Edit tour

Windows Analysis Report
PagefileConfig.exe

Overview

General Information

Sample name:	PagefileConfig.exe
Analysis ID:	1566859
MD5:	df53b06d20092c35a0e594801c5ddf56
SHA1:	93e19fe9e46baecbe6f104735b33b1ff004e8216
SHA256:	390100a6f28c962f3f3db8026b216dbc8409d3467a4c130692ca2f4f4ec970a0
Infos:

Detection

Score:	5
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Detected potential crypto function

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Program does not show much activity (idle)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

PagefileConfig.exe (PID: 6496 cmdline: "C:\Users\user\Desktop\PagefileConfig.exe" MD5: DF53B06D20092C35A0E594801C5DDF56)

conhost.exe (PID: 2760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: PagefileConfig.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PagefileConfig.exe

Static PE information: certificate valid

Source: PagefileConfig.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: PagefileConfig.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: PagefileConfig.exe	String found in binary or memory: http://www.autoitscript.com/atools/
Source: PagefileConfig.exe, ConDrv.0.dr	String found in binary or memory: http://www.autoitscript.com/tools
Source: PagefileConfig.exe	String found in binary or memory: http://www.autoitscript.com/tools:
Source: PagefileConfig.exe	String found in binary or memory: http://www.autoitscript.com/toolsB
Source: PagefileConfig.exe	String found in binary or memory: http://www.autoitscript.com/toolsThis

Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: 0_2_0079F260	0_2_0079F260
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: 0_2_00799362	0_2_00799362
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: 0_2_00799736	0_2_00799736
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: 0_2_007A27CF	0_2_007A27CF
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: 0_2_00799B42	0_2_00799B42
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: 0_2_00798E8D	0_2_00798E8D
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: 0_2_00799F62	0_2_00799F62

Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: String function: 0079FEA0 appears 49 times
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: String function: 0079AF0E appears 37 times
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: String function: 00788591 appears 32 times
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: String function: 0079AEDB appears 182 times

Source: PagefileConfig.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: clean5.winEXE@2/1@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2760:120:WilError_03

Source: PagefileConfig.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PagefileConfig.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PagefileConfig.exe "C:\Users\user\Desktop\PagefileConfig.exe"
Source: C:\Users\user\Desktop\PagefileConfig.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\PagefileConfig.exe

Section loaded: apphelp.dll

Jump to behavior

Source: PagefileConfig.exe

Static PE information: certificate valid

Source: PagefileConfig.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: PagefileConfig.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: PagefileConfig.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: PagefileConfig.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: PagefileConfig.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: PagefileConfig.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\PagefileConfig.exe

Code function: 0_2_007A6DF4 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_007A6DF4

Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: 0_2_0079FEE5 push ecx; ret		0_2_0079FEF8
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: 0_2_0079AFB3 push ecx; ret		0_2_0079AFC6

Source: C:\Users\user\Desktop\PagefileConfig.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_0-24361
Source: C:\Users\user\Desktop\PagefileConfig.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-25300

Source: C:\Users\user\Desktop\PagefileConfig.exe

API coverage: 9.7 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\PagefileConfig.exe

API call chain: ExitProcess graph end node

graph_0-25302

Source: C:\Users\user\Desktop\PagefileConfig.exe

Code function: 0_2_007985B2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_007985B2

Source: C:\Users\user\Desktop\PagefileConfig.exe

0_2_007A6DF4

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: 0_2_007985B2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_007985B2
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: 0_2_007A1742 SetUnhandledExceptionFilter,	0_2_007A1742
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: 0_2_0079DC7A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0079DC7A
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: 0_2_00798D15 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00798D15
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: 0_2_0078BE8D _abort,__NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0078BE8D

Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: GetLocaleInfoA,	0_2_0079F038
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP,	0_2_007A603D
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	0_2_007A6154
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: __crtGetLocaleInfoA_stat,	0_2_007A711B
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,	0_2_007A61EC
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	0_2_007A6260
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_007A52DF
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,	0_2_007A1349
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	0_2_0079C3EE
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	0_2_007A6432
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_007A64F3
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_007A655A
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,	0_2_007A6596
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,	0_2_007A594D
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: GetLocaleInfoA,	0_2_007A4AAF
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,	0_2_007A5BA5
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA,	0_2_007A6FDC
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: GetLocaleInfoW,	0_2_007A6FA8
Source: C:\Users\user\Desktop\PagefileConfig.exe	Code function: GetLocaleInfoA,___ascii_strnicmp,__tolower_l,__tolower_l,	0_2_007A7F85

Source: C:\Users\user\Desktop\PagefileConfig.exe

Code function: 0_2_007A1EBA GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_007A1EBA

Source: C:\Users\user\Desktop\PagefileConfig.exe

Code function: 0_2_007889E5 GetVersionExW,

0_2_007889E5

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	13 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PagefileConfig.exe	0%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.autoitscript.com/toolsB	PagefileConfig.exe	false	high
http://www.autoitscript.com/atools/	PagefileConfig.exe	false	high
http://www.autoitscript.com/tools:	PagefileConfig.exe	false	high
http://www.autoitscript.com/tools	PagefileConfig.exe, ConDrv.0.dr	false	high
http://www.autoitscript.com/toolsThis	PagefileConfig.exe	false	high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1566859
Start date and time:	2024-12-02 18:58:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PagefileConfig.exe
Detection:	CLEAN
Classification:	clean5.winEXE@2/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 18 Number of non-executed functions: 52
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, otelrules.azureedge.net
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: PagefileConfig.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\PagefileConfig.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	845
Entropy (8bit):	4.559172871464807
Encrypted:	false
SSDEEP:	24:zOFSOOOuP0oBECWxZt858X858sq8tdREq6RR:yFPhM0UsncFRET
MD5:	10B27BC3421249DA288A9872D9946736
SHA1:	BB69ADBAC704AC4CDF2EB76598456076B315ED02
SHA-256:	2CFD0AD67BC755EA227B2E6DAFC647DA4BF9F250F143D687BCD9F72147AF829E
SHA-512:	09E88C5C2549C3C11EFAD3C879039DBCE5F3A9E0AA8E81CFAEF646E8727C601BCA83190EF597A494BB174D1F95E7AF4DBD6D96C5F61342218A64407E166D082B
Malicious:	false
Reputation:	low
Preview:	..PagefileConfig v1.0.0 - Pagefile Configuration Utility..Copyright (C) 2009 Jonathan Bennett..http://www.autoitscript.com/tools....Options:.. -h [ --help ] This help message... -a [ --auto ] Let the system manage all page files... -s [ --set ] arg Set pagefile options for a drive... Where args are: driveletter: min max... Sizes are in megabytes (Mb)... -n [ --none ] Don't use any page files.....Examples:.. PagefileConfig.exe --set C: 1024 4096.. PagefileConfig.exe --set C: 1024 4096 --set D: 512 512.. PagefileConfig.exe --set C: 0 0 --set D: 512 512.. PagefileConfig.exe --auto.. PagefileConfig.exe --none....Notes:.. - Pagefile sizes are in megabytes (Mb)... - Setting min and max to 0 will let the system manage the pagefile for a given drive...

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	6.390151828775151
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PagefileConfig.exe
File size:	254'832 bytes
MD5:	df53b06d20092c35a0e594801c5ddf56
SHA1:	93e19fe9e46baecbe6f104735b33b1ff004e8216
SHA256:	390100a6f28c962f3f3db8026b216dbc8409d3467a4c130692ca2f4f4ec970a0
SHA512:	f576aeeb088c154fb6c54b77aa642b01c4c82dad6a308f0d4e0fab173ed1945c76065fe94bc3e1d8373cdcedc6aceab8da362b5e9940e45d52b49ede7fad22cf
SSDEEP:	3072:UY/hS35NexXsLTvbzOgtDZRxuz0uN1k59A8IAi0LLnEs+oO0wzlBNeun/TOEj2:UY/hL1m7zD8QUExLnElzlBNPKEa
TLSH:	6D447B227BD1C077C26325768CC8D7B9A6F9F8709D358A07BBD4076E9F316A38A11352
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Bxb..............a.......a..;....a..{...!.w.........g....a.......K.......a......Rich............PE..L...y..J...................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x41aa9f
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x4A1CEB79 [Wed May 27 07:27:53 2009 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	ff3580dc3e267752241c0cf58e513fd5

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	08/02/2009 19:00:00 09/02/2012 18:59:59
Subject Chain	CN=Jonathan Bennett, O=Jonathan Bennett, STREET=19 Linnet Close, L=Birmingham, S=West Midlands, PostalCode=B30 1XB, C=GB
Version:	3
Thumbprint MD5:	5FE91C20B3DE6BA483BF3C8D461FAB8B
Thumbprint SHA-1:	B1B968D50B0BED69315EFCE51D307D8DCBEBD584
Thumbprint SHA-256:	771CA562615F9F128FF3993D079825DA87F8800358B67E52172DEA5691E6E4A4
Serial:	00FF3628AC973FD4AF789D25697A20B243

Entrypoint Preview

Instruction
call 00007F8C545FE40Bh
jmp 00007F8C545F6E9Ah
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0042BB5Ch
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F8C545F6FFEh
test byte ptr [eax], 00000008h
je 00007F8C545F6FF9h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [0042B064h]
leave
retn 0008h
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword ptr [ebp+0Ch]
add eax, 0Ch
mov dword ptr [ebp-04h], eax
mov ebx, dword ptr fs:[00000000h]
mov eax, dword ptr [ebx]
mov dword ptr fs:[00000000h], eax
mov eax, dword ptr [ebp+08h]
mov ebx, dword ptr [ebp+0Ch]
mov ebp, dword ptr [ebp-04h]
mov esp, dword ptr [ebx-04h]
jmp eax
pop ebx
leave
retn 0008h
pop eax
pop ecx
xchg dword ptr [esp], eax
jmp eax
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, dword ptr fs:[00000000h]
mov dword ptr [ebp-04h], esi
mov dword ptr [ebp-08h], 0041AB59h
push 00000000h
push dword ptr [ebp+0Ch]
push dword ptr [ebp-08h]
push dword ptr [ebp+08h]
call 00007F8C5460496Ah
mov eax, dword ptr [ebp+0Ch]
mov eax, dword ptr [eax+04h]
and eax, FFFFFFFDh
mov ecx, dword ptr [ebp+0Ch]
mov dword ptr [ecx+00h], eax

Rich Headers

Programming Language:

