f19b39c85d751dd38e10808ff28b9e7b9a83a32d31e9a
Instruction Fuzzy Hash: 93F06261A1960289EB148F28E4853796760EF85BE1F541335C76E451F4CFACE448C340

Function 00007FF8BEE5B044 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF8BEE5B167
__AdjustPointer.LIBCMT ref: 00007FF8BEE5B1B2

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: e528e13f9be41aad643f060d0d1199269f21a2fdd535f9fe7f289e6188888710
Instruction ID: 34e850d55039116109c5b34835f5a299e8fbc80581bda0db9d89a737758e0ed3
Opcode Fuzzy Hash: e528e13f9be41aad643f060d0d1199269f21a2fdd535f9fe7f289e6188888710
Instruction Fuzzy Hash: D7B1A1A2E0A68A89EA659F5D958023D67D4AF44BC4F098836DF4D07799DFBCF4428310

Function 00007FF8BEE40A10 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BEE3C2E0: GetProcessHeap.KERNEL32 ref: 00007FF8BEE3C2F4
Part of subcall function 00007FF8BEE3C2E0: HeapAlloc.KERNEL32 ref: 00007FF8BEE3C305
Part of subcall function 00007FF8BEE3C2E0: GetModuleHandleW.KERNEL32 ref: 00007FF8BEE3C329
Part of subcall function 00007FF8BEE3C2E0: GetProcAddress.KERNEL32 ref: 00007FF8BEE3C33E

CloseHandle.KERNEL32 ref: 00007FF8BEE40B56
CloseHandle.KERNEL32 ref: 00007FF8BEE40B6D
GetProcessHeap.KERNEL32 ref: 00007FF8BEE40B81
HeapFree.KERNEL32 ref: 00007FF8BEE40B8F

Part of subcall function 00007FF8BEE3C660: ReleaseMutex.KERNEL32 ref: 00007FF8BEE3C68C

Part of subcall function 00007FF8BEE3C660: CreateSemaphoreExW.KERNEL32 ref: 00007FF8BEE3C7F0

Strings

wil, xrefs: 00007FF8BEE40A69, 00007FF8BEE40AB4

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Heap$Handle$CloseProcess$AddressAllocCreateFreeModuleMutexProcReleaseSemaphore
String ID: wil
API String ID: 3215620834-1589926490
Opcode ID: 306703ea24084b581afddb5be4ed49465bea48b5cf6833c6ccc62fdb9fb647b1
Instruction ID: 82f751f61423467143fb254cf919b0366ed1f30b429a04d061c16c59e53db07c
Opcode Fuzzy Hash: 306703ea24084b581afddb5be4ed49465bea48b5cf6833c6ccc62fdb9fb647b1
Instruction Fuzzy Hash: AD518422A18B828AE7609F25A95027A77B0FB98BD4F045235EF4D43B55EF7CF5A08704

Function 00007FF8BEE12D20 Relevance: 7.6, APIs: 5, Instructions: 73windowtimeCOMMON

Download Yara Rule

APIs

GetShellWindow.USER32 ref: 00007FF8BEE12D39
SendMessageTimeoutW.USER32 ref: 00007FF8BEE12D98
SendMessageTimeoutW.USER32 ref: 00007FF8BEE12DD7
SendMessageTimeoutW.USER32 ref: 00007FF8BEE12E09
SendMessageTimeoutW.USER32 ref: 00007FF8BEE12E33

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: MessageSendTimeout$ShellWindow
String ID:
API String ID: 1795729329-0
Opcode ID: df9fee810fcfd716007199a647c37334879f3c85e0c05d576c8dc6250f3d142f
Instruction ID: c1cfe883468e46ed403e6647f0f38e6256d0f77b414c0a97478670599812e1ec
Opcode Fuzzy Hash: df9fee810fcfd716007199a647c37334879f3c85e0c05d576c8dc6250f3d142f
Instruction Fuzzy Hash: 69313B32618B8187E7608B58F85061EBAA5FB89BB4F541325E6BD47BD8CFBCD5418F00

Function 00007FF8BEE247E0 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

TryEnterCriticalSection.KERNEL32 ref: 00007FF8BEE24806
LeaveCriticalSection.KERNEL32 ref: 00007FF8BEE2486A
MulDiv.KERNEL32 ref: 00007FF8BEE248A5
LeaveCriticalSection.KERNEL32 ref: 00007FF8BEE248B8
LeaveCriticalSection.KERNEL32 ref: 00007FF8BEE248DB

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 1a92415a633d95fbb063690ab0e28c0a14bf50bd2e5e985193831506fdf3669f
Instruction ID: 9a510f6a2f0080966c5b4fab2b1307de4bfced56ba5fa53e986d54da2adcbcda
Opcode Fuzzy Hash: 1a92415a633d95fbb063690ab0e28c0a14bf50bd2e5e985193831506fdf3669f
Instruction Fuzzy Hash: F7311021F2DA528AE7585F6DB8C423967A1FB85BC0F140039EB5E837A4DEEDF8448750

Function 00007FF8BEE33C10 Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF8BEE33C55
HeapFree.KERNEL32 ref: 00007FF8BEE33C63
GetProcessHeap.KERNEL32 ref: 00007FF8BEE33C93
HeapFree.KERNEL32 ref: 00007FF8BEE33CA1
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF8BEE33CC3

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Heap$FreeProcess$__std_exception_destroy
String ID:
API String ID: 107506009-0
Opcode ID: 508a8f8c128779259fad8302647ce02a2afb58cfb7573152f94ff8ca8ed7eebd
Instruction ID: d1ff9a2d16cde3d486b0ac3bd80e05f82cdcbb7aed8499c94c9e202459bb64e0
Opcode Fuzzy Hash: 508a8f8c128779259fad8302647ce02a2afb58cfb7573152f94ff8ca8ed7eebd
Instruction Fuzzy Hash: 57217F32A09B8186EB488B6AE980769B3A1FB85BD0F194135DF5D17B60CF79E4628300

Function 00007FF8BEE798E8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF8BEE79910
_set_statfp.LIBCMT ref: 00007FF8BEE7992B
_set_statfp.LIBCMT ref: 00007FF8BEE79947
_set_statfp.LIBCMT ref: 00007FF8BEE79983

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 52dd6ee43e7558787e25f2b81cb0a7cd67245f9696d3e699f10f322dd1311e8a
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 8B117C26E5CA039AFB64512CE4D63791D406F5D3F4F0A4A34EBAF062DACEEEAC415200

Function 00007FF8BEE13950 Relevance: 7.5, APIs: 5, Instructions: 42timesynchronizationCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32 ref: 00007FF8BEE13976
SetWaitableTimer.KERNEL32 ref: 00007FF8BEE139A5
CloseHandle.KERNEL32 ref: 00007FF8BEE139B2
WaitForSingleObject.KERNEL32 ref: 00007FF8BEE139C1
CloseHandle.KERNEL32 ref: 00007FF8BEE139CA

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CloseHandleTimerWaitable$CreateObjectSingleWait
String ID:
API String ID: 2007961542-0
Opcode ID: f35fe9c5397126d8a8b6cc2eeadd2e7ad3a421f9d1d1043d657964b9880001d4
Instruction ID: 325cbe71fb51a4efdac443e462daf5769dec62717115a0be04e5fd6d67096599
Opcode Fuzzy Hash: f35fe9c5397126d8a8b6cc2eeadd2e7ad3a421f9d1d1043d657964b9880001d4
Instruction Fuzzy Hash: CB01962261DB8286EB504B68B85162B77A0FF897E1F441135EF5E06758DF7CD0408B00