[ASM] VS2008 SP1 build 30729
[C++] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x35220	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3c000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3ce00	0x1570
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3d000	0x2b3c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2e9a8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x14c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29ce1	0x29e00	12d22b371ba2372c96dc5c938b47ca9b	False	0.5327308768656717	MPEG-4 LOAS, single stream	6.559673592043765	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0xa998	0xaa00	4cadd83a9ce1421085fafb9012cca1b2	False	0.3262637867647059	data	4.507251096462881	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x36000	0x5688	0x3600	1e391e4bac89d42de9ebf02f550d0707	False	0.15719039351851852	OpenPGP Secret Key	4.497366649401155	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3c000	0x59c	0x600	c53884369cfd2c05043bc4f990f7f198	False	0.41015625	data	4.301412065725441	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3d000	0x44ea	0x4600	d27b7ce4c349bff4cb952f5ae69a31e7	False	0.452734375	data	4.861125957490916	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x3c0a0	0x394	OpenPGP Secret Key	English	Great Britain	0.41375545851528384
RT_MANIFEST	0x3c434	0x165	ASCII text, with CRLF line terminators	English	United States	0.5434173669467787

Imports

DLL

Import

KERNEL32.dll

GetVersionExW, GetFileAttributesW, CreateFileA, SetStdHandle, InterlockedIncrement, InterlockedDecrement, WideCharToMultiByte, InterlockedCompareExchange, InterlockedExchange, MultiByteToWideChar, Sleep, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, RaiseException, RtlUnwind, GetLastError, HeapFree, GetCPInfo, LCMapStringA, LCMapStringW, GetStringTypeW, GetModuleHandleW, GetProcAddress, ExitProcess, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, HeapSize, HeapAlloc, GetACP, GetOEMCP, IsValidCodePage, WriteFile, GetStdHandle, GetModuleFileNameA, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, VirtualAlloc, HeapReAlloc, GetConsoleCP, GetConsoleMode, FlushFileBuffers, ReadFile, SetFilePointer, CloseHandle, GetStringTypeA, GetLocaleInfoA, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, LoadLibraryA, InitializeCriticalSectionAndSpinCount, GetLocaleInfoW, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW

ADVAPI32.dll

RegOpenKeyExW, RegQueryValueExW, RegCloseKey, RegSetValueExW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Target ID:	0
Start time:	12:59:23
Start date:	02/12/2024
Path:	C:\Users\user\Desktop\PagefileConfig.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PagefileConfig.exe"
Imagebase:	0x780000
File size:	254'832 bytes
MD5 hash:	DF53B06D20092C35A0E594801C5DDF56
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:59:23
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.5%
Total number of Nodes:	1538
Total number of Limit Nodes:	8

Executed Functions

Function 00781318 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 214
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 00781334

Part of subcall function 00781729: __EH_prolog3_GS.LIBCMT ref: 00781730

Part of subcall function 0078183E: __EH_prolog3_GS.LIBCMT ref: 00781845

Strings

set, xrefs: 007814C3
help,h, xrefs: 007813D6
none,n, xrefs: 0078140A
Don't use any page files., xrefs: 00781405
This help message., xrefs: 007813D1
Options, xrefs: 0078135D
Let the system manage all page files., xrefs: 007813E2
auto,a, xrefs: 007813E7
help, xrefs: 00781461
none, xrefs: 00781568
Set pagefile options for a drive. Where args are: driveletter: min max. Sizes are in megabytes (Mb)., xrefs: 007813F3
set,s, xrefs: 007813F9
auto, xrefs: 00781506

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: H_prolog3_$H_prolog3_catch
String ID: Don't use any page files.$Let the system manage all page files.$Options$Set pagefile options for a drive. Where args are: driveletter: min max. Sizes are in megabytes (Mb).$This help message.$auto$auto,a$help$help,h$none$none,n$set$set,s
API String ID: 756925408-3976253575
Opcode ID: 025db0c26deeb3d6bd1629104f370a2fe2a438565ef677055b78cba226e8f9ae
Instruction ID: 2e9b0942462e51bc5f3ca4ff46fe64ea9cdd9ee9e0a9077444f09c1a4a3a859e
Opcode Fuzzy Hash: 025db0c26deeb3d6bd1629104f370a2fe2a438565ef677055b78cba226e8f9ae
Instruction Fuzzy Hash: 0B71B471980248EADF20FBA4D84AEEDB7B89F55300F504159F40AA3182EF3C5F49C762

Function 0078B60D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 171
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0078B614
_Fputc.LIBCPMT ref: 0078B7C5

Strings

, xrefs: 0078B738

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: FputcH_prolog3_
String ID:
API String ID: 4013897487-3916222277
Opcode ID: d0d21321cc4976f3d3a6e113c103db4135d2d8f06d689020b41f6650832bbf4c
Instruction ID: 870112d607813e9521e1618afb537c06cad1d4adc853315f988868767f984a91
Opcode Fuzzy Hash: d0d21321cc4976f3d3a6e113c103db4135d2d8f06d689020b41f6650832bbf4c
Instruction Fuzzy Hash: 5E51A436980209DBDF14FFA4C8859FEB7B5AF98300F54842AF502A7581EF78A944CB51

Function 00789F88 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00789F8F
_Fputc.LIBCPMT ref: 00789FE3
_Fputc.LIBCPMT ref: 0078A111

Strings

, xrefs: 0078A09B

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: Fputc$H_prolog3_
String ID:
API String ID: 2569218679-3916222277
Opcode ID: 0951ffa38b7fcb0cf05d388ff158a054b742ee26f48c4008a31924078e3ab27b
Instruction ID: a95f4d7ab144011821b7bf1a079ba174411ec9eb0b649afc249392dd8a443360
Opcode Fuzzy Hash: 0951ffa38b7fcb0cf05d388ff158a054b742ee26f48c4008a31924078e3ab27b
Instruction Fuzzy Hash: DD519631D80208EFDF14FBA4D889DFEB7B5AF95300F18851AE612A7181EF39A904CB51

Function 007987A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 007987BC

Part of subcall function 007A00DB: __FF_MSGBANNER.LIBCMT ref: 007A00FE
Part of subcall function 007A00DB: __NMSG_WRITE.LIBCMT ref: 007A0105
Part of subcall function 007A00DB: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,0079DBAC,?,00000001,?,?,007A2228,00000018,007B37B0,0000000C,007A22B9), ref: 007A0152

std::bad_alloc::bad_alloc.LIBCMT ref: 007987DF

Part of subcall function 00798787: std::exception::exception.LIBCMT ref: 00798793

__CxxThrowException@8.LIBCMT ref: 00798801

Strings

JIx, xrefs: 007987B9

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::exception::exception
String ID: JIx
API String ID: 3715980512-4247379014
Opcode ID: 0f2a1a25b8cc12b9ca30536c94d71cce0bad7a2bcc20da63790ad40582859401
Instruction ID: 67d60b300132f7c0b383d4f4f5dec49655ffda23c31f7fabf5bc7e5a5e0f60bc
Opcode Fuzzy Hash: 0f2a1a25b8cc12b9ca30536c94d71cce0bad7a2bcc20da63790ad40582859401
Instruction Fuzzy Hash: 79F0E231501209B6DF8477E0FC0ABAD3BA84B83724B204129E91155192DF7CE90482D2

Function 007886BE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::exception::exception.LIBCMT ref: 007886ED
__CxxThrowException@8.LIBCMT ref: 00788702

Part of subcall function 007987A2: _malloc.LIBCMT ref: 007987BC

Strings

L>{, xrefs: 0078870A

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: L>{
API String ID: 4063778783-13835903
Opcode ID: 9c6e5437e2f4eea5696d89846dd4285181f49dcb85daa3b47e5ad5ae75810e28
Instruction ID: 8c7049a8810e56d100e0519b06a39557c901baf28d7440dc8aa8c2079bbf2959
Opcode Fuzzy Hash: 9c6e5437e2f4eea5696d89846dd4285181f49dcb85daa3b47e5ad5ae75810e28
Instruction Fuzzy Hash: 65F02E715101087ADF48FA64E80AB8E37A9EB50710F60C22DF411910C2EFB4D2448796

Function 00792549 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00792554

Strings

Only one tab per paragraph is allowed, xrefs: 007925C0

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: H_prolog3
String ID: Only one tab per paragraph is allowed
API String ID: 431132790-829416125
Opcode ID: 0ab289a92cd353839ae8e96703d3c038068f0cde48cc7b699ee411ce7adfff6d
Instruction ID: d42e22ff18f23c303737c44b64c634b4d9a3b1cc8bd499c680393488dcb110a5
Opcode Fuzzy Hash: 0ab289a92cd353839ae8e96703d3c038068f0cde48cc7b699ee411ce7adfff6d
Instruction Fuzzy Hash: 89A16B72440148EFCF15FFA0C899EED3BA5AF18354F440159FE06A71A2EB39E955CB90

Function 007845AC Relevance: 3.1, APIs: 2, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 007845B3
_wcslen.LIBCMT ref: 007845C3

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: H_prolog3_catch_wcslen
String ID:
API String ID: 1260878687-0
Opcode ID: d76c38ec8c0577ebb4495c53f36b40977844ec9123102a61e4f6bc9c391e3d2f
Instruction ID: ba2340432e1d99a1745af55206bd415cf09cfb7e759b626e5cfa2d76dcfa8eb4
Opcode Fuzzy Hash: d76c38ec8c0577ebb4495c53f36b40977844ec9123102a61e4f6bc9c391e3d2f
Instruction Fuzzy Hash: D9516670A40206CFCB20EF58C589A6CBBF1AF59304F258099E146DB3A2D7B9DE40CB81

Function 0078446E Relevance: 3.1, APIs: 2, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 00784475
_strlen.LIBCMT ref: 00784482

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: H_prolog3_catch_strlen
String ID:
API String ID: 3133806014-0
Opcode ID: 0b61174bcc40d3afa056609ac00597f900ed842da5a6fd72881c68c6fdcda44e
Instruction ID: cf8f03b9ea983e263c462d467a15ee898f5606d1d914db32c3434ff134dbc5a7
Opcode Fuzzy Hash: 0b61174bcc40d3afa056609ac00597f900ed842da5a6fd72881c68c6fdcda44e
Instruction Fuzzy Hash: B8416D34640245CFCB10EFA8C989B6DBBF0AF18324F254158E655DB3A2C779DE40CB81

Function 00788718 Relevance: 3.1, APIs: 2, Instructions: 62
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 0078871F
char_traits.LIBCPMT ref: 007887BA

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: H_prolog3_catchchar_traits
String ID:
API String ID: 1964944973-0
Opcode ID: 3606756e3f44cb99b91aa17f19677403a71090b5a8ea45f2806f3a9d910bb193
Instruction ID: 6183f5c7a8bb69fd9f2836346484c4bf90df019aa64130314fd4c6f00b0b855b
Opcode Fuzzy Hash: 3606756e3f44cb99b91aa17f19677403a71090b5a8ea45f2806f3a9d910bb193
Instruction Fuzzy Hash: CA11D372A40605EBDB44EF94C84176CB376BB94320FB08616F915AB2C1DF79BA508BD2

Function 0079F4A6 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 0079F4AE

Part of subcall function 0079F47B: GetModuleHandleW.KERNEL32(mscoree.dll,?,0079F4B3,?,?,007A0114,000000FF,0000001E,?,0079DBAC,?,00000001,?,?,007A2228,00000018), ref: 0079F485
Part of subcall function 0079F47B: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0079F495

ExitProcess.KERNEL32 ref: 0079F4B7

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 8b89f3ad6c9b6077b7f69f1968f79a2439f03039763907e3d31a182f8c396ef8
Instruction ID: 5b535f93fcc07aae96cd03c21c2de64fc4cf6b5286803237ccb4755457a16b7d
Opcode Fuzzy Hash: 8b89f3ad6c9b6077b7f69f1968f79a2439f03039763907e3d31a182f8c396ef8
Instruction Fuzzy Hash: 8CB09B31000148FBCF112F51DC0D84B3F25DB81751711C020F41445131DF759D529694

Function 00792AAB Relevance: 1.7, APIs: 1, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00792AB5

Part of subcall function 00791AA2: __EH_prolog3_catch.LIBCMT ref: 00791AA9

Part of subcall function 0078446E: __EH_prolog3_catch.LIBCMT ref: 00784475
Part of subcall function 0078446E: _strlen.LIBCMT ref: 00784482

Part of subcall function 00792986: __EH_prolog3.LIBCMT ref: 00792990

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: H_prolog3H_prolog3_catch$_strlen
String ID:
API String ID: 2084972985-0
Opcode ID: 5a7afcb1de062e0e407e9f0f563a7b48512765dd30e8f2117bf0a32b21a43c87
Instruction ID: 5d9c6e55fe76b46e131f46cc61c56e6ed41c32c4e0d01dad23dbc48bfaad9c8b
Opcode Fuzzy Hash: 5a7afcb1de062e0e407e9f0f563a7b48512765dd30e8f2117bf0a32b21a43c87
Instruction Fuzzy Hash: 7E51B572A44219EEDF05FBF0ED5AAEE77B9AF40310F10441AF40267182EF7C9A5187A5

Function 00792830 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0079283A

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-0
Opcode ID: eb94f2efaf6ceb636488654cf7ff0ccb7f4c1107be3a3e41f8e03b37f6d6d0eb
Instruction ID: 7a9ebc3e3457c6763f1f828ffbfad7da58d824ff2644ff45f58ee3d5ef2edd68
Opcode Fuzzy Hash: eb94f2efaf6ceb636488654cf7ff0ccb7f4c1107be3a3e41f8e03b37f6d6d0eb
Instruction Fuzzy Hash: 72318D71841219EADF25FB50EC5ABEDB378AF16310F4080D9E54977182DF386F8A8B61

Function 00792986 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00792990

Part of subcall function 00792109: __EH_prolog3.LIBCMT ref: 00792110

Part of subcall function 00790B8B: __EH_prolog3.LIBCMT ref: 00790B92

Part of subcall function 0078446E: __EH_prolog3_catch.LIBCMT ref: 00784475
Part of subcall function 0078446E: _strlen.LIBCMT ref: 00784482

Part of subcall function 00791AA2: __EH_prolog3_catch.LIBCMT ref: 00791AA9

Part of subcall function 00791C85: __EH_prolog3_catch.LIBCMT ref: 00791C8C

Part of subcall function 00791F80: __EH_prolog3_catch.LIBCMT ref: 00791F87

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: H_prolog3_catch$H_prolog3$_strlen
String ID:
API String ID: 392102239-0
Opcode ID: ce8874cbfa62dcb2f25fa53a567483e19d720a6a650c51d0f98654caecbf1e70
Instruction ID: b6abdf6ae3a7aa1455c1cfd4b18afef90953d84d9b223780965cb00eb7aa0c5c
Opcode Fuzzy Hash: ce8874cbfa62dcb2f25fa53a567483e19d720a6a650c51d0f98654caecbf1e70
Instruction Fuzzy Hash: CB31D432841209EEEF15FBA0ED1AFDD77B99F14320F508189F40967182EE786A05CB72

Function 007922D6 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 007922DD

Part of subcall function 007987A2: _malloc.LIBCMT ref: 007987BC

Part of subcall function 007987A2: std::bad_alloc::bad_alloc.LIBCMT ref: 007987DF
Part of subcall function 007987A2: __CxxThrowException@8.LIBCMT ref: 00798801

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: Exception@8H_prolog3Throw_mallocstd::bad_alloc::bad_alloc
String ID:
API String ID: 491441085-0
Opcode ID: 18a5db78d040b70e075df3f2ac0f89970eb2eb16632af80897f6c1b579dbe1d0
Instruction ID: d294be82c098a91657671029020a03a70747b45f0c3d266dfb8618bba86d3638
Opcode Fuzzy Hash: 18a5db78d040b70e075df3f2ac0f89970eb2eb16632af80897f6c1b579dbe1d0
Instruction Fuzzy Hash: 89019270640209FBEF44FBA4DD4BAAE7765AF00320F104229F9119A1C2DF7C8A418761

Function 007887FA Relevance: 1.5, APIs: 1, Instructions: 39
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_String_base::_Xlen.LIBCPMT ref: 00788807

Part of subcall function 00788EC9: __EH_prolog3.LIBCMT ref: 00788ED0
Part of subcall function 00788EC9: __CxxThrowException@8.LIBCMT ref: 00788EFB

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: Exception@8H_prolog3String_base::_ThrowXlenstd::_
String ID:
API String ID: 1675473389-0
Opcode ID: 75f3a10fa21f4752a747140b7b8218387fec2d054a69ddc817c50ec50effc0c4
Instruction ID: 45f2c29085ed65dab6fb24bec432f82df4abc52d1ca40494e9f189c34d8e5a41
Opcode Fuzzy Hash: 75f3a10fa21f4752a747140b7b8218387fec2d054a69ddc817c50ec50effc0c4
Instruction Fuzzy Hash: 10F0B4327E46109EDAB17568C80453F55A79FD1B60BD50F1EF852831C2DF7C98458393

Function 007A1E8A Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 007A1E9F

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 4fb01996c65871e52287538980feb710187756e0d249407212da933d8f581879
Instruction ID: 15045cab77e8a365fb706b44cf9779b553fe4723fc3e29fa0d313998e1aafffa
Opcode Fuzzy Hash: 4fb01996c65871e52287538980feb710187756e0d249407212da933d8f581879
Instruction Fuzzy Hash: 8AD05E36954348AEEB10AFB17C08B673BECA7C4396F00C536BA0DC6250F678D5508A08

Function 00788574 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0078857B

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 3dc2762f278a2eec10c3bca226ffc830697792326f0c65507cdd55469475a6c4
Instruction ID: 45efb3b20c41c4c9b9ebaff25f000347a9b271c59e9f26e9ba1a49f4a963021d
Opcode Fuzzy Hash: 3dc2762f278a2eec10c3bca226ffc830697792326f0c65507cdd55469475a6c4
Instruction Fuzzy Hash: EFC08C32104220AA49553610A809C6FAA45CB81230B00C80FBC48012118D3A8C90859A

Function 0079F6C2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 0079F6CE

Part of subcall function 0079F596: __lock.LIBCMT ref: 0079F5A4
Part of subcall function 0079F596: __decode_pointer.LIBCMT ref: 0079F5DB
Part of subcall function 0079F596: __decode_pointer.LIBCMT ref: 0079F5F0
Part of subcall function 0079F596: __decode_pointer.LIBCMT ref: 0079F61A
Part of subcall function 0079F596: __decode_pointer.LIBCMT ref: 0079F630
Part of subcall function 0079F596: __decode_pointer.LIBCMT ref: 0079F63D
Part of subcall function 0079F596: __initterm.LIBCMT ref: 0079F66C
Part of subcall function 0079F596: __initterm.LIBCMT ref: 0079F67C

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: 9e6faec162b0dae8a305f4c08d7b3a2b5d73c0a17fca5bfc1bc4b5c337faff51
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: D9B0923258020873DA202952AC07F063A0987C0BA4E650020FA0C1D1A1A9A2A9A5808A

Non-executed Functions

Function 007A52DF Relevance: 66.4, APIs: 44, Instructions: 432COMMONLIBRARYCODE

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 007A5316
___getlocaleinfo.LIBCMT ref: 007A532B
___getlocaleinfo.LIBCMT ref: 007A5340
___getlocaleinfo.LIBCMT ref: 007A5355
___getlocaleinfo.LIBCMT ref: 007A536D
___getlocaleinfo.LIBCMT ref: 007A5382
___getlocaleinfo.LIBCMT ref: 007A5394
___getlocaleinfo.LIBCMT ref: 007A53A9
___getlocaleinfo.LIBCMT ref: 007A53C1
___getlocaleinfo.LIBCMT ref: 007A53D6

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: 2a5bb40b8e7486997eb0079059d66f16d5dce17c6034ac71dfad862cf25795b9
Instruction ID: f60d1c27da1458ffd28af1a5cc90b41d9e5e8bb007c6561e02d05d0585e5d269
Opcode Fuzzy Hash: 2a5bb40b8e7486997eb0079059d66f16d5dce17c6034ac71dfad862cf25795b9
Instruction Fuzzy Hash: 85E1D1B290020DFEFF11DAE1CC85DFF77BEEB48744F04492AB256D2441EA75AA059760

Function 007985B2 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0079F815
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0079F82A
UnhandledExceptionFilter.KERNEL32(007AC4F0), ref: 0079F835
GetCurrentProcess.KERNEL32(C0000409), ref: 0079F851
TerminateProcess.KERNEL32(00000000), ref: 0079F858

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: c88cbda013b17f8e05c3389c941f8bca4455d9615994e3fecd720884b7b1f7cc
Instruction ID: c407e21446b0b4e290182860ce2aa5c8e931eea8a4253aea982fc7fb0983b6ab
Opcode Fuzzy Hash: c88cbda013b17f8e05c3389c941f8bca4455d9615994e3fecd720884b7b1f7cc
Instruction Fuzzy Hash: AC21EBB49042189FDB40DF28EC89F557BB4BB8A304F00C21AE72996B61E7BC5880CF4D

Function 007889E5 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00788A0B

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 9a460809592b33908f99adc7da218c59d3ba5e1a9d2fded85f8a78d1825495c0
Instruction ID: ef5a1f9dd30ba7714439523160e6e2087eb77145e0c0a87734c6172fd78420e3
Opcode Fuzzy Hash: 9a460809592b33908f99adc7da218c59d3ba5e1a9d2fded85f8a78d1825495c0
Instruction Fuzzy Hash: F341D521549BC4CDD776DE688448796BFE01B32308F58CD8EC4D647A83C6A9A68CC7A3

Function 007A1742 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00021700), ref: 007A1747