Function 00007FF8BEE11592 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 31COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FF8BEE115FD

Strings

THIS IS NOT A BUG, A DELIBERATE STACK TRACE REQUEST HAS BEEN MADE, xrefs: 00007FF8BEE11592
====================================, xrefs: 00007FF8BEE11622
Here is the stack trace:, xrefs: 00007FF8BEE11611
Description: %s, xrefs: 00007FF8BEE115EA

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: FreeLocal
String ID: ====================================$Description: %s$Here is the stack trace:$THIS IS NOT A BUG, A DELIBERATE STACK TRACE REQUEST HAS BEEN MADE
API String ID: 2826327444-1300954401
Opcode ID: 5b9c26d1a7a765aca19a893aaf8f3b37c14e8039537c0f65ca4f22efadb90e26
Instruction ID: 69a029fbc4cb5b9b2e870133b4a64469321c5a47b05dd0bc2ca0f135bf4c04ed
Opcode Fuzzy Hash: 5b9c26d1a7a765aca19a893aaf8f3b37c14e8039537c0f65ca4f22efadb90e26
Instruction Fuzzy Hash: 1601E661E4D9468EF984EB1DF4511B96360AF857C0F890231FB0E572ABEEACF5808701

Function 00007FF8BEE11579 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 31COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FF8BEE115FD

Strings

Unable to set the requested DPI awareness context, xrefs: 00007FF8BEE11579
====================================, xrefs: 00007FF8BEE11622
Here is the stack trace:, xrefs: 00007FF8BEE11611
Description: %s, xrefs: 00007FF8BEE115EA

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: FreeLocal
String ID: ====================================$Description: %s$Here is the stack trace:$Unable to set the requested DPI awareness context
API String ID: 2826327444-4207243742
Opcode ID: 24ab273f7025f721364c5b8674c767793bcd91a4831abff6f511bc7d305de6a9
Instruction ID: e95d9687ed1f8acb9443b1ccadc60fa3749f62771c9f12ce46126bcbf88d566d
Opcode Fuzzy Hash: 24ab273f7025f721364c5b8674c767793bcd91a4831abff6f511bc7d305de6a9
Instruction Fuzzy Hash: 3001E661E0D9468EF984EB1DF4511B96360AF857C0F890231FB0E572ABEEACF5808701

Function 00007FF8BEE11582 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 31COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FF8BEE115FD

Strings

====================================, xrefs: 00007FF8BEE11622
One or more of the parameters supplied is invalid, xrefs: 00007FF8BEE11582
Here is the stack trace:, xrefs: 00007FF8BEE11611
Description: %s, xrefs: 00007FF8BEE115EA

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: FreeLocal
String ID: ====================================$Description: %s$Here is the stack trace:$One or more of the parameters supplied is invalid
API String ID: 2826327444-753373920
Opcode ID: a5b4a8dfd45a7964cedd182faa343b30e744949b1f966e26c53bbf05beb9e18a
Instruction ID: b7f84227d1dce6f3c2054b6415dc3a4cb773b4d76e2fbcb9211941dbc8de41e8
Opcode Fuzzy Hash: a5b4a8dfd45a7964cedd182faa343b30e744949b1f966e26c53bbf05beb9e18a
Instruction Fuzzy Hash: 7201E661E0D9468EF984EB1DF4511B96360AF857C0F890231EB0E572ABEEACF5818701

Function 00007FF8BEE11570 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 31COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FF8BEE115FD

Strings

The requested procedure was not found, xrefs: 00007FF8BEE11570
====================================, xrefs: 00007FF8BEE11622
Here is the stack trace:, xrefs: 00007FF8BEE11611
Description: %s, xrefs: 00007FF8BEE115EA

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: FreeLocal
String ID: ====================================$Description: %s$Here is the stack trace:$The requested procedure was not found
API String ID: 2826327444-1242647813
Opcode ID: 75995d7f11c179413857d765ebe3de4459dd291b6dc8d62efb3aab6ee8e2e411
Instruction ID: e09a108ed2e823649c433608b62299b1153de6c571c6de5ac95dec3a257b7571
Opcode Fuzzy Hash: 75995d7f11c179413857d765ebe3de4459dd291b6dc8d62efb3aab6ee8e2e411
Instruction Fuzzy Hash: 1401E661E0D9468EF984EB1DF4511B96360AF857C0F890231EB0E572ABEEACF5808701

Function 00007FF8BEE1155E Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 31COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FF8BEE115FD

Strings

Functionality is not initialized, xrefs: 00007FF8BEE1155E
====================================, xrefs: 00007FF8BEE11622
Here is the stack trace:, xrefs: 00007FF8BEE11611
Description: %s, xrefs: 00007FF8BEE115EA

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: FreeLocal
String ID: ====================================$Description: %s$Functionality is not initialized$Here is the stack trace:
API String ID: 2826327444-176991105
Opcode ID: 280dc8867c10ca6339ad6ffcc938aecfe2b24f13a88c74bc7b3b09a4a3860d90
Instruction ID: b9e429c5865dcbea3083547235c53e46b583742bbb1547be937a44785acf6d2a
Opcode Fuzzy Hash: 280dc8867c10ca6339ad6ffcc938aecfe2b24f13a88c74bc7b3b09a4a3860d90
Instruction Fuzzy Hash: FE01E661E0D9468EFD84EB1DF4511B96360AF857C0F890231EB0E572ABEEACF5818711

Function 00007FF8BEE11567 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 31COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FF8BEE115FD

Strings

The requested library is not available, xrefs: 00007FF8BEE11567
====================================, xrefs: 00007FF8BEE11622
Here is the stack trace:, xrefs: 00007FF8BEE11611
Description: %s, xrefs: 00007FF8BEE115EA

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: FreeLocal
String ID: ====================================$Description: %s$Here is the stack trace:$The requested library is not available
API String ID: 2826327444-2487367941
Opcode ID: 4a69e9522ff560458051ec1ba8836a3b4ef2975eb35f0b27065e212659313a78
Instruction ID: 7151c4544b5a5fd994395aca003c57c00330b47b6bbedd503d8a7baf7145f13e
Opcode Fuzzy Hash: 4a69e9522ff560458051ec1ba8836a3b4ef2975eb35f0b27065e212659313a78
Instruction Fuzzy Hash: 7B01E661E0D9468EFD94EB1DF4511B96360AF857C0F890231FB0E572ABEEACF5808701

Function 00007FF8BEE11549 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 31COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FF8BEE115FD

Strings

A generic error has occured, xrefs: 00007FF8BEE11549
====================================, xrefs: 00007FF8BEE11622
Here is the stack trace:, xrefs: 00007FF8BEE11611
Description: %s, xrefs: 00007FF8BEE115EA

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: FreeLocal
String ID: ====================================$A generic error has occured$Description: %s$Here is the stack trace:
API String ID: 2826327444-2479978688
Opcode ID: 4878480ea47d561040410f0f84e6f0f0e1a8efa5d006c276a542e0dabd8cca74
Instruction ID: 3a5cd5e4e2b4b8e964a7614961b5b4459a5fe2eed46e9ff423aeab421171b852
Opcode Fuzzy Hash: 4878480ea47d561040410f0f84e6f0f0e1a8efa5d006c276a542e0dabd8cca74
Instruction Fuzzy Hash: 0301C261E0D9468EF984EB1DB4511B96360AF857C0F890231EB0E572ABEEACF5808701

Function 00007FF8BEE11555 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 31COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FF8BEE115FD