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 851feb39dc252d742829e2cf3add8939e1f313a56d6bf9c7285d686f704beaa2
Instruction ID: 05c23187c02755617cf9e01930b9e58845322137fee19ee64775f46aae46ae45
Opcode Fuzzy Hash: 851feb39dc252d742829e2cf3add8939e1f313a56d6bf9c7285d686f704beaa2
Instruction Fuzzy Hash: 6F9002A425520086961057705C4941767905ACA697B82E650E012C4455DB6840005525

Function 00799F62 Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: 876cf3dd32846b96bc7b51b80109e30714987f212f9fbc690d20b3ddb826be0e
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: A8D17D73C0F9B34A9B36862D60A813EEE626FD174031EC3E5DCE82F28D952B5D0195D1

Function 00799B42 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: d6072e1079167dc25542918268bffc82b5c4a11d7c46fe5721c0c20bbfddad01
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: E7D18E73C0E9B34A9B35852D649823EEEA26FD175031EC3E9CDE83F28DD22A5D0195D0

Function 00799736 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: c08a196841e2255f6571f23fad2e7b5163bb4e581a0634d7cf913dde5a8d8da1
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: E4C18D73C1E9B34A9B36852D60A852EEE626FD175131FC3E8CDE83F28D912B5D0186D0

Function 00799362 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 7d1e264682eeb3dcbc7f90777b2db01a391baed35bc433c3cf53057d0a719380
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 99C18E73D1E9B34A9B36852E609812FEE626FD174131FC3A8CDE82F28DD52B5D1186D0

Function 0079F260 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 33552173d82eb922b3c6636f64d9b347e5ebfff8ece0809606eb398f4c9047b6
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: E811087F20118243DE048B6DF4B47BFA795FBCA32173C437AD041CB758D22AE9459500

Function 00781AAE Relevance: 30.0, APIs: 9, Strings: 8, Instructions: 274registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management,00000000,00000002,?,445E45D0), ref: 00781B02
RegSetValueExW.ADVAPI32(?,PagingFiles,00000000,00000007,?,?,00000001,00000000,?), ref: 00781BCA
RegCloseKey.ADVAPI32(?), ref: 00781BF8

Part of subcall function 007845AC: __EH_prolog3_catch.LIBCMT ref: 007845B3
Part of subcall function 007845AC: _wcslen.LIBCMT ref: 007845C3

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00781D70
Setting system to automatically manage pagefiles. Please reboot for changes to take effect., xrefs: 00781EC0
\pagefile.sys 0 0, xrefs: 00781DD6, 00781DDB
SystemRoot, xrefs: 00781D57
?:\pagefile.sys, xrefs: 00781B62, 00781C4D
PagingFiles, xrefs: 00781BC1, 00781CAA, 00781E34
ERROR: Unable to write to the registry - please ensure you have administrator rights., xrefs: 00781B12, 00781BDA, 00781CC3, 00781E4D
SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management, xrefs: 00781AF8

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: CloseH_prolog3_catchOpenValue_wcslen
String ID: ?:\pagefile.sys$ERROR: Unable to write to the registry - please ensure you have administrator rights.$PagingFiles$SOFTWARE\Microsoft\Windows NT\CurrentVersion$SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management$Setting system to automatically manage pagefiles. Please reboot for changes to take effect.$SystemRoot$\pagefile.sys 0 0
API String ID: 407989496-1100478893
Opcode ID: 7a9d3813cb284225d5d45697a85acd543b5367080264fbfa55d001a8b8e73af6
Instruction ID: e3c328b5e76a90676aaa9f8ce3fe6753eb0ba2313188a2025ffe9f01c6de9f94
Opcode Fuzzy Hash: 7a9d3813cb284225d5d45697a85acd543b5367080264fbfa55d001a8b8e73af6
Instruction Fuzzy Hash: 90A161B1588380EEE724FB60CC4AF9B77E8BB85310F404A1DF59953292DB785909CB63

Function 0079F9C7 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,007B3640,0000000C,0079FB02,00000000,00000000,?,00000000,0078291A,00000000,?,00781D70), ref: 0079F9D9
__crt_waiting_on_module_handle.LIBCMT ref: 0079F9E4

Part of subcall function 0079F422: Sleep.KERNEL32(000003E8,00000000,?,0079F92A,KERNEL32.DLL,?,0079F976,?,00000000,0078291A,00000000,?,00781D70), ref: 0079F42E
Part of subcall function 0079F422: GetModuleHandleW.KERNEL32(?,?,0079F92A,KERNEL32.DLL,?,0079F976,?,00000000,0078291A,00000000,?,00781D70), ref: 0079F437

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0079FA0D
GetProcAddress.KERNEL32(?,DecodePointer), ref: 0079FA1D
__lock.LIBCMT ref: 0079FA3F
InterlockedIncrement.KERNEL32(007B7F20), ref: 0079FA4C
__lock.LIBCMT ref: 0079FA60
___addlocaleref.LIBCMT ref: 0079FA7E

Strings

EncodePointer, xrefs: 0079FA01
DecodePointer, xrefs: 0079FA15
KERNEL32.DLL, xrefs: 0079F9D3, 0079F9D8, 0079F9E3

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: 3490a2bf62f9299465d4ab696d8ef28833bc7dbc046b7c631cdb10f49a4ec6f5
Instruction ID: 3bb061799f4df5b9337296d7f6a4f465b6c06dc3b142397056166be0f3ad2866
Opcode Fuzzy Hash: 3490a2bf62f9299465d4ab696d8ef28833bc7dbc046b7c631cdb10f49a4ec6f5
Instruction Fuzzy Hash: 01116371900701EEDB20AF69AC05B9ABBE4EF45310F108529E499D62A1CB7CAA418F54

Function 0078C7AC Relevance: 18.1, APIs: 12, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

____lc_handle_func.LIBCMT ref: 0078C7E0
____lc_codepage_func.LIBCMT ref: 0078C7E8
__GetLocaleForCP.LIBCPMT ref: 0078C811
____mb_cur_max_l_func.LIBCMT ref: 0078C827
MultiByteToWideChar.KERNEL32(?,00000009,?,00000002,00000000,00000000,?,?,?,?,0078A8CE,?,00000000,00000001,00000000), ref: 0078C846
____mb_cur_max_l_func.LIBCMT ref: 0078C854
___pctype_func.LIBCMT ref: 0078C879
____mb_cur_max_l_func.LIBCMT ref: 0078C89F
____mb_cur_max_l_func.LIBCMT ref: 0078C8B7
____mb_cur_max_l_func.LIBCMT ref: 0078C8CF
MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,00000000,?,?,?,?,0078A8CE,?,00000000,00000001,00000000), ref: 0078C8DC
MultiByteToWideChar.KERNEL32(?,00000009,?,00000001,00000000,00000000,?,?,?,?,0078A8CE,?,00000000,00000001,00000000), ref: 0078C90D

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: ____mb_cur_max_l_func$ByteCharMultiWide$Locale____lc_codepage_func____lc_handle_func___pctype_func
String ID:
API String ID: 3819326198-0
Opcode ID: e0a77393a14461be23a62d317c3837d9089de51a666b06f36807fcac7988d21d
Instruction ID: cb5b473cd1f185a218edbd6ed8d35bec542e31ee0865d6d5428917d55c198051
Opcode Fuzzy Hash: e0a77393a14461be23a62d317c3837d9089de51a666b06f36807fcac7988d21d
Instruction Fuzzy Hash: AE41C431184241EEDF226F31DC49B7A3BA8EF00361F24842AF955CA192EB3CD990DB70

Function 0078780C Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 340COMMON

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 0078785A
char_traits.LIBCPMT ref: 007878CF
char_traits.LIBCPMT ref: 00787907
char_traits.LIBCPMT ref: 0078794A
char_traits.LIBCPMT ref: 007879D4
char_traits.LIBCPMT ref: 00787A4F
char_traits.LIBCPMT ref: 00787AC3
char_traits.LIBCPMT ref: 00787B0A
char_traits.LIBCPMT ref: 00787B50

Strings

wx, xrefs: 00787845, 00787A39, 007878C2, 007878F8, 0078793B, 007879F9, 00787A7D

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: char_traits$String_base::_Xlenstd::_
String ID: wx
API String ID: 1810552321-3666969251
Opcode ID: ab7ec79c39d6a5e6059ccd90fdb6934ff08c8e541a6c1d99366acc7f948dca4d
Instruction ID: a79468fdb233048fe85e1e4efa277de6b9f85687da454e1acf9851dbb7b5794f
Opcode Fuzzy Hash: ab7ec79c39d6a5e6059ccd90fdb6934ff08c8e541a6c1d99366acc7f948dca4d
Instruction Fuzzy Hash: 20D11DB025450AEF8B0CEF58C9D4CAAB776FF843007608619E41AC7655EB34FA64CBE5

Function 007818CE Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 007818D5

Part of subcall function 00788B22: __EH_prolog3.LIBCMT ref: 00788B29

Part of subcall function 00782F03: char_traits.LIBCPMT ref: 00782F28

Strings

PagefileConfig.exe --set C: 1024 4096, xrefs: 0078191C
PagefileConfig.exe --set C: 1024 4096 --set D: 512 512, xrefs: 00781946
Examples:, xrefs: 007818EC
PagefileConfig.exe --none, xrefs: 007819C4
Notes:, xrefs: 00781A18
- Pagefile sizes are in megabytes (Mb)., xrefs: 00781A42
PagefileConfig.exe --set C: 0 0 --set D: 512 512, xrefs: 00781970
PagefileConfig.exe --auto, xrefs: 0078199A
- Setting min and max to 0 will let the system manage the pagefile for a given drive., xrefs: 00781A6C

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: H_prolog3H_prolog3_char_traits
String ID: - Pagefile sizes are in megabytes (Mb).$ - Setting min and max to 0 will let the system manage the pagefile for a given drive.$ PagefileConfig.exe --auto$ PagefileConfig.exe --none$ PagefileConfig.exe --set C: 0 0 --set D: 512 512$ PagefileConfig.exe --set C: 1024 4096$ PagefileConfig.exe --set C: 1024 4096 --set D: 512 512$Examples:$Notes:
API String ID: 3685356560-987424936
Opcode ID: 315452b0106512dbdadbae73df51d4c68faa733549832996c9023f5605c3281c
Instruction ID: 3fa39f0b0803cbd16662aaaa9d2a63f6947fcaf5d5dfe98013a43566e19b42a2
Opcode Fuzzy Hash: 315452b0106512dbdadbae73df51d4c68faa733549832996c9023f5605c3281c
Instruction Fuzzy Hash: EB51EAB188524CEADB05FBE4C899DDEBBBC9F69300F848055E411B3142DB7C5B4ADB61

Function 0078A2E6 Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0078A2ED
std::_Lockit::_Lockit.LIBCPMT ref: 0078A2F7
int.LIBCPMT ref: 0078A30E

Part of subcall function 00788F78: std::_Lockit::_Lockit.LIBCPMT ref: 00788F8B

std::locale::_Getfacet.LIBCPMT ref: 0078A317
ctype.LIBCPMT ref: 0078A331
std::bad_exception::bad_exception.LIBCMT ref: 0078A345
__CxxThrowException@8.LIBCMT ref: 0078A353
std::locale::facet::_Incref.LIBCPMT ref: 0078A363
std::locale::facet::facet_Register.LIBCPMT ref: 0078A369

Strings

bad cast, xrefs: 0078A33D

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8GetfacetH_prolog3IncrefRegisterThrowctypestd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_std::locale::facet::facet_
String ID: bad cast
API String ID: 2535038987-3145022300
Opcode ID: 0853d718283b90dff659f81abbf9ae21ac1f30fc8dd8a4aa46b51441d79e5196
Instruction ID: 658558eee8fd5994d14c4d19298e578a6f857c95e22f7706a4444fd74584007a
Opcode Fuzzy Hash: 0853d718283b90dff659f81abbf9ae21ac1f30fc8dd8a4aa46b51441d79e5196
Instruction Fuzzy Hash: 54016D71981219EBCF15FBA09C5AAFEB335AF40720F544219F3206B2E1EF3CA9019752

Function 0078A505 Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0078A50C
std::_Lockit::_Lockit.LIBCPMT ref: 0078A516
int.LIBCPMT ref: 0078A52D

Part of subcall function 00788F78: std::_Lockit::_Lockit.LIBCPMT ref: 00788F8B

std::locale::_Getfacet.LIBCPMT ref: 0078A536
codecvt.LIBCPMT ref: 0078A550
std::bad_exception::bad_exception.LIBCMT ref: 0078A564
__CxxThrowException@8.LIBCMT ref: 0078A572
std::locale::facet::_Incref.LIBCPMT ref: 0078A582
std::locale::facet::facet_Register.LIBCPMT ref: 0078A588

Strings

bad cast, xrefs: 0078A55C

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8GetfacetH_prolog3IncrefRegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_std::locale::facet::facet_
String ID: bad cast
API String ID: 577375395-3145022300
Opcode ID: 4460aab3ffcf79c3cf254622f6f485227b7c56d4fe6c58949cd800261f6bd91d
Instruction ID: 696c6c505d38d0bd155b9919dab8e726d15fc6f6691fe3c204f0682c8319aec5
Opcode Fuzzy Hash: 4460aab3ffcf79c3cf254622f6f485227b7c56d4fe6c58949cd800261f6bd91d
Instruction Fuzzy Hash: B0018B71981219EBDF11FBA09C4AAEEB335AF40720F640219F2206B2D0EF3C9A518752

Function 0078B999 Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0078B9A0
std::_Lockit::_Lockit.LIBCPMT ref: 0078B9AA
int.LIBCPMT ref: 0078B9C1

Part of subcall function 00788F78: std::_Lockit::_Lockit.LIBCPMT ref: 00788F8B

std::locale::_Getfacet.LIBCPMT ref: 0078B9CA
ctype.LIBCPMT ref: 0078B9E4
std::bad_exception::bad_exception.LIBCMT ref: 0078B9F8
__CxxThrowException@8.LIBCMT ref: 0078BA06
std::locale::facet::_Incref.LIBCPMT ref: 0078BA16
std::locale::facet::facet_Register.LIBCPMT ref: 0078BA1C

Strings

bad cast, xrefs: 0078B9F0

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8GetfacetH_prolog3IncrefRegisterThrowctypestd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_std::locale::facet::facet_
String ID: bad cast
API String ID: 2535038987-3145022300
Opcode ID: f557802caa5e506397c056d9e4c6f0f436452f9ea56f551c40114725cb411149
Instruction ID: d583a492b4639b063c8bd56d35176bc7d2451af9d2ad5fd689456dae36cc43fd
Opcode Fuzzy Hash: f557802caa5e506397c056d9e4c6f0f436452f9ea56f551c40114725cb411149
Instruction Fuzzy Hash: 14016D71981219DBCF15FBA09D5AAFEB335AF80720F544219F2216B2E1DF3C9A018752

Function 0078BA36 Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0078BA3D
std::_Lockit::_Lockit.LIBCPMT ref: 0078BA47
int.LIBCPMT ref: 0078BA5E

Part of subcall function 00788F78: std::_Lockit::_Lockit.LIBCPMT ref: 00788F8B

std::locale::_Getfacet.LIBCPMT ref: 0078BA67
codecvt.LIBCPMT ref: 0078BA81
std::bad_exception::bad_exception.LIBCMT ref: 0078BA95
__CxxThrowException@8.LIBCMT ref: 0078BAA3
std::locale::facet::_Incref.LIBCPMT ref: 0078BAB3
std::locale::facet::facet_Register.LIBCPMT ref: 0078BAB9

Strings

bad cast, xrefs: 0078BA8D

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8GetfacetH_prolog3IncrefRegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_std::locale::facet::facet_
String ID: bad cast
API String ID: 577375395-3145022300
Opcode ID: 467fd84bb9a5db855e02abadc9f11d5b809af12e7d8c2c41176b9029826c91ea
Instruction ID: 499568e0f2e15b9ae01d581c8dea1c670d9e71f6fff942487a35d244c183b817
Opcode Fuzzy Hash: 467fd84bb9a5db855e02abadc9f11d5b809af12e7d8c2c41176b9029826c91ea
Instruction Fuzzy Hash: FF018071981219EBCF15FBA0DC5AAFEB335AF40720F544218F2206B1E1DF3C9A018792

Function 0079ECB3 Relevance: 15.1, APIs: 10, Instructions: 95COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 0079ECCC

Part of subcall function 0079DBE0: __calloc_impl.LIBCMT ref: 0079DBF1
Part of subcall function 0079DBE0: Sleep.KERNEL32(00000000), ref: 0079DC08

__calloc_crt.LIBCMT ref: 0079ECF0
__calloc_crt.LIBCMT ref: 0079ED0C
__copytlocinfo_nolock.LIBCMT ref: 0079ED31
__setlocale_nolock.LIBCMT ref: 0079ED3E
___removelocaleref.LIBCMT ref: 0079ED4A
___freetlocinfo.LIBCMT ref: 0079ED51
__setmbcp_nolock.LIBCMT ref: 0079ED69
___removelocaleref.LIBCMT ref: 0079ED7E
___freetlocinfo.LIBCMT ref: 0079ED85

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: __calloc_crt$___freetlocinfo___removelocaleref$Sleep__calloc_impl__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 2969281212-0
Opcode ID: f8498c17a51d2db3714177f4ea20d1f6ba4d79a07fa7e17ceae1e684997419f2
Instruction ID: f59602717abdbed0a75900327762229bc7ef8a930170bd6f79deaf50a9cebeca
Opcode Fuzzy Hash: f8498c17a51d2db3714177f4ea20d1f6ba4d79a07fa7e17ceae1e684997419f2
Instruction Fuzzy Hash: 7221D835204A01EBDF31BF28F90A95B7BE5FF45760B20452EF49956261DF3D9C00D661

Function 00781EF8 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management,00000000,00000002,?,445E45D0), ref: 00781F37
RegSetValueExW.ADVAPI32(?,PagingFiles,00000000,00000007,?), ref: 00781FA6
RegCloseKey.ADVAPI32(?), ref: 00781FF4
RegCloseKey.ADVAPI32(?), ref: 00781FD4

Part of subcall function 007845AC: __EH_prolog3_catch.LIBCMT ref: 007845B3
Part of subcall function 007845AC: _wcslen.LIBCMT ref: 007845C3

Strings

PagingFiles, xrefs: 00781F9D
Setting system to not use any pagefiles. Please reboot for changes to take effect., xrefs: 00781FFA
ERROR: Unable to write to the registry - please ensure you have administrator rights., xrefs: 00781F47, 00781FB6
SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management, xrefs: 00781F2D

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: Close$H_prolog3_catchOpenValue_wcslen
String ID: ERROR: Unable to write to the registry - please ensure you have administrator rights.$PagingFiles$SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management$Setting system to not use any pagefiles. Please reboot for changes to take effect.
API String ID: 1113622823-379381163
Opcode ID: e33097214a5f26f0df4bfe43150be7bf98ecd4acfe95cf1aac3f9f05549b62aa
Instruction ID: a662f72291bbccbc8fe810a6e27f223d693de3810d4a497c66b967761678bd42
Opcode Fuzzy Hash: e33097214a5f26f0df4bfe43150be7bf98ecd4acfe95cf1aac3f9f05549b62aa
Instruction Fuzzy Hash: EF21D6B2688341AFD704EF61DC4BE2B77ACFB86710F000A1DF151921D1EBA8A804CB26

Function 00797229 Relevance: 9.2, APIs: 6, Instructions: 199COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00797248
std::_String_base::_Xlen.LIBCPMT ref: 0079728C

Part of subcall function 00790769: __EH_prolog3.LIBCMT ref: 00790770
Part of subcall function 00790769: __CxxThrowException@8.LIBCMT ref: 0079079B

ctype.LIBCPMT ref: 00797304
ctype.LIBCPMT ref: 00797327

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catchString_base::_ThrowXlenstd::_
String ID:
API String ID: 1217835658-0
Opcode ID: 04803643252ec614580cd094c53f4eca1e33ff631a8cca94919ae43e48b02462
Instruction ID: 56890e628754cec7137bb6427aa523a1cb055a818d611e16312202c9a47d78a4
Opcode Fuzzy Hash: 04803643252ec614580cd094c53f4eca1e33ff631a8cca94919ae43e48b02462
Instruction Fuzzy Hash: 4F719371A10708DFCF28DFA4DC85AAEBBB6FF44710F10851DE41A97291DB78AA08CB51

Function 00795515 Relevance: 9.2, APIs: 6, Instructions: 199COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00795534
std::_String_base::_Xlen.LIBCPMT ref: 00795578

Part of subcall function 0078345D: __EH_prolog3.LIBCMT ref: 00783464
Part of subcall function 0078345D: __CxxThrowException@8.LIBCMT ref: 00783496

ctype.LIBCPMT ref: 007955F0
ctype.LIBCPMT ref: 00795613

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catchString_base::_ThrowXlenstd::_
String ID:
API String ID: 1217835658-0
Opcode ID: 30c3187d878f036c069814ddc830f9fd84353b4e3eb16b3094b27f43d9d2c7c2
Instruction ID: bf211b9e42eab1e0f08502f3cce6add04b553c1f4756afd0cf9ab708136deedc
Opcode Fuzzy Hash: 30c3187d878f036c069814ddc830f9fd84353b4e3eb16b3094b27f43d9d2c7c2
Instruction Fuzzy Hash: 93718171A00718DFCF25DFA8DC85AAEBBF6EF44310F10451DE41A97291EB78AA48CB51