Strings

Insufficient memory. Please close some applications and try again, xrefs: 00007FF8BEE11555
====================================, xrefs: 00007FF8BEE11622
Here is the stack trace:, xrefs: 00007FF8BEE11611
Description: %s, xrefs: 00007FF8BEE115EA

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: FreeLocal
String ID: ====================================$Description: %s$Here is the stack trace:$Insufficient memory. Please close some applications and try again
API String ID: 2826327444-3218687599
Opcode ID: 7bb42ebe61512666ec6cb57e6b43ee85e0bb6e591d5c5e8ac78c43debcde0836
Instruction ID: c1092691d7ca00c6774266cbfd50d4397a10b164f859f4964b317082131e244b
Opcode Fuzzy Hash: 7bb42ebe61512666ec6cb57e6b43ee85e0bb6e591d5c5e8ac78c43debcde0836
Instruction Fuzzy Hash: 3101E661E0D9468EFD84EB1DF4511B96360AF857C0F890231FB4E572ABEEACF5818701

Function 00007FF8BEE5BC44 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 319COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF8BEE5BDE2

Strings

csm, xrefs: 00007FF8BEE5BD29
csm, xrefs: 00007FF8BEE5BE09
csm, xrefs: 00007FF8BEE5BD8B

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Is_bad_exception_allowed
String ID: csm$csm$csm
API String ID: 2758241748-393685449
Opcode ID: 0f408a928b9063f3cb43c95ecb0e6ad9ed1d94acb3a705d365a36861a7962b86
Instruction ID: d7f43ab76bdb019a6727b0721f8586ee2fb5a439a85014db696162e9bfa8eadf
Opcode Fuzzy Hash: 0f408a928b9063f3cb43c95ecb0e6ad9ed1d94acb3a705d365a36861a7962b86
Instruction Fuzzy Hash: 1AE18CB290868A8EE7209F68D4912AD7BE0EB45788F140136EF9D57696DF7CF581CB00

Function 00007FF8BEE6A874 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE6AB53

Part of subcall function 00007FF8BEE6C200: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE6C21D

Strings

ccs, xrefs: 00007FF8BEE6AA8E
UTF-8, xrefs: 00007FF8BEE6AAD2
UTF-16LEUNICODE, xrefs: 00007FF8BEE6AAF1

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 029c5fe67b73cdfdd60bdaa44205972f0f340c7a38dfe566cdf3be9392e55d4c
Instruction ID: b5eb57417113c94416e8d948da965610a31ab2c7b9163b9bb00c1021b5d73f39
Opcode Fuzzy Hash: 029c5fe67b73cdfdd60bdaa44205972f0f340c7a38dfe566cdf3be9392e55d4c
Instruction Fuzzy Hash: 1E81AC72E0C2428DFB658F2DC25427977A1EF21BC8F55803ADB0E97295DBADF9019701

Function 00007FF8BEE6A5B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE6A859

Part of subcall function 00007FF8BEE72A6C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE72A89

Strings

UTF-16LEUNICODE, xrefs: 00007FF8BEE6A7FD
ccs, xrefs: 00007FF8BEE6A7A5
UTF-8, xrefs: 00007FF8BEE6A7DC

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 79f6d62af0d2a11728363c4cf58a475a223f689a94163aa021ca5029a70fb927
Instruction ID: 527476fc1feff71d2760ca205332bfdfe1316dd9955a706e7115169e6edab71f
Opcode Fuzzy Hash: 79f6d62af0d2a11728363c4cf58a475a223f689a94163aa021ca5029a70fb927
Instruction Fuzzy Hash: 4B817D32D0C2428DF7759E2C96583782BE19F12BC8F559035CB1E8B696EFEDB8429701

Function 00007FF8BEE5A8F4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF8BEE5A91F
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF8BEE5A9B6
RtlUnwindEx.KERNEL32 ref: 00007FF8BEE5AA10

Strings

csm, xrefs: 00007FF8BEE5A99D

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: b0775caf7f1d2b05c3f24c6280081a2cbd6f04dd6fb58565bd2260f94b75ca7d
Instruction ID: 6c56cb04be0beaaff447e5908b24b2186bcf8432592f68d5d1e5592d97505972
Opcode Fuzzy Hash: b0775caf7f1d2b05c3f24c6280081a2cbd6f04dd6fb58565bd2260f94b75ca7d
Instruction Fuzzy Hash: 9A519D72A1960A8EEB148F19E944A7937D1EB44BD8F558132EB4E47789DFBCF841C700

Function 00007FF8BEE410E0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 150threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF8BEE41171
IsDebuggerPresent.KERNEL32 ref: 00007FF8BEE4126F
OutputDebugStringW.KERNEL32 ref: 00007FF8BEE412FA

Strings

D:\a\ExplorerPatcher\ExplorerPatcher\packages\Microsoft.Windows.ImplementationLibrary.1.0.230824.2\include\wil\resource.h, xrefs: 00007FF8BEE4117B

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CurrentDebugDebuggerOutputPresentStringThread
String ID: D:\a\ExplorerPatcher\ExplorerPatcher\packages\Microsoft.Windows.ImplementationLibrary.1.0.230824.2\include\wil\resource.h
API String ID: 4268342597-2916856121
Opcode ID: c2409748dd961db57dd970ab792968617b87b09f0f36ecc3f1e9a3576d394143
Instruction ID: 9bfb778389cb74a28afabf871402568ee15939b19a86941e8fe1f58781f39e5f
Opcode Fuzzy Hash: c2409748dd961db57dd970ab792968617b87b09f0f36ecc3f1e9a3576d394143
Instruction Fuzzy Hash: D4613222A197868DEB619F69E4412AD77F4FF89784F440139EB8D82BA4DFBCE540C704

Function 00007FF8BEE5C938 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF8BEE5C960
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF8BEE5CA48

Strings

csm, xrefs: 00007FF8BEE5CA9A
csm, xrefs: 00007FF8BEE5C982

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 263a83af241b7526f11cabccce44437bc8b50dcc97adeb20576438e6a8d85533
Instruction ID: def648f0c4ba7b5bb4ced379b347d45e43b312b5430de1eda3ebb04be0495bb6
Opcode Fuzzy Hash: 263a83af241b7526f11cabccce44437bc8b50dcc97adeb20576438e6a8d85533
Instruction Fuzzy Hash: CB51BEB2A0838A8EEB648B1994A436877E1FB54BC4F244536DB8D47B85CFBCF490C701

Function 00007FF8BEE490F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121comCOMMON

Download Yara Rule

APIs

MonitorFromRect.USER32 ref: 00007FF8BEE4912F
CoCreateInstance.OLE32 ref: 00007FF8BEE4915E
GetMonitorInfoW.USER32 ref: 00007FF8BEE491DF

Strings

TwinUIPatches.cpp, xrefs: 00007FF8BEE4920F

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Monitor$CreateFromInfoInstanceRect
String ID: TwinUIPatches.cpp
API String ID: 3092215291-2263794832
Opcode ID: cd0172f9358455f7de5327db1c0183027fbaee7a9058c5023375d1bee2188970
Instruction ID: 3d7339e8c20a7de7925ba651b603adcc754139b16e5fa5fa337ac9a3d97b1e39
Opcode Fuzzy Hash: cd0172f9358455f7de5327db1c0183027fbaee7a9058c5023375d1bee2188970
Instruction Fuzzy Hash: DE51FD32B05A429DEB00CFB9E4906AD73B4FB84B88F045536DA0D67A28DF79D559C340

Function 00007FF8BEE7B5B9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8BEE7B607
SysFreeString.OLEAUT32 ref: 00007FF8BEE7B6B4