Function 00786269 Relevance: 9.2, APIs: 6, Instructions: 181COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00786270
std::_String_base::_Xlen.LIBCPMT ref: 007862AB

Part of subcall function 0078345D: __EH_prolog3.LIBCMT ref: 00783464
Part of subcall function 0078345D: __CxxThrowException@8.LIBCMT ref: 00783496

ctype.LIBCPMT ref: 00786318
ctype.LIBCPMT ref: 00786338

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catch_String_base::_ThrowXlenstd::_
String ID:
API String ID: 1119708605-0
Opcode ID: 38e85d0382dc22ba63386ebae82fcd51529832306067bd58d84bde624c6e8421
Instruction ID: 58a9653faa0d615e2373f2932008a932f8be63db1f8645e31420cbc32ea84069
Opcode Fuzzy Hash: 38e85d0382dc22ba63386ebae82fcd51529832306067bd58d84bde624c6e8421
Instruction Fuzzy Hash: 6D515171A40318EFDB14EFA8DC89A6EBBB6FB44310F10851DF4159B295DBB9E9089B10

Function 007853E6 Relevance: 9.2, APIs: 6, Instructions: 181COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 007853ED
std::_String_base::_Xlen.LIBCPMT ref: 00785428

Part of subcall function 0078345D: __EH_prolog3.LIBCMT ref: 00783464
Part of subcall function 0078345D: __CxxThrowException@8.LIBCMT ref: 00783496

ctype.LIBCPMT ref: 00785495
ctype.LIBCPMT ref: 007854B5

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catch_String_base::_ThrowXlenstd::_
String ID:
API String ID: 1119708605-0
Opcode ID: 9e211f49b93e76e1682a3c150f5d0c065e9f0f5be15949dbf8bb7d4974fda584
Instruction ID: 0b47e527d04a466302d6c8a2067a61d4d191c030310ec437f08f61cacfa1735c
Opcode Fuzzy Hash: 9e211f49b93e76e1682a3c150f5d0c065e9f0f5be15949dbf8bb7d4974fda584
Instruction Fuzzy Hash: 6F5140B1A40708EFDB14EFA9DC89A9EBBB6FF54310F10851DF4159B291EBB5E9048B10

Function 00794BB6 Relevance: 9.2, APIs: 6, Instructions: 168COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00794BBD
std::_String_base::_Xlen.LIBCPMT ref: 00794BF2

Part of subcall function 00790769: __EH_prolog3.LIBCMT ref: 00790770
Part of subcall function 00790769: __CxxThrowException@8.LIBCMT ref: 0079079B

ctype.LIBCPMT ref: 00794C66
ctype.LIBCPMT ref: 00794C86

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catchString_base::_ThrowXlenstd::_
String ID:
API String ID: 1217835658-0
Opcode ID: 1d362b65b007858c13592b4d8077d6f0f1f899bae342ac3c225307f505112b35
Instruction ID: f5a5be7619fbaa3cc4a32984fa1e3ec4791addfb1538060aaf09f3df5228ae2c
Opcode Fuzzy Hash: 1d362b65b007858c13592b4d8077d6f0f1f899bae342ac3c225307f505112b35
Instruction Fuzzy Hash: A3519EB1A00709DFCF14DFA4D959AAEBBB5FF44310F11461DF416A7281EB74AA05CBA0

Function 0079117F Relevance: 9.2, APIs: 6, Instructions: 161COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00791186
std::_String_base::_Xlen.LIBCPMT ref: 007911BB

Part of subcall function 00790769: __EH_prolog3.LIBCMT ref: 00790770
Part of subcall function 00790769: __CxxThrowException@8.LIBCMT ref: 0079079B

ctype.LIBCPMT ref: 0079122B
ctype.LIBCPMT ref: 00791249

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catchString_base::_ThrowXlenstd::_
String ID:
API String ID: 1217835658-0
Opcode ID: b028adf884b20e2417ca1d5023ba4057d60d242f4904589b83c16372089eaed7
Instruction ID: 7d2d63ae133701c6a966f7260ec8ecde3b7b44e869b3e35fb8f72081d6e70c8c
Opcode Fuzzy Hash: b028adf884b20e2417ca1d5023ba4057d60d242f4904589b83c16372089eaed7
Instruction Fuzzy Hash: 29518071A0060EEFCF25EFA4C8599AEBBB5FF44310F10461DF416A7251DB74AA14CBA1

Function 00790D6E Relevance: 9.1, APIs: 6, Instructions: 140COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00790D75
std::_String_base::_Xlen.LIBCPMT ref: 00790DAA

Part of subcall function 00790769: __EH_prolog3.LIBCMT ref: 00790770
Part of subcall function 00790769: __CxxThrowException@8.LIBCMT ref: 0079079B

ctype.LIBCPMT ref: 00790E0B
ctype.LIBCPMT ref: 00790E1E

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catchString_base::_ThrowXlenstd::_
String ID:
API String ID: 1217835658-0
Opcode ID: 2cb32ee0200f887fef4b4dcd92d4494f010d3024c2ea1485a2ff42d0bc90f9c3
Instruction ID: 382d34c71df4301e4a37c26656725ae18febd13743449f63976e60b5c1887b94
Opcode Fuzzy Hash: 2cb32ee0200f887fef4b4dcd92d4494f010d3024c2ea1485a2ff42d0bc90f9c3
Instruction Fuzzy Hash: 92516DB0A1020ADFCF25EF68D8959AF77B9FF44310B10452DF81697241EB74AE14CBA1

Function 0079CB94 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 0079CBBC

Part of subcall function 0079ADD6: __getptd.LIBCMT ref: 0079ADE4
Part of subcall function 0079ADD6: __getptd.LIBCMT ref: 0079ADF2

__getptd.LIBCMT ref: 0079CBC6

Part of subcall function 0079FB27: __getptd_noexit.LIBCMT ref: 0079FB2A
Part of subcall function 0079FB27: __amsg_exit.LIBCMT ref: 0079FB37

__getptd.LIBCMT ref: 0079CBD4
__getptd.LIBCMT ref: 0079CBE2
__getptd.LIBCMT ref: 0079CBED
_CallCatchBlock2.LIBCMT ref: 0079CC13

Part of subcall function 0079AE7B: __CallSettingFrame@12.LIBCMT ref: 0079AEC7

Part of subcall function 0079CCBA: __getptd.LIBCMT ref: 0079CCC9
Part of subcall function 0079CCBA: __getptd.LIBCMT ref: 0079CCD7

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: d2a53ddc6d2c0ecd983ad738e5366b6827ae37909ac85c17f584428d1b029e4e
Instruction ID: 427060da8d51f99f52fc4076e923b5684701715f2445890305d3c7e1fd713776
Opcode Fuzzy Hash: d2a53ddc6d2c0ecd983ad738e5366b6827ae37909ac85c17f584428d1b029e4e
Instruction Fuzzy Hash: 3411C6B1D00249EFDF00EFA4E84AAED7BB1FF08315F108069F814A7251DB789A119B54

Function 007937CC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 007937D3
__CxxThrowException@8.LIBCMT ref: 00793804

Part of subcall function 0079AAA9: RaiseException.KERNEL32(?,?,00798806,?,?,?,?,JIx,00798806,?,007B3E4C,007B9948,?,0078494A,?), ref: 0079AAEB

__EH_prolog3.LIBCMT ref: 00793811

Strings

multiple_occurrences, xrefs: 00793826
multiple_values, xrefs: 0079385A

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: multiple_occurrences$multiple_values
API String ID: 1412866469-1208176579
Opcode ID: 2c38f2e5896ef032ba773c2be8dcc915416932ea1abaa6df84c0496bc81cd13f
Instruction ID: 3bef6737161899c87233fb900c44772446e7c2be22b1d1d621ff1ba17c4b9c4c
Opcode Fuzzy Hash: 2c38f2e5896ef032ba773c2be8dcc915416932ea1abaa6df84c0496bc81cd13f
Instruction Fuzzy Hash: 382148B1940208EADF04FBA4E84AFEDB778AF15300F508558F515AB192DF7C9B49CB62

Function 0079BBEE Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 0079BC10
__calloc_crt.LIBCMT ref: 0079BC29

Strings

`}{, xrefs: 0079BC55
P{{, xrefs: 0079BC92
z{, xrefs: 0079BC40

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: __calloc_crt
String ID: P{{$`}{$z{
API String ID: 3494438863-3789798985
Opcode ID: 7678f2212e5f5edc5ac52ca3f859b0199e1a919006a2e6ada7344101c91e563e
Instruction ID: 7be45581e8b7a536eda9480b490204f0f94dd4856de72a4760b523456134a7ce
Opcode Fuzzy Hash: 7678f2212e5f5edc5ac52ca3f859b0199e1a919006a2e6ada7344101c91e563e
Instruction Fuzzy Hash: A0112C717046159BEF284F1C7E55FA62392EB863247258337F511CB290EF3CCC418264

Function 00797A56 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00797A5D
std::_Lockit::_Lockit.LIBCPMT ref: 00797A69
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00797AD7

Part of subcall function 00788478: __EH_prolog3.LIBCMT ref: 0078847F

__CxxThrowException@8.LIBCMT ref: 00797ACE

Part of subcall function 0079AAA9: RaiseException.KERNEL32(?,?,00798806,?,?,?,?,JIx,00798806,?,007B3E4C,007B9948,?,0078494A,?), ref: 0079AAEB

Strings

bad locale name, xrefs: 00797AA8

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: H_prolog3std::_$ExceptionException@8Locinfo::_Locinfo_ctorLockitLockit::_RaiseThrow
String ID: bad locale name
API String ID: 4278901745-1405518554
Opcode ID: 4f603ecd3b730a971cb809d3c7e984564a5d1b28747fb4397bc81a867041b2e9
Instruction ID: c5faa98e956686501c2380c99c3f816781fa8a391e420880035b97e837177ccd
Opcode Fuzzy Hash: 4f603ecd3b730a971cb809d3c7e984564a5d1b28747fb4397bc81a867041b2e9
Instruction Fuzzy Hash: 65018471845688EADB05FBA4D94A7DDBBB49F24310F90804DF1492B182DF7D5708C762

Function 0079CF41 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 0079CF54

Part of subcall function 0079CEAF: ___BuildCatchObjectHelper.LIBCMT ref: 0079CEE5

_UnwindNestedFrames.LIBCMT ref: 0079CF6B
___FrameUnwindToState.LIBCMT ref: 0079CF79

Strings

d5{, xrefs: 0079CF43
csm, xrefs: 0079CF50, 0079CF65, 0079CF78, 0079CF96, 0079CFA6