Part of subcall function 00007FF8BEE3A9E0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,00000000,00007FF8BEE3B2DF,?,?,?,?,?,00000000,?,00007FF8BEE3BADB), ref: 00007FF8BEE3AA03

MultiByteToWideChar.KERNEL32 ref: 00007FF8BEE7B645

Part of subcall function 00007FF8BEE3FFA0: GetProcessHeap.KERNEL32 ref: 00007FF8BEE3FFC4
Part of subcall function 00007FF8BEE3FFA0: HeapFree.KERNEL32 ref: 00007FF8BEE3FFD1

Strings

W, xrefs: 00007FF8BEE7B66E

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Heap$ByteCharFreeMultiProcessWide$String
String ID: W
API String ID: 3011908892-655174618
Opcode ID: b955a97a5b32027b3c2abb87ce5cf3b74ac42c216eb46514c0301bc97ed473c0
Instruction ID: d03fffdadbeec1648737b4bc8ed017d181c6e508013f12a00a31678939c11c6d
Opcode Fuzzy Hash: b955a97a5b32027b3c2abb87ce5cf3b74ac42c216eb46514c0301bc97ed473c0
Instruction Fuzzy Hash: FF318F62604A858DE710EF6AE8503AA6B91EB847E8F144234FB5E47BDADFB9D4418340

Function 00007FF8BEE2ACE0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57registrystringCOMMON

Download Yara Rule

APIs

lstrcmpW.KERNEL32 ref: 00007FF8BEE2AD3F
RegSetValueExW.ADVAPI32 ref: 00007FF8BEE2AD9E

Part of subcall function 00007FF8BEE12890: GetModuleHandleW.KERNEL32 ref: 00007FF8BEE128AF
Part of subcall function 00007FF8BEE12890: GetProcAddress.KERNEL32 ref: 00007FF8BEE128C8
Part of subcall function 00007FF8BEE12890: RegOpenKeyExW.KERNEL32 ref: 00007FF8BEE1293F
Part of subcall function 00007FF8BEE12890: RegQueryValueExW.KERNEL32 ref: 00007FF8BEE1296F

Strings

TaskbarDa, xrefs: 00007FF8BEE2AD5E, 00007FF8BEE2AD79
ShowCortanaButton, xrefs: 00007FF8BEE2AD35

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Value$AddressHandleModuleOpenProcQuerylstrcmp
String ID: ShowCortanaButton$TaskbarDa
API String ID: 4138643572-1008683796
Opcode ID: fc8ece550bb8c7acf918c61d312ddb5ea9bba7b5a151fc2a031c54a26226eecd
Instruction ID: 197081582bd83196de4b266d4b402ffc32114dfd552907db7fb8f552e3204e6f
Opcode Fuzzy Hash: fc8ece550bb8c7acf918c61d312ddb5ea9bba7b5a151fc2a031c54a26226eecd
Instruction Fuzzy Hash: B521A472A08A468EEB608F19F88067A77A0BB487D9F404035EB4E47755EFBCE845CB00

Function 00007FF8BEE20A00 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50registryCOMMON

Download Yara Rule

APIs

RegGetValueW.ADVAPI32 ref: 00007FF8BEE20AB6

Part of subcall function 00007FF8BEE68004: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE68021

SHRegGetValueFromHKCUHKLM.SHLWAPI ref: 00007FF8BEE20A81

Strings

EnableMTCUVC, xrefs: 00007FF8BEE20A46
Software\Microsoft\Windows NT\CurrentVersion\MTCUVC, xrefs: 00007FF8BEE20A33

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Value$From_invalid_parameter_noinfo
String ID: EnableMTCUVC$Software\Microsoft\Windows NT\CurrentVersion\MTCUVC
API String ID: 1239731142-1716574372
Opcode ID: 5861e141445f8e955a3289905a4e437a090633403b9959973d8ba9a70dd700b4
Instruction ID: a840b5dcf0865e3aed1a56e1b7ca35c9e8cafa674cbe3456c9d15e2efac834f4
Opcode Fuzzy Hash: 5861e141445f8e955a3289905a4e437a090633403b9959973d8ba9a70dd700b4
Instruction Fuzzy Hash: CE116071A0CB4589EA60CF5AF44426AB3A1FB48BD4F544135EF8D43BA9DF7CE0408B04

Function 00007FF8BEE20EB0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32 ref: 00007FF8BEE20ED9
GetMenuItemInfoW.USER32 ref: 00007FF8BEE20F10

Strings

P, xrefs: 00007FF8BEE20EF5
", xrefs: 00007FF8BEE20F03

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ItemMenu$CountInfo
String ID: "$P
API String ID: 115949281-1577843662
Opcode ID: 16e21393e86f85a400357fa905794d203e81493258b4ba4839ecfb9ad0c58f16
Instruction ID: 9047a68cb4f56f0648d3c27031d6e5ce0417c0b672a947087912456643a21fc3
Opcode Fuzzy Hash: 16e21393e86f85a400357fa905794d203e81493258b4ba4839ecfb9ad0c58f16
Instruction Fuzzy Hash: 2E111F31A19A828AF760CF29E45472E67A0FB49BD4F444135EB8D82B98CFBDE5458B04

Function 00007FF8BEE22F10 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44registrystringCOMMON

Download Yara Rule

APIs

lstrcmpW.KERNEL32 ref: 00007FF8BEE22F3A
SHRegGetValueFromHKCUHKLM.SHLWAPI ref: 00007FF8BEE22F78
RegGetValueW.ADVAPI32 ref: 00007FF8BEE22FAA

Strings

UseWin32BatteryFlyout, xrefs: 00007FF8BEE22F2A

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Value$Fromlstrcmp
String ID: UseWin32BatteryFlyout
API String ID: 276759952-619460319
Opcode ID: c065c0d2f960dd8f936992df36bb8e8c96ba532300c4fed80597d46d2c895608
Instruction ID: 139b009434fa1ea17eac823b8e8cc619e3490562e3634264773a4e03997f4bac
Opcode Fuzzy Hash: c065c0d2f960dd8f936992df36bb8e8c96ba532300c4fed80597d46d2c895608
Instruction Fuzzy Hash: F5110636A08B8185EA208F1AF88055AB7A4FB89BD4F584135EF8D57B28DF7CD0548B04

Function 00007FF8BEE23EE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34threadCOMMON

Download Yara Rule

APIs

FindWindowExW.USER32 ref: 00007FF8BEE23F08
GetWindowThreadProcessId.USER32 ref: 00007FF8BEE23F13
EnumThreadWindows.USER32 ref: 00007FF8BEE23F28

Strings

ApplicationManager_ImmersiveShellWindow, xrefs: 00007FF8BEE23EFD

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ThreadWindow$EnumFindProcessWindows
String ID: ApplicationManager_ImmersiveShellWindow
API String ID: 274631990-213675812
Opcode ID: 6e7747a90d7feac162397ed771bd533da0d24bf3604af7f567f007bcb59fafea
Instruction ID: 62472bb47b6d2ec18a66a5439de2f76b9202fd56f532a6a366d248ca401f1015
Opcode Fuzzy Hash: 6e7747a90d7feac162397ed771bd533da0d24bf3604af7f567f007bcb59fafea
Instruction Fuzzy Hash: 3EF0C261F1874289FF64DB7AB980079A362AF8DBC0F489431DE0D47754DEBCD4848700

Function 00007FF8BEE12CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

FindWindowExW.USER32 ref: 00007FF8BEE12CDC
FindWindowExW.USER32 ref: 00007FF8BEE12CF6

Strings

WorkerW, xrefs: 00007FF8BEE12CEA
SHELLDLL_DefView, xrefs: 00007FF8BEE12CCD

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: FindWindow
String ID: SHELLDLL_DefView$WorkerW
API String ID: 134000473-2583568628
Opcode ID: bcb08aa4f46a98805f56447e0641afb3d08a4efac12ff943e5d5823cef5df09c
Instruction ID: d3665633e80147c19f6ea9672b6d8896c54cbc58161977eef2e9ffe7a7dce045
Opcode Fuzzy Hash: bcb08aa4f46a98805f56447e0641afb3d08a4efac12ff943e5d5823cef5df09c
Instruction Fuzzy Hash: 1DE06561B0574245FB998B65FA54AA666A1EF4CBC0F488035CF0D17B54DE7CD484C300

Function 00007FF8BEE1E760 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24windowregistryCOMMON

Download Yara Rule

APIs

GetClassWord.USER32 ref: 00007FF8BEE1E77A
RegisterWindowMessageW.USER32 ref: 00007FF8BEE1E78A
PostMessageW.USER32 ref: 00007FF8BEE1E7A2

Strings

WorkerW, xrefs: 00007FF8BEE1E780

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Message$ClassPostRegisterWindowWord
String ID: WorkerW
API String ID: 18795929-1267966093
Opcode ID: 000a1699d6c733d8297f14a566244c7bad78dbd5b75204c92b2b73296a67d543
Instruction ID: d61f3943a1d925ce528069f95699eb8d3cc25ee59088c6d1c0d34baaadfc3e28
Opcode Fuzzy Hash: 000a1699d6c733d8297f14a566244c7bad78dbd5b75204c92b2b73296a67d543
Instruction Fuzzy Hash: 27F03720A0869142F740475AB98457A6650EB85BD4F544131EF5D53F59DE6CD5918700

Function 00007FF8BEE32F30 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF8BEE32F4F
GetProcAddress.KERNEL32 ref: 00007FF8BEE32F5F

Strings

RaiseFailFastException, xrefs: 00007FF8BEE32F58
kernelbase.dll, xrefs: 00007FF8BEE32F45

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RaiseFailFastException$kernelbase.dll
API String ID: 1646373207-919018592
Opcode ID: aff523935e77aa5942e22dd7d409c00eae744fc5a90c305d315768be12512c97
Instruction ID: 1061e8c51779c5bea6d327efbdb498269e2033bc041bb6b155846e0553945c2c
Opcode Fuzzy Hash: aff523935e77aa5942e22dd7d409c00eae744fc5a90c305d315768be12512c97
Instruction Fuzzy Hash: F1E03925B1979196EB458B5AF880029A7A0FF8DBC0F489035EE4D17B28CE7CD5418700

Function 00007FF8BEE71818 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF8BEE71897
WriteFile.KERNEL32 ref: 00007FF8BEE71B5F
WriteFile.KERNEL32 ref: 00007FF8BEE71BA5
GetLastError.KERNEL32 ref: 00007FF8BEE71C5B

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 827301bbf73ee794d4cbbb220726300af4e68b43f7bc6836aeb60430446fd9f0
Instruction ID: 05abe28b4fbb44c69b62c635fd7ab139f2ae26be547047eae1116c0ed45017e9
Opcode Fuzzy Hash: 827301bbf73ee794d4cbbb220726300af4e68b43f7bc6836aeb60430446fd9f0
Instruction Fuzzy Hash: 98D1CE72B18B818DE715CFA9D4802AC3BB1EB45BD8F044225EF5E97B99DE78E406C340

Function 00007FF8BEE3CEC0 Relevance: 6.2, APIs: 4, Instructions: 211memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,00000000), ref: 00007FF8BEE3CFBD
HeapFree.KERNEL32(?,?,?,00000000), ref: 00007FF8BEE3CFCB
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE3D0C2
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE3D136

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Heap_invalid_parameter_noinfo$FreeProcess
String ID:
API String ID: 3364316771-0
Opcode ID: cea42ef51c2c06b5f114bfec80a09f6f38cf7f9a6300bdbeb4d183cee8b85edc
Instruction ID: 4111af33accf473e67dd734312b8fb752711b905584e97a8c8088cbbbb2b3c74
Opcode Fuzzy Hash: cea42ef51c2c06b5f114bfec80a09f6f38cf7f9a6300bdbeb4d183cee8b85edc
Instruction Fuzzy Hash: FC81E266A49B8289EB168F199644279A7B6FF04FD8F188431DF4D07789CFBDE466C300

Function 00007FF8BEE220A0 Relevance: 6.1, APIs: 4, Instructions: 117windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BEE1D750: QueryPerformanceFrequency.KERNEL32 ref: 00007FF8BEE1D768
Part of subcall function 00007FF8BEE1D750: QueryPerformanceCounter.KERNEL32 ref: 00007FF8BEE1D777

GetCursorPos.USER32 ref: 00007FF8BEE2210F
#410.COMCTL32 ref: 00007FF8BEE221CA
TrackPopupMenu.USER32 ref: 00007FF8BEE221F0
#412.COMCTL32 ref: 00007FF8BEE2221E

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: PerformanceQuery$#410#412CounterCursorFrequencyMenuPopupTrack
String ID:
API String ID: 2611046820-0
Opcode ID: 6e4c59f5cddd525b48263cefdc0b17beb49f6c27f7a0b4ce120e260110584f11
Instruction ID: ab8be73a9238bbd4e08afa2f0c16f938996d0bf57e95c9772066e4c2a64a879e
Opcode Fuzzy Hash: 6e4c59f5cddd525b48263cefdc0b17beb49f6c27f7a0b4ce120e260110584f11
Instruction Fuzzy Hash: 2D415132A086428EEB208F59E48066EA7A0FF897D0F504036EB4D57764CEBDE845CB40

Function 00007FF8BEE21EF0 Relevance: 6.1, APIs: 4, Instructions: 116windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BEE1D750: QueryPerformanceFrequency.KERNEL32 ref: 00007FF8BEE1D768
Part of subcall function 00007FF8BEE1D750: QueryPerformanceCounter.KERNEL32 ref: 00007FF8BEE1D777

GetCursorPos.USER32 ref: 00007FF8BEE21F5B
#410.COMCTL32 ref: 00007FF8BEE22014
TrackPopupMenuEx.USER32 ref: 00007FF8BEE22032
#412.COMCTL32 ref: 00007FF8BEE22060

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: PerformanceQuery$#410#412CounterCursorFrequencyMenuPopupTrack
String ID:
API String ID: 2611046820-0
Opcode ID: 94383dd62891745bf7bce47a25c8260786a77ccf9eff9fd3b064278bc6400af2
Instruction ID: 491874cf2d1b856c2e91ead0bd6f0f5fe5df3b266c619a727cfae182594d16a5
Opcode Fuzzy Hash: 94383dd62891745bf7bce47a25c8260786a77ccf9eff9fd3b064278bc6400af2
Instruction Fuzzy Hash: F5415D22A1D6828EFA608F59E88067EB7A1FF897D0F504036EB4D47654CEBCE941CB40

Function 00007FF8BEE1EBF0 Relevance: 6.1, APIs: 4, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

QISearch.SHLWAPI ref: 00007FF8BEE1EC0D
VirtualProtect.KERNEL32 ref: 00007FF8BEE1EC60
VirtualProtect.KERNEL32 ref: 00007FF8BEE1ECDE
VirtualProtect.KERNEL32 ref: 00007FF8BEE1ED20