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$d5{
API String ID: 2163707966-2832275219
Opcode ID: 897de3ac07446944308d15e80b2e02fed61e753b384f2a82f7a733087c59a827
Instruction ID: a0fb6a20fd97db3c0d06b40bac4b454cd9bf7aa961e739ef8905b9ef3fb697cb
Opcode Fuzzy Hash: 897de3ac07446944308d15e80b2e02fed61e753b384f2a82f7a733087c59a827
Instruction Fuzzy Hash: 3A01F67200150AFFDF13AF51ED4AEAA7F6BEF08354F044015BE1815161D73A99B1EBA1

Function 007948A3 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 007948AA
__CxxThrowException@8.LIBCMT ref: 00794909

Strings

style disallows all characters for short options, xrefs: 007948E2
style disallows parameters for short options, xrefs: 007948D3, 007948E7
style disallows parameters for long options, xrefs: 007948C1

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: Exception@8H_prolog3Throw
String ID: style disallows all characters for short options$style disallows parameters for long options$style disallows parameters for short options
API String ID: 3670251406-2573483067
Opcode ID: 4b08f493aa5f662f5ae691fbca2bccc22f3ed738cb4ec4fc37272b8fdc88a35c
Instruction ID: a231c2f4ec3549650113a8742fc52997ec7fa6a144687589f533a048aeae2698
Opcode Fuzzy Hash: 4b08f493aa5f662f5ae691fbca2bccc22f3ed738cb4ec4fc37272b8fdc88a35c
Instruction Fuzzy Hash: D1F09071941248AADF64A5D0F94AFEE6368AF51329F044229F902AA141DB2CDD07C792

Function 007A0BA0 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 007A0BAC

Part of subcall function 0079FB27: __getptd_noexit.LIBCMT ref: 0079FB2A
Part of subcall function 0079FB27: __amsg_exit.LIBCMT ref: 0079FB37

__amsg_exit.LIBCMT ref: 007A0BCC
__lock.LIBCMT ref: 007A0BDC
InterlockedDecrement.KERNEL32(?), ref: 007A0BF9
InterlockedIncrement.KERNEL32(00B42D98), ref: 007A0C24

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 08f07fe4b2ce57a235cea9d2f2ab3782fcdcdd75bfda3bcd02e956237bd5f67e
Instruction ID: a394281d29465a78e1a1b8380a95378205096cec4714fd9487370a55042c6ed4
Opcode Fuzzy Hash: 08f07fe4b2ce57a235cea9d2f2ab3782fcdcdd75bfda3bcd02e956237bd5f67e
Instruction Fuzzy Hash: 8C01FE31D01715DBCB10AF24AD09B9EB3A0BF45B20F188715F810A7192CB3C5D81CBE5

Function 00781729 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00781730

Part of subcall function 00788B22: __EH_prolog3.LIBCMT ref: 00788B29

Part of subcall function 00782F03: char_traits.LIBCPMT ref: 00782F28

Strings

http://www.autoitscript.com/tools, xrefs: 007817CC
PagefileConfig v1.0.0 - Pagefile Configuration Utility, xrefs: 00781778

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: H_prolog3H_prolog3_char_traits
String ID: Copyright (C) 2009 Jonathan Bennett$PagefileConfig v1.0.0 - Pagefile Configuration Utility$http://www.autoitscript.com/tools
API String ID: 3685356560-2737818879
Opcode ID: f24ff2ea885dc77c2ad25e21a368e3d56d454636caa3e6d4a9bc847a78969723
Instruction ID: 5166d1c5a81866872a409964490d3ec6706d0bcf98e9b6b3c9c26358975aed6d
Opcode Fuzzy Hash: f24ff2ea885dc77c2ad25e21a368e3d56d454636caa3e6d4a9bc847a78969723
Instruction Fuzzy Hash: 09312AB584518CEADB05FBE4C899DDEBBBC9F69300F448059E412B3142DF385B0ACB61

Function 00788130 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0078817D

Strings

ios_base::failbit set, xrefs: 007881C5
ios_base::eofbit set, xrefs: 007881FF
ios_base::badbit set, xrefs: 00788187

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: fbe95a07488151587d9ead5107ca19933224452811a858101bd655477f8c6ada
Instruction ID: 40cbb186ee7819b4749e8e7efae5fdcd638eb7451cf2d677d20739a9b7d7b737
Opcode Fuzzy Hash: fbe95a07488151587d9ead5107ca19933224452811a858101bd655477f8c6ada
Instruction Fuzzy Hash: E02173B1188748AFC350EF14C855F9BB3E8EB85710F84492DF59586281DF7DA908CB57

Function 00785821 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00785828
type_info::operator==.LIBCMT ref: 0078584E
std::bad_exception::bad_exception.LIBCMT ref: 0078586C

Strings

bad cast, xrefs: 00785864

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: H_prolog3std::bad_exception::bad_exceptiontype_info::operator==
String ID: bad cast
API String ID: 1107443109-3145022300
Opcode ID: ac06a058b164ebae96fb3841846d685432b82bfc6fe948e65ae49ab827e1ab7e
Instruction ID: 8aefe8b1a69ee12633e936f7e36044b631bb765d403dcca06644f98d933f35b7
Opcode Fuzzy Hash: ac06a058b164ebae96fb3841846d685432b82bfc6fe948e65ae49ab827e1ab7e
Instruction Fuzzy Hash: 41F0AF70E80604EBDF64FF64C80ABBEB7A0AF01701F004429A852EB241EB7CDD04CB82

Function 0079C8D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0079C8EA

Part of subcall function 0079FB27: __getptd_noexit.LIBCMT ref: 0079FB2A
Part of subcall function 0079FB27: __amsg_exit.LIBCMT ref: 0079FB37

__getptd.LIBCMT ref: 0079C8FB
__getptd.LIBCMT ref: 0079C909

Strings

MOC, xrefs: 0079C8DC

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC
API String ID: 803148776-624257665
Opcode ID: 6318ce30a81a55e391bff514816b56a4f8d7f02916502401f4d8f18761619bf4
Instruction ID: 61f4b6b67bd4f8a56d4e5391e08fbb4f3f3eed39b5e852d951ea805bf70bb4d2
Opcode Fuzzy Hash: 6318ce30a81a55e391bff514816b56a4f8d7f02916502401f4d8f18761619bf4
Instruction Fuzzy Hash: 8EE04F76510244CFDF10EB74E44AB683798EF55325F2601B1E41CCB222C73CE9409682

Function 0079B74F Relevance: 6.1, APIs: 4, Instructions: 137COMMONLIBRARYCODE

Download Yara Rule

APIs

__flush.LIBCMT ref: 0079B813
__fileno.LIBCMT ref: 0079B833
__locking.LIBCMT ref: 0079B83A
__flsbuf.LIBCMT ref: 0079B865

Part of subcall function 0079EF5A: __getptd_noexit.LIBCMT ref: 0079EF5A

Part of subcall function 00798E3D: __decode_pointer.LIBCMT ref: 00798E48

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: 86b4dd513e40df894f61f8930a33e2bafc901f08d6d5cc91125f90f76cd047b7
Instruction ID: 2070e541fa21b1f3ba099026d2d3b0181e769287064708c67785ee574d7ccadf
Opcode Fuzzy Hash: 86b4dd513e40df894f61f8930a33e2bafc901f08d6d5cc91125f90f76cd047b7
Instruction Fuzzy Hash: 6641D831A00604EBDF24DFA9FA8499EB7BAEFC4760F24866DE41597140E778DE41CB80

Function 00788DFB Relevance: 6.1, APIs: 4, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?), ref: 00788E2A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?), ref: 00788E55
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?), ref: 00788E9E
RegCloseKey.ADVAPI32(?), ref: 00788EBF

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 6a8cb5ce71a79e7ae77c602a47c947ef6ac5bcba21ea4dd28a01995953369ff3
Instruction ID: ad1404ea5ac368aa851f6cde8473d03851d85e70919fdf0122868031116b5c03
Opcode Fuzzy Hash: 6a8cb5ce71a79e7ae77c602a47c947ef6ac5bcba21ea4dd28a01995953369ff3
Instruction Fuzzy Hash: 1D21AF32A40214FFDF24AF64DC0AAAFBB79EF81710F504069E905AB151EB74AE50CBD5

Function 0079E087 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0079E093

Part of subcall function 0079FB27: __getptd_noexit.LIBCMT ref: 0079FB2A
Part of subcall function 0079FB27: __amsg_exit.LIBCMT ref: 0079FB37

__getptd.LIBCMT ref: 0079E0AA
__amsg_exit.LIBCMT ref: 0079E0B8
__lock.LIBCMT ref: 0079E0C8

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: b9e32ba7ad07661f0896f9b543c6154fa6202c7892a52bf0d94fc6384bc96995
Instruction ID: a1037aa13c3c9b7e1a8fceeea1a629059013ffc6fc8a726d7183c41774347716
Opcode Fuzzy Hash: b9e32ba7ad07661f0896f9b543c6154fa6202c7892a52bf0d94fc6384bc96995
Instruction Fuzzy Hash: 46F01D32900704CADF70FF78B40AB9973A06F04720F648229E454D72D2DBBC9941CB56

Function 0078387C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 225COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00783883

Part of subcall function 007889B0: __EH_prolog3.LIBCMT ref: 007889B7

__CxxThrowException@8.LIBCMT ref: 007838C1

Part of subcall function 0079AAA9: RaiseException.KERNEL32(?,?,00798806,?,?,?,?,JIx,00798806,?,007B3E4C,007B9948,?,0078494A,?), ref: 0079AAEB

Strings

invalid map/set<T> iterator, xrefs: 00783894

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: invalid map/set<T> iterator
API String ID: 1412866469-152884079
Opcode ID: 1f329cd76bb477523ceddbd9680cdba2020ece6cd5e98456789924116985da44
Instruction ID: 54849be60089df38cfdfe54b11442ced8d1dc3aa2bed84e0e1f0cd4925e52111
Opcode Fuzzy Hash: 1f329cd76bb477523ceddbd9680cdba2020ece6cd5e98456789924116985da44
Instruction Fuzzy Hash: 26A1A070A44280DFDB55EF1CC0C4B65BBA2AF55718F68908CE08A4F7A2C7B9ED85CB51

Function 00783B34 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 225COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00783B3B

Part of subcall function 007889B0: __EH_prolog3.LIBCMT ref: 007889B7

__CxxThrowException@8.LIBCMT ref: 00783B79

Part of subcall function 0079AAA9: RaiseException.KERNEL32(?,?,00798806,?,?,?,?,JIx,00798806,?,007B3E4C,007B9948,?,0078494A,?), ref: 0079AAEB