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ProtectVirtual$Search
String ID:
API String ID: 1061791571-0
Opcode ID: 946f8cae8b5b9d015c77196a61e294205d4a01f28a426854e1f270abb1160bd5
Instruction ID: 54cf023a2965fdc06208a077d9dcb3554b7a3e3fc3bebad2d8e80690669a55ad
Opcode Fuzzy Hash: 946f8cae8b5b9d015c77196a61e294205d4a01f28a426854e1f270abb1160bd5
Instruction Fuzzy Hash: 99413D76A09A468AFB608B19E49036677A0FB89BD4F115036EB0D437B4DFBCE8D5C740

Function 00007FF8BEE3F9C0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8BEE3F9E3
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF8BEE3F9FA
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF8BEE3FA75
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF8BEE3FA9E

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID:
API String ID: 17069307-0
Opcode ID: 313c56aac8693e6bd7644ef5f6484252a958648c6b86227760b8e058a361e185
Instruction ID: 735ede42a42fe02237549e2ee6097648a85705bd3edadc400dab1354d53c013f
Opcode Fuzzy Hash: 313c56aac8693e6bd7644ef5f6484252a958648c6b86227760b8e058a361e185
Instruction Fuzzy Hash: 5221C122718B8685EB41DF29E5902AD73A0FB88BC4F484431EB8D83B89DF7CD551CB00

Function 00007FF8BEE4FBD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

RmStartSession.RSTRTMGR ref: 00007FF8BEE4FBFF

Part of subcall function 00007FF8BEE4FA80: FindWindowW.USER32 ref: 00007FF8BEE4FAB7
Part of subcall function 00007FF8BEE4FA80: GetWindowThreadProcessId.USER32 ref: 00007FF8BEE4FACB
Part of subcall function 00007FF8BEE4FA80: K32EnumProcesses.KERNEL32 ref: 00007FF8BEE4FAEB
Part of subcall function 00007FF8BEE4FA80: OpenProcess.KERNEL32 ref: 00007FF8BEE4FB26
Part of subcall function 00007FF8BEE4FA80: K32GetProcessImageFileNameW.KERNEL32 ref: 00007FF8BEE4FB45
Part of subcall function 00007FF8BEE4FA80: GetProcessTimes.KERNEL32 ref: 00007FF8BEE4FB67
Part of subcall function 00007FF8BEE4FA80: CloseHandle.KERNEL32 ref: 00007FF8BEE4FB82

RmRegisterResources.RSTRTMGR ref: 00007FF8BEE4FC4E
RmGetList.RSTRTMGR ref: 00007FF8BEE4FC7B
RmShutdown.RSTRTMGR ref: 00007FF8BEE4FC96

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Process$Window$CloseEnumFileFindHandleImageListNameOpenProcessesRegisterResourcesSessionShutdownStartThreadTimes
String ID:
API String ID: 1342731755-0
Opcode ID: 20e33d10a4184354a0f613581d4d014b7fe66c7707c619d43fa3e48570e76614
Instruction ID: 84ec262aaade6bf508dfd9c9f17c3062a2c6ac6954d140f52943849bc2fc807f
Opcode Fuzzy Hash: 20e33d10a4184354a0f613581d4d014b7fe66c7707c619d43fa3e48570e76614
Instruction Fuzzy Hash: D3210C72A18B828AE710DF28E8946AA73A1FFC9794F405135E78D42A64DFBCE545CB40

Function 00007FF8BEE51F08 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8BEE51F34
GetCurrentThreadId.KERNEL32 ref: 00007FF8BEE51F42
GetCurrentProcessId.KERNEL32 ref: 00007FF8BEE51F4E
QueryPerformanceCounter.KERNEL32 ref: 00007FF8BEE51F5E

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: eb4a947963e005101faac0d65b8e27ef659be33c1a433e75e87c82fc8b7ad02a
Instruction ID: 6a1cb80124c94dc24f69324ac14f79095dd00088fd2308e0f181577e5ce92340
Opcode Fuzzy Hash: eb4a947963e005101faac0d65b8e27ef659be33c1a433e75e87c82fc8b7ad02a
Instruction Fuzzy Hash: 2C113C22B15F058EEB00DF64E8942B833A4FB59798F441E35EB6D967A8DFBCD1548340

Function 00007FF8BEE1158B Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FF8BEE115FD

Strings

====================================, xrefs: 00007FF8BEE11622
Here is the stack trace:, xrefs: 00007FF8BEE11611
Description: %s, xrefs: 00007FF8BEE115EA

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: FreeLocal
String ID: ====================================$Description: %s$Here is the stack trace:
API String ID: 2826327444-530566993
Opcode ID: 5edbddd9c504f60b4359ff91c015bc9b2d895708f4c1124b9fa623321c0ba941
Instruction ID: 81b2486e33239edf869d0e1b5279efe3fcaf46ec466e9f1566d71f68386955d6
Opcode Fuzzy Hash: 5edbddd9c504f60b4359ff91c015bc9b2d895708f4c1124b9fa623321c0ba941
Instruction Fuzzy Hash: 72F0E661E0D5468EFA80EB1DB45117D6360AF857C0F450231FB4E5729BEEACF5808711

Function 00007FF8BEE5CB70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF8BEE5CB9A

Strings

csm, xrefs: 00007FF8BEE5CD2E
csm, xrefs: 00007FF8BEE5CBBF

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: d8082b7006d163f8c35e851c49aec36f61e2f18eb4ee73712fd4fd4773bdb9fc
Instruction ID: a27a2aefa33c3026900534287a531cca0f63b4c5a13b4f9302f9d49f2bbc0245
Opcode Fuzzy Hash: d8082b7006d163f8c35e851c49aec36f61e2f18eb4ee73712fd4fd4773bdb9fc
Instruction Fuzzy Hash: F17192B29086858EDB608F29D4607797BE0FB45BC8F149136DF8D57A89DF6CE491C700

Function 00007FF8BEE440D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8BEE4427D
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8BEE44283

Strings

.dll, xrefs: 00007FF8BEE441F0, 00007FF8BEE44243

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: .dll
API String ID: 73155330-2738580789
Opcode ID: cfb59001a9207c6cd0ac9777086a35be51a90529a9f34389d0dafd787fd9ac5f
Instruction ID: ac955c419ef165cc4d8494d65ef25547469f2cd329d131baf6aa9500e9368769
Opcode Fuzzy Hash: cfb59001a9207c6cd0ac9777086a35be51a90529a9f34389d0dafd787fd9ac5f
Instruction Fuzzy Hash: CC41E162B08A4289EE109B69E5542BE63A1EB44BE4F940732DB7D07BD5EFBCE041C304

Function 00007FF8BEE71EB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF8BEE71FC7
GetLastError.KERNEL32 ref: 00007FF8BEE71FE9

Strings

U, xrefs: 00007FF8BEE71F73

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 6e8b134f65fd2beae049d5b96ea9d5d6d5a4b9a636e8214698cef711629abd11
Instruction ID: 8d1a5a049c94153c4426b3fcc56994d8a5b8569cc5c67db738255be57bfc19df
Opcode Fuzzy Hash: 6e8b134f65fd2beae049d5b96ea9d5d6d5a4b9a636e8214698cef711629abd11
Instruction Fuzzy Hash: AE41A262A19B818ADB208F69E4943A96BA0FF887D4F444035EF4D87798EFBCD441C710

Function 00007FF8BEE2A030 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 82comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00007FF8BEE2A0E4

Strings

Microsoft.System, xrefs: 00007FF8BEE2A0FF
Microsoft.ProgramsAndFeatures, xrefs: 00007FF8BEE2A10A