Strings

invalid map/set<T> iterator, xrefs: 00783B4C

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: invalid map/set<T> iterator
API String ID: 1412866469-152884079
Opcode ID: 975f6f3e265062dff24f9514353e070b441685ffc21dc1303d38ff0cd39adbbd
Instruction ID: 6cdc6b0f9aa37b86057718bca27e17280c21e890570689cf812776fd36a3f80e
Opcode Fuzzy Hash: 975f6f3e265062dff24f9514353e070b441685ffc21dc1303d38ff0cd39adbbd
Instruction Fuzzy Hash: 1CA19FB0644281DFDB15EF28C084B65BFE2AF59718F28858CD0495F2A2C7B9EDC5CB64

Function 0078D678 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0078D67F
__CxxThrowException@8.LIBCMT ref: 0078D6B7

Part of subcall function 0079AAA9: RaiseException.KERNEL32(?,?,00798806,?,?,?,?,JIx,00798806,?,007B3E4C,007B9948,?,0078494A,?), ref: 0079AAEB

Strings

map/set<T> too long, xrefs: 0078D691

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrow
String ID: map/set<T> too long
API String ID: 1961742612-1285458680
Opcode ID: 6ec78da4c5dcf391bd4ff08cc2e36577495a81603fb95ac986bc57d157830784
Instruction ID: 3b02c90f16ece3642817e7a941e1d7224ef5b6744b6d8dabb74e4731da199716
Opcode Fuzzy Hash: 6ec78da4c5dcf391bd4ff08cc2e36577495a81603fb95ac986bc57d157830784
Instruction Fuzzy Hash: 0261B471580240EFDF22BF38D88AA6D7BA5EF45310F140099F5419B2A2DFBD9D509B62

Function 0078DA1E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0078DA25
__CxxThrowException@8.LIBCMT ref: 0078DA5D

Part of subcall function 0079AAA9: RaiseException.KERNEL32(?,?,00798806,?,?,?,?,JIx,00798806,?,007B3E4C,007B9948,?,0078494A,?), ref: 0079AAEB

Strings

map/set<T> too long, xrefs: 0078DA37

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrow
String ID: map/set<T> too long
API String ID: 1961742612-1285458680
Opcode ID: b1a46e2a1fac79e15ee410cc8fdf2a8d316ebba50ee625449b45214fb83b3fcb
Instruction ID: 3749d72451fd1754bf00d77bd83dc0bca2903c80a25daf19f9310c90560e7c8c
Opcode Fuzzy Hash: b1a46e2a1fac79e15ee410cc8fdf2a8d316ebba50ee625449b45214fb83b3fcb
Instruction Fuzzy Hash: 1B61A071580240EFDB26BF38D88AE6D7BA6AF05710F140095F5019B2A2DF7D9E10CBA2

Function 007841FB Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00784202

Part of subcall function 00784AF1: __EH_prolog3.LIBCMT ref: 00784AF8

Part of subcall function 00784B3C: __EH_prolog3.LIBCMT ref: 00784B43

Part of subcall function 0078895B: char_traits.LIBCPMT ref: 00788980

Part of subcall function 00782D34: std::_String_base::_Xlen.LIBCPMT ref: 00782D71
Part of subcall function 00782D34: char_traits.LIBCPMT ref: 00782DC0

Strings

(=, xrefs: 00784270, 007842DD
[=arg(=, xrefs: 0078422D

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: H_prolog3char_traits$H_prolog3_String_base::_Xlenstd::_
String ID: (=$[=arg(=
API String ID: 3935908814-2804717308
Opcode ID: 321932ac5a619344ab7d19f2aaa904b3d2a52ce77d6ebaf4d58f2fbacf30d6eb
Instruction ID: 0d9ffa7bf4019be521170010721481cc96b2875c0fde9d8323c49a8297546a97
Opcode Fuzzy Hash: 321932ac5a619344ab7d19f2aaa904b3d2a52ce77d6ebaf4d58f2fbacf30d6eb
Instruction Fuzzy Hash: 5C31A5B1D80305EADB10FB95CC49FDFBAF8EB55700F40462AF515B2182DABD9604CB62

Function 007864D4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0078657B

Strings

at least one value required, xrefs: 007865A7
multiple values not allowed, xrefs: 0078654D

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: Exception@8Throw
String ID: at least one value required$multiple values not allowed
API String ID: 2005118841-4090532116
Opcode ID: 31dd9aff6e69a45c160fe286f2d3328f2482bc1b1afa7d86e260a0eb1eb689ce
Instruction ID: 7c7a2ae871198917c8d33d4200fce2a14626630c36f130e4203362ffd7f296b6
Opcode Fuzzy Hash: 31dd9aff6e69a45c160fe286f2d3328f2482bc1b1afa7d86e260a0eb1eb689ce
Instruction Fuzzy Hash: 4821F4B1288384BBC324FF54DC86FEAB7A8EB84710F004A2DF154821C1DBBCA944C792

Function 00783228 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 00783263
char_traits.LIBCPMT ref: 007832B4

Part of subcall function 00788F01: __EH_prolog3.LIBCMT ref: 00788F08
Part of subcall function 00788F01: __CxxThrowException@8.LIBCMT ref: 00788F33

Strings

\pagefile.sys 0 0, xrefs: 0078322C

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: Exception@8H_prolog3String_base::_ThrowXlenchar_traitsstd::_
String ID: \pagefile.sys 0 0
API String ID: 1868744336-1836148727
Opcode ID: 98506b566b3d40e07400ff78b2fc3663a7df16ac395c2c9753848fd85bcebf44
Instruction ID: 508dbce9e17591d90873492d7cc2c7a50072da1aae1a9102a235f6e5ecfba400
Opcode Fuzzy Hash: 98506b566b3d40e07400ff78b2fc3663a7df16ac395c2c9753848fd85bcebf44
Instruction Fuzzy Hash: 8821CD71640205EBCB10EF6CC9C495AB3B6BF44B107504A28E416CB642E778FE54CBA1

Function 007832CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 00783317
char_traits.LIBCPMT ref: 00783354

Strings

\pagefile.sys 0 0, xrefs: 007832CF, 007832D2, 007832F4, 0078334E

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: String_base::_Xlenchar_traitsstd::_
String ID: \pagefile.sys 0 0
API String ID: 511128623-1836148727
Opcode ID: 3fd0df068d3158838ac6c4c856cf5d049a375fca5760c9853a72e6d7f3dd86fa
Instruction ID: c8c5b5e810cfe93deaf5ad4429ddbb1cc1c7c39cb2d5dfe4db91072194040015
Opcode Fuzzy Hash: 3fd0df068d3158838ac6c4c856cf5d049a375fca5760c9853a72e6d7f3dd86fa
Instruction Fuzzy Hash: 1D119471640701DB8620FEACD98592EF3EABF80F04B540A1DF056C7A52EB79FE048795

Function 0079CCBA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0079AE29: __getptd.LIBCMT ref: 0079AE2F
Part of subcall function 0079AE29: __getptd.LIBCMT ref: 0079AE3F

__getptd.LIBCMT ref: 0079CCC9

Part of subcall function 0079FB27: __getptd_noexit.LIBCMT ref: 0079FB2A
Part of subcall function 0079FB27: __amsg_exit.LIBCMT ref: 0079FB37

__getptd.LIBCMT ref: 0079CCD7

Strings

csm, xrefs: 0079CCE5

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 586819d06424154abc68e0f83f452f27895a84e2ce1504a77ad45e74777f4479
Instruction ID: 9d35b75a71b4483dd0854576bcc36f079d49499566b601f74fff7ebd08988427
Opcode Fuzzy Hash: 586819d06424154abc68e0f83f452f27895a84e2ce1504a77ad45e74777f4479
Instruction Fuzzy Hash: 39014675A01218DECF369F24F859AADBBB5AF14311F28583EE4419A691CF388D80CB81

Function 00784932 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00784964
__CxxThrowException@8.LIBCMT ref: 00784979

Part of subcall function 007987A2: _malloc.LIBCMT ref: 007987BC

Strings

hL>{, xrefs: 00784969

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: hL>{
API String ID: 4063778783-541378461
Opcode ID: 86bbebc4c624b46d5c9d023891f32b8caa40291f2edb6d6a22e1d5be90305378
Instruction ID: 3ad4fa01e3bad04031dc02e4602815a912ba1d6cb9f1e99722f63fdeb5ac0c8a
Opcode Fuzzy Hash: 86bbebc4c624b46d5c9d023891f32b8caa40291f2edb6d6a22e1d5be90305378
Instruction Fuzzy Hash: FDF0EC71510108AACF04EAA4D446ACE336DAB55714F10C22DE421D2082DFB4D209C791

Function 00788F01 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00788F08
__CxxThrowException@8.LIBCMT ref: 00788F33

Part of subcall function 0079AAA9: RaiseException.KERNEL32(?,?,00798806,?,?,?,?,JIx,00798806,?,007B3E4C,007B9948,?,0078494A,?), ref: 0079AAEB

Strings

invalid string position, xrefs: 00788F0D

Memory Dump Source

Source File: 00000000.00000002.2125848291.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2125831096.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125875539.00000000007AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125890707.00000000007B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2125906706.00000000007BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_PagefileConfig.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrow
String ID: invalid string position
API String ID: 1961742612-1799206989
Opcode ID: bf30dfa18d2395a442397b4ffc5f3e1f8e33b27977ccab9d4ccb144264ed938d
Instruction ID: 4e835e9d64996657eafaa9e9cfbee3202bb7c5194ed517db700dc011185e45cb
Opcode Fuzzy Hash: bf30dfa18d2395a442397b4ffc5f3e1f8e33b27977ccab9d4ccb144264ed938d
Instruction Fuzzy Hash: 6BD017B2A80108E6CF40F6E0EC4ABDDB378AF14701F840525B200AA081DFAC5604C7A2

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PagefileConfig.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: PagefileConfig.exePID: 6496, Parent PID: 4004

General

Chronological Activities

Analysis Process: conhost.exePID: 2760, Parent PID: 6496

General

Chronological Activities

Disassembly

Analysis Process: PagefileConfig.exePID: 6496, Parent PID: 4004COMMON

Execution Graph

Windows Analysis Report
PagefileConfig.exe

Function 00781318 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 214
COMMON

Function 0078B60D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 171
COMMON

Function 00789F88 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 157
COMMON

Function 007987A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Function 007886BE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Function 00792549 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256
COMMON

Function 007845AC Relevance: 3.1, APIs: 2, Instructions: 130
COMMON

Function 0078446E Relevance: 3.1, APIs: 2, Instructions: 96
COMMON

Function 00788718 Relevance: 3.1, APIs: 2, Instructions: 62
COMMONLIBRARYCODE

Function 0079F4A6 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Function 00792AAB Relevance: 1.7, APIs: 1, Instructions: 158
COMMON

Function 00792830 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 00792986 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Function 007922D6 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Function 007887FA Relevance: 1.5, APIs: 1, Instructions: 39
COMMONLIBRARYCODE