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CreateInstance
String ID: Microsoft.ProgramsAndFeatures$Microsoft.System
API String ID: 542301482-3255149969
Opcode ID: 92763ffc1d9867786412e0d7f6ff3e3557efa1aa0ba69767de9fc49c93acccc8
Instruction ID: 93b92ea3ebd70530c2d9004768ef601973ea4d00e8a4e483e522d25ea934539b
Opcode Fuzzy Hash: 92763ffc1d9867786412e0d7f6ff3e3557efa1aa0ba69767de9fc49c93acccc8
Instruction Fuzzy Hash: C9315E26A18A428AFB518F6DE89067963A1BF84BD4F444435EF0E07768EFBDE485C700

Function 00007FF8BEE20F90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF8BEE20FE4

Strings

Shell_TrayWnd, xrefs: 00007FF8BEE20FF3
Shell_SecondaryTrayWnd, xrefs: 00007FF8BEE2103B

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ClassName
String ID: Shell_SecondaryTrayWnd$Shell_TrayWnd
API String ID: 1191326365-1433838494
Opcode ID: c9ea4d571e726979cd25428ce0d519139d513b68f189776e072e990548b2ae5e
Instruction ID: 02a2aaccdf727e990aa65018dfa5ed459e2f06c5c8c7b0005eb676c095434032
Opcode Fuzzy Hash: c9ea4d571e726979cd25428ce0d519139d513b68f189776e072e990548b2ae5e
Instruction Fuzzy Hash: B521EB22A0968186F7649F19A450BBD3361FF98BE0F844136EF4D06799DFBCD585C301

Function 00007FF8BEE210B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF8BEE21104

Strings

Shell_TrayWnd, xrefs: 00007FF8BEE21113
Shell_SecondaryTrayWnd, xrefs: 00007FF8BEE2115B

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ClassName
String ID: Shell_SecondaryTrayWnd$Shell_TrayWnd
API String ID: 1191326365-1433838494
Opcode ID: a6af8759eadf375a40e26f1fd8c17b4b520a4968ee941da5d07fb15a920493dd
Instruction ID: cd118e7b7c624e179c95aaa14ae409b02f36c57eb9dcc81e2ed6da1319e945d5
Opcode Fuzzy Hash: a6af8759eadf375a40e26f1fd8c17b4b520a4968ee941da5d07fb15a920493dd
Instruction Fuzzy Hash: FF21D922A0959586F7649F1DA4506BD33A1FF99BE0F848132EF4D02795DFBCD945D300

Function 00007FF8BEE2B6C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32 ref: 00007FF8BEE2B770

Part of subcall function 00007FF8BEE68004: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8BEE68021

SHFlushSFCache.SHELL32 ref: 00007FF8BEE2B737

Strings

Attributes, xrefs: 00007FF8BEE2B709

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: CacheFlushValue_invalid_parameter_noinfo
String ID: Attributes
API String ID: 3611136396-2126945696
Opcode ID: 473fe7d18576862a84c3b9b6fe93c8222011de4fa89fb592f57f2bc12431410e
Instruction ID: 9eb320a4288a31f9753a44f48c5e498168f4c29155b8e45976d7d0cf2007bc05
Opcode Fuzzy Hash: 473fe7d18576862a84c3b9b6fe93c8222011de4fa89fb592f57f2bc12431410e
Instruction Fuzzy Hash: FC116062A19B818DEB60CF29B88076A77A0AB497D4F041139EF4D47B59EF7CE445C700

Function 00007FF8BEE28700 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FF8BEE28794
VirtualProtect.KERNEL32 ref: 00007FF8BEE287D4

Part of subcall function 00007FF8BEE12890: GetModuleHandleW.KERNEL32 ref: 00007FF8BEE128AF
Part of subcall function 00007FF8BEE12890: GetProcAddress.KERNEL32 ref: 00007FF8BEE128C8
Part of subcall function 00007FF8BEE12890: RegOpenKeyExW.KERNEL32 ref: 00007FF8BEE1293F
Part of subcall function 00007FF8BEE12890: RegQueryValueExW.KERNEL32 ref: 00007FF8BEE1296F

Strings

xx????xxx????xxxxx, xrefs: 00007FF8BEE2875B

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ProtectVirtual$AddressHandleModuleOpenProcQueryValue
String ID: xx????xxx????xxxxx
API String ID: 1029361184-12075917
Opcode ID: 2cdcb021fdd9f9cf0ca9e297d25b3595a024f5c45fdce59915cbe1e1a13bf1f2
Instruction ID: eb3afaf19c4e9d9cd9ae11c0df7608038416b0a2aec2f31d78340312a9836290
Opcode Fuzzy Hash: 2cdcb021fdd9f9cf0ca9e297d25b3595a024f5c45fdce59915cbe1e1a13bf1f2
Instruction Fuzzy Hash: EB215921A0DA868EFF608F28E89126A33A0BF457C4F444036DB4E42AA5DFBCE544CB04

Function 00007FF8BEE5AB84 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF8BEE3503F), ref: 00007FF8BEE5ABD4
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF8BEE3503F), ref: 00007FF8BEE5AC15

Strings

csm, xrefs: 00007FF8BEE5AC02

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: ee37ca2534bea36559d9d190c12bae42e93264b1f79909f83ca4179d035941a4
Instruction ID: 8cc65e4e1099b93cac5d960ad2a089fcd8268957305e944a120761f2a1f09483
Opcode Fuzzy Hash: ee37ca2534bea36559d9d190c12bae42e93264b1f79909f83ca4179d035941a4
Instruction Fuzzy Hash: 57112B72618B4582EB618F29F440269B7E5FB88BC4F584235EF8C47758EF7CD5518B40

Function 00007FF8BEE2FEE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF8BEE2FF30
RegOpenKeyExW.ADVAPI32 ref: 00007FF8BEE2FF55

Strings

$start.tilegrid$windows.data.curatedtilecollection.tilecollection\Current, xrefs: 00007FF8BEE2FEFE

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Open
String ID: $start.tilegrid$windows.data.curatedtilecollection.tilecollection\Current
API String ID: 71445658-2485209836
Opcode ID: a4fe59345262f16846a98a3583e81d6852551d9273177763c1f1091658579aff
Instruction ID: 5bddc50ea5b87453a0afc0f0e8ed94ae5492ef88fd5197624626909d122a8c5f
Opcode Fuzzy Hash: a4fe59345262f16846a98a3583e81d6852551d9273177763c1f1091658579aff
Instruction Fuzzy Hash: 9A014C35608B8185EB20CF0AB84002AB3A5FB89BC4F440535EF8D57B59CFBDE411C704

Function 00007FF8BEE2DA00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32registrystringCOMMON

Download Yara Rule

APIs

RegGetValueW.ADVAPI32 ref: 00007FF8BEE2DA33
lstrcmpW.KERNEL32 ref: 00007FF8BEE2DA45

Strings

ReplaceVan, xrefs: 00007FF8BEE2DA39

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Valuelstrcmp
String ID: ReplaceVan
API String ID: 372169353-130473729
Opcode ID: ea89487583a2989f85a63e4f3d37de35d909f03b5df420a7b1d84c36d94bc7b7
Instruction ID: 7bf10551818ad9f99d624357d226e6bc0f84387b6c1ab8127894a9bc7ba4f07e
Opcode Fuzzy Hash: ea89487583a2989f85a63e4f3d37de35d909f03b5df420a7b1d84c36d94bc7b7
Instruction Fuzzy Hash: 4CF0FF72A08B81C6DB508F19F44051AB7A4F788BD4F584171EB8D43B28DFBCD5968B00

Function 00007FF8BEE1EF20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29windowregistryCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32 ref: 00007FF8BEE1EF4E
RegisterWindowMessageW.USER32 ref: 00007FF8BEE1EF5D

Strings

TaskbarCreated, xrefs: 00007FF8BEE1EF56

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Message$PostQuitRegisterWindow
String ID: TaskbarCreated
API String ID: 1640695409-2362178303
Opcode ID: e40dd106e5c28cd757ea849553ffbbc5691f3de6786a5015d584f4b93040861c
Instruction ID: df8ff6c5823ad233eac29dae15d3fd85d0cc2e063ddb5cf7823ad3a9667a0a65
Opcode Fuzzy Hash: e40dd106e5c28cd757ea849553ffbbc5691f3de6786a5015d584f4b93040861c
Instruction Fuzzy Hash: F0F06D31A1DF818AE7548F5AB98006AB764FB99BD0F184035EB4D03B69CEBCE890C700

Function 00007FF8BEE4FE30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BEE4FBD0: RmStartSession.RSTRTMGR ref: 00007FF8BEE4FBFF
Part of subcall function 00007FF8BEE4FBD0: RmRegisterResources.RSTRTMGR ref: 00007FF8BEE4FC4E
Part of subcall function 00007FF8BEE4FBD0: RmGetList.RSTRTMGR ref: 00007FF8BEE4FC7B
Part of subcall function 00007FF8BEE4FBD0: RmShutdown.RSTRTMGR ref: 00007FF8BEE4FC96

RmRestart.RSTRTMGR ref: 00007FF8BEE4FE44
RmEndSession.RSTRTMGR ref: 00007FF8BEE4FE62

Strings

RmRestart error: %d, xrefs: 00007FF8BEE4FE50

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Session$ListRegisterResourcesRestartShutdownStart
String ID: RmRestart error: %d
API String ID: 4293926141-2348054958
Opcode ID: 54cc6a934dd87566f3e5259231cbfb4de4c3fcb9d1fe53514352706030b0dc14
Instruction ID: 2acbb1d579c933e7c89057965fd31bb330b9c34d230547dd61743fb4bb16ba59
Opcode Fuzzy Hash: 54cc6a934dd87566f3e5259231cbfb4de4c3fcb9d1fe53514352706030b0dc14
Instruction Fuzzy Hash: 09E0ED24F199038EF305AB7D9C9167622B1AFC97A1F501234D31D466A1DFBC6846C744

Function 00007FF8BEE1F6B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF8BEE1F6B6
GetModuleHandleW.KERNEL32 ref: 00007FF8BEE1F6CB

Part of subcall function 00007FF8BEE1F170: GetCurrentProcess.KERNEL32 ref: 00007FF8BEE1F190
Part of subcall function 00007FF8BEE1F170: K32GetModuleInformation.KERNEL32 ref: 00007FF8BEE1F1A7
Part of subcall function 00007FF8BEE1F170: VirtualProtect.KERNEL32 ref: 00007FF8BEE1F1F5
Part of subcall function 00007FF8BEE1F170: VirtualProtect.KERNEL32 ref: 00007FF8BEE1F214

Strings

Windows.UI.Xaml.dll, xrefs: 00007FF8BEE1F6C4

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: ModuleProtectVirtual$CurrentHandleInformationLibraryLoadProcess
String ID: Windows.UI.Xaml.dll
API String ID: 3223347177-2173645706
Opcode ID: 4705757b04769834add8c28f739ce60215544b2ab1f43437472e0612bcaeadca
Instruction ID: 3d14605749baec30076ccf35415b31e1deca5b1e0c5e06260f0bc87a2076bdc0
Opcode Fuzzy Hash: 4705757b04769834add8c28f739ce60215544b2ab1f43437472e0612bcaeadca
Instruction Fuzzy Hash: D1D01700F1A60689EE559769A86007502509F5ABC1F481030CA0E0A3A2EEACE8D6D291

Function 00007FF8BEE1E7C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14threadCOMMON

Download Yara Rule

APIs

FindWindowExW.USER32 ref: 00007FF8BEE1E7D2
GetWindowThreadProcessId.USER32 ref: 00007FF8BEE1E7DD

Strings

ApplicationManager_ImmersiveShellWindow, xrefs: 00007FF8BEE1E7C7

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Window$FindProcessThread
String ID: ApplicationManager_ImmersiveShellWindow
API String ID: 3928697162-213675812
Opcode ID: 93a7cb4f59372fdb730c8bf98ddd9380fbeeac1c84da272d54703491c3626796
Instruction ID: aa6629be17952dc547c0cd4ae63fd10be40dadb48b4733a29ed7ddd4e052e779
Opcode Fuzzy Hash: 93a7cb4f59372fdb730c8bf98ddd9380fbeeac1c84da272d54703491c3626796
Instruction Fuzzy Hash: 36D01265F0A70285F718D776A8905752662AB9A784F808435CA0912650DEBC91868301

Function 00007FF8BEE33D00 Relevance: 5.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF8BEE33D3C
HeapFree.KERNEL32 ref: 00007FF8BEE33D4A
GetProcessHeap.KERNEL32 ref: 00007FF8BEE33D7A
HeapFree.KERNEL32 ref: 00007FF8BEE33D88

Memory Dump Source

Source File: 0000000A.00000002.2175033966.00007FF8BEE11000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8BEE10000, based on PE: true

Associated: 0000000A.00000002.2175011790.00007FF8BEE10000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175083796.00007FF8BEE7D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175117571.00007FF8BEEAA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175144996.00007FF8BEEAB000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175165050.00007FF8BEEB0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175190381.00007FF8BEEB2000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175215709.00007FF8BEEB8000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000A.00000002.2175238612.00007FF8BEEBB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff8bee10000_explorer.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: eb2518a923c2e680aae5d6174970ba7f06051d0c2a8381f7bbfd7a6f48999b07
Instruction ID: 443df28a23106030e2f01a7c85afc371d286b480cce8d6a3c7a458f1f60762d0
Opcode Fuzzy Hash: eb2518a923c2e680aae5d6174970ba7f06051d0c2a8381f7bbfd7a6f48999b07
Instruction Fuzzy Hash: 51116332A0AB81DAEB598F6AE980269B375FB49BD1F484134CB6D43760DF78E461C740

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll

C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll

C:\Program Files\ExplorerPatcher\WebView2Loader.dll

C:\Program Files\ExplorerPatcher\ep_dwm.exe

C:\Program Files\ExplorerPatcher\ep_gui.dll

C:\Program Files\ExplorerPatcher\ep_setup.exe

C:\Program Files\ExplorerPatcher\ep_setup.exe:Zone.Identifier

C:\Program Files\ExplorerPatcher\ep_weather_host.dll

C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ExplorerPatcher\Properties (ExplorerPatcher).lnk

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000014.db

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000015.db

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\C0866EA3E544525B84B4BD79EA00F871272358DC594A98F105A217AFB95AD63000[1].blob

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\39B7A829951E377CD5C4AA3BD72155D9808470F724602420910673D8D0CC60C600[1].blob

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Windows[2].json

C:\Users\user\AppData\Roaming\ExplorerPatcher\StartUI.pdb

C:\Users\user\AppData\Roaming\ExplorerPatcher\twinui.pcshell.pdb

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll

Windows Analysis Report
SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe

Function 00007FF8BEE45CF0 Relevance: 159.8, APIs: 52, Strings: 39, Instructions: 591
registryfileCOMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre