Edit tour

Windows Analysis Report
tOE2mg8TbU.exe

Overview

General Information

Sample name:	tOE2mg8TbU.exe renamed because original name is a hash value
Original sample name:	250b19f587575df98fc24e8eb185db8afdadd2b672de55bb9be1982212bc05b3.exe
Analysis ID:	1574818
MD5:	007c8d6917cb62d9cf8bc921ff92ae93
SHA1:	de2bef155edeafb67956d1425bcf5a085319a179
SHA256:	250b19f587575df98fc24e8eb185db8afdadd2b672de55bb9be1982212bc05b3
Tags:	exeimmureprech-bizuser-JAMESWT_MHT
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contain functionality to detect virtual machines

LummaC encrypted strings found

Sample uses string decryption to hide its real strings

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

tOE2mg8TbU.exe (PID: 6908 cmdline: "C:\Users\user\Desktop\tOE2mg8TbU.exe" MD5: 007C8D6917CB62D9CF8BC921FF92AE93)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["debonairnukk.xyz", "diffuculttan.xyz", "deafeninggeh.biz", "immureprech.biz", "sordid-snaked.cyou", "wrathful-jammy.cyou", "effecterectz.xyz", "cycahao.shop", "awake-weaves.cyou"], "Build id": "hRjzG3--ALFA"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2580806521.00000000014D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x4be5f:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T16:42:43.535259+0100	2028371	3	Unknown Traffic	192.168.2.12	49717	104.21.7.3	443	TCP
2024-12-13T16:42:45.967011+0100	2028371	3	Unknown Traffic	192.168.2.12	49719	104.21.7.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T16:42:44.542927+0100	2054653	1	A Network Trojan was detected	192.168.2.12	49717	104.21.7.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T16:42:44.542927+0100	2049836	1	A Network Trojan was detected	192.168.2.12	49717	104.21.7.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: tOE2mg8TbU.exe.6908.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["debonairnukk.xyz", "diffuculttan.xyz", "deafeninggeh.biz", "immureprech.biz", "sordid-snaked.cyou", "wrathful-jammy.cyou", "effecterectz.xyz", "cycahao.shop", "awake-weaves.cyou"], "Build id": "hRjzG3--ALFA"}

Multi AV Scanner detection for submitted file

Source: tOE2mg8TbU.exe

ReversingLabs: Detection: 21%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 86.4% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2581048787.0000000003050000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sordid-snaked.cyou
Source: 00000000.00000002.2581048787.0000000003050000.00000004.00001000.00020000.00000000.sdmp	String decryptor: awake-weaves.cyou
Source: 00000000.00000002.2581048787.0000000003050000.00000004.00001000.00020000.00000000.sdmp	String decryptor: wrathful-jammy.cyou
Source: 00000000.00000002.2581048787.0000000003050000.00000004.00001000.00020000.00000000.sdmp	String decryptor: debonairnukk.xyz
Source: 00000000.00000002.2581048787.0000000003050000.00000004.00001000.00020000.00000000.sdmp	String decryptor: diffuculttan.xyz
Source: 00000000.00000002.2581048787.0000000003050000.00000004.00001000.00020000.00000000.sdmp	String decryptor: effecterectz.xyz
Source: 00000000.00000002.2581048787.0000000003050000.00000004.00001000.00020000.00000000.sdmp	String decryptor: deafeninggeh.biz
Source: 00000000.00000002.2581048787.0000000003050000.00000004.00001000.00020000.00000000.sdmp	String decryptor: immureprech.biz
Source: 00000000.00000002.2581048787.0000000003050000.00000004.00001000.00020000.00000000.sdmp	String decryptor: cycahao.shop
Source: 00000000.00000002.2581048787.0000000003050000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2581048787.0000000003050000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2581048787.0000000003050000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2581048787.0000000003050000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2581048787.0000000003050000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.2581048787.0000000003050000.00000004.00001000.00020000.00000000.sdmp	String decryptor: hRjzG3--ALFA

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

Code function: 0_2_005AEE40 CryptQueryObject,CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,CertFindCertificateInStore,CertGetNameStringW,CertGetNameStringW,CertGetNameStringW,CertFreeCertificateContext,CertCloseStore,CryptMsgClose,

0_2_005AEE40

Source: tOE2mg8TbU.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.7.3:443 -> 192.168.2.12:49717 version: TLS 1.2

Source: tOE2mg8TbU.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Jenkins\workspace\MBAM-Windows\A_MB5_MBSetup\bin\Win32\Release\MBSetup.pdb source: tOE2mg8TbU.exe

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005CC1C8 GetFileAttributesExW,GetLastError,___std_fs_open_handle@16,GetLastError,GetFileInformationByHandle,FindFirstFileExW,FindClose,	0_2_005CC1C8
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_0058720F FindFirstFileW,FindClose,	0_2_0058720F
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_00591970 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	0_2_00591970

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.12:49717 -> 104.21.7.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.12:49717 -> 104.21.7.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: debonairnukk.xyz
Source: Malware configuration extractor	URLs: diffuculttan.xyz
Source: Malware configuration extractor	URLs: deafeninggeh.biz
Source: Malware configuration extractor	URLs: immureprech.biz
Source: Malware configuration extractor	URLs: sordid-snaked.cyou
Source: Malware configuration extractor	URLs: wrathful-jammy.cyou
Source: Malware configuration extractor	URLs: effecterectz.xyz
Source: Malware configuration extractor	URLs: cycahao.shop
Source: Malware configuration extractor	URLs: awake-weaves.cyou

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.12:49719 -> 104.21.7.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.12:49717 -> 104.21.7.3:443

Source: global traffic

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cycahao.shop

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: cycahao.shop

Source: unknown

Source: tOE2mg8TbU.exe, 00000000.00000003.2579328135.0000000001247000.00000004.00000020.00020000.00000000.sdmp, tOE2mg8TbU.exe, 00000000.00000003.2579115673.0000000001203000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: tOE2mg8TbU.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: tOE2mg8TbU.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: tOE2mg8TbU.exe	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA2.crl0t
Source: tOE2mg8TbU.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: tOE2mg8TbU.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: tOE2mg8TbU.exe	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA2.crt0#
Source: tOE2mg8TbU.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: tOE2mg8TbU.exe	String found in binary or memory: http://www.adr.org/Forms
Source: tOE2mg8TbU.exe	String found in binary or memory: http://www.adr.org/Rules
Source: tOE2mg8TbU.exe	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: tOE2mg8TbU.exe	String found in binary or memory: http://www.google.com/policies/privacy
Source: tOE2mg8TbU.exe	String found in binary or memory: http://www.malwarebytes.com
Source: tOE2mg8TbU.exe	String found in binary or memory: http://www.malwarebytes.com/legal
Source: tOE2mg8TbU.exe	String found in binary or memory: https://ark.mwbsys.com/bgext
Source: tOE2mg8TbU.exe	String found in binary or memory: https://aws.amazon.com/compliance/
Source: tOE2mg8TbU.exe	String found in binary or memory: https://br.malwarebytes.com/privacy/
Source: tOE2mg8TbU.exe	String found in binary or memory: https://cdn.cookielaw.org/consent/9530a107-0af8-4204-a2c2-217efb78222b.js
Source: tOE2mg8TbU.exe	String found in binary or memory: https://cdn.jsdelivr.net/npm/slick-carousel
Source: tOE2mg8TbU.exe	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/s
Source: tOE2mg8TbU.exe	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.6.0/slick-theme.css
Source: tOE2mg8TbU.exe	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.6.0/slick.css
Source: tOE2mg8TbU.exe	String found in binary or memory: https://code.jquery.com/jquery-3.3.1.min.js
Source: tOE2mg8TbU.exe, 00000000.00000003.2579115673.0000000001203000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycahao.shop/
Source: tOE2mg8TbU.exe, 00000000.00000002.2580555776.0000000001203000.00000004.00000020.00020000.00000000.sdmp, tOE2mg8TbU.exe, 00000000.00000003.2579423426.0000000001203000.00000004.00000020.00020000.00000000.sdmp, tOE2mg8TbU.exe, 00000000.00000003.2579115673.0000000001203000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycahao.shop/X
Source: tOE2mg8TbU.exe, 00000000.00000003.2579423426.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, tOE2mg8TbU.exe, 00000000.00000002.2580555776.0000000001203000.00000004.00000020.00020000.00000000.sdmp, tOE2mg8TbU.exe, 00000000.00000003.2579423426.0000000001203000.00000004.00000020.00020000.00000000.sdmp, tOE2mg8TbU.exe, 00000000.00000002.2580477957.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, tOE2mg8TbU.exe, 00000000.00000003.2579115673.0000000001203000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycahao.shop/api
Source: tOE2mg8TbU.exe, 00000000.00000003.2579423426.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, tOE2mg8TbU.exe, 00000000.00000002.2580477957.00000000011EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycahao.shop/apiMP
Source: tOE2mg8TbU.exe, 00000000.00000002.2580455505.00000000011C3000.00000004.00000020.00020000.00000000.sdmp, tOE2mg8TbU.exe, 00000000.00000003.2579115673.00000000011C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cycahao.shop/l
Source: tOE2mg8TbU.exe	String found in binary or memory: https://de.malwarebytes.com/privacy/
Source: tOE2mg8TbU.exe	String found in binary or memory: https://downloads.malwarebytes.com/file/mb4_offline
Source: tOE2mg8TbU.exe	String found in binary or memory: https://es.malwarebytes.com/privacy/
Source: tOE2mg8TbU.exe	String found in binary or memory: https://fr.malwarebytes.com/privacy/
Source: tOE2mg8TbU.exe	String found in binary or memory: https://it.malwarebytes.com/privacy/
Source: tOE2mg8TbU.exe	String found in binary or memory: https://links.malwarebytes.com/link/uninstalled?
Source: tOE2mg8TbU.exe	String found in binary or memory: https://links.malwarebytes.com/link/uninstalled?days_since_install=launching
Source: tOE2mg8TbU.exe	String found in binary or memory: https://links.malwarebytes.com/support/general/business/ms-2019-09-security-update
Source: tOE2mg8TbU.exe	String found in binary or memory: https://links.malwarebytes.com/support/installer/AVBlocking
Source: tOE2mg8TbU.exe	String found in binary or memory: https://links.malwarebytes.com/support/mb/windows/security-other-av
Source: tOE2mg8TbU.exe	String found in binary or memory: https://links.malwarebytes.com/support/mb/windows/security-other-avhttps://links.malwarebytes.com/su
Source: tOE2mg8TbU.exe	String found in binary or memory: https://links.malwarebytes.com/support/mb/windows/system-requirements
Source: tOE2mg8TbU.exe	String found in binary or memory: https://nl.malwarebytes.com/privacy/
Source: tOE2mg8TbU.exe	String found in binary or memory: https://pl.malwarebytes.com/privacy/
Source: tOE2mg8TbU.exe	String found in binary or memory: https://preferences-mgr.truste.com/
Source: tOE2mg8TbU.exe	String found in binary or memory: https://pt.malwarebytes.com/privacy/
Source: tOE2mg8TbU.exe	String found in binary or memory: https://ru.malwarebytes.com/privacy/
Source: tOE2mg8TbU.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: tOE2mg8TbU.exe	String found in binary or memory: https://support.malwarebytes.com/hc/en-us/articles/360039142934-Installation-troubleshooting-for-Mal
Source: tOE2mg8TbU.exe	String found in binary or memory: https://support.malwarebytes.com/hc/en-us/articles/4402964326419
Source: tOE2mg8TbU.exe	String found in binary or memory: https://www.google.com/policies/privacy
Source: tOE2mg8TbU.exe	String found in binary or memory: https://www.jamsadr.com/eu-us-privacy-shield.
Source: tOE2mg8TbU.exe	String found in binary or memory: https://www.malwarebytes.com/
Source: tOE2mg8TbU.exe	String found in binary or memory: https://www.malwarebytes.com/eula/
Source: tOE2mg8TbU.exe	String found in binary or memory: https://www.malwarebytes.com/eula/services-agreement/
Source: tOE2mg8TbU.exe	String found in binary or memory: https://www.malwarebytes.com/images/mb-logo-2.png
Source: tOE2mg8TbU.exe	String found in binary or memory: https://www.malwarebytes.com/images/share/Malwarebytes-homepage-share.jpg
Source: tOE2mg8TbU.exe	String found in binary or memory: https://www.malwarebytes.com/images/uploads/2020/07/30233020/EULA_Chart-2.png
Source: tOE2mg8TbU.exe	String found in binary or memory: https://www.malwarebytes.com/jobs
Source: tOE2mg8TbU.exe	String found in binary or memory: https://www.malwarebytes.com/js/mess.js
Source: tOE2mg8TbU.exe	String found in binary or memory: https://www.malwarebytes.com/legal/privacy-policy
Source: tOE2mg8TbU.exe	String found in binary or memory: https://www.malwarebytes.com/legal/privacy-policyopenhttps://www.malwarebytes.com/eula/MBAM-Crelease
Source: tOE2mg8TbU.exe	String found in binary or memory: https://www.malwarebytes.com/privacy/
Source: tOE2mg8TbU.exe	String found in binary or memory: https://www.malwarebytes.com/support/lifecycle/
Source: tOE2mg8TbU.exe	String found in binary or memory: https://www.privacyshield.gov/article?id=How-to-Submit-a-Complaint
Source: tOE2mg8TbU.exe	String found in binary or memory: https://www.privacyshield.gov/list
Source: tOE2mg8TbU.exe	String found in binary or memory: https://www.youronlinechoices.eu/

Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443

Source: unknown

HTTPS traffic detected: 104.21.7.3:443 -> 192.168.2.12:49717 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2580806521.00000000014D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

Code function: 0_2_0056A370: GetSystemDirectoryW,CreateFileW,DeviceIoControl,GetLastError,CloseHandle,CloseHandle,GetLastError,

0_2_0056A370

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005A0310	0_2_005A0310
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_0059D0F0	0_2_0059D0F0
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_0059D800	0_2_0059D800
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_00581D70	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_0060806B	0_2_0060806B
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005A4010	0_2_005A4010
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005F4035	0_2_005F4035
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_0056E0D0	0_2_0056E0D0
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005EC0AE	0_2_005EC0AE
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_00586149	0_2_00586149
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005D8356	0_2_005D8356
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005885C0	0_2_005885C0
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005AA5C0	0_2_005AA5C0
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_00604629	0_2_00604629
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_00590790	0_2_00590790
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005FE85F	0_2_005FE85F
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005BC990	0_2_005BC990
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_0060E9B0	0_2_0060E9B0
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_00592C10	0_2_00592C10
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005B4E00	0_2_005B4E00
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005D2FC3	0_2_005D2FC3
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_0059D150	0_2_0059D150
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_00603251	0_2_00603251
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_00603375	0_2_00603375
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005A1310	0_2_005A1310
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005E73B0	0_2_005E73B0
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005E745D	0_2_005E745D
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005E77CF	0_2_005E77CF
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005D37A9	0_2_005D37A9
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005C3880	0_2_005C3880
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005E7A79	0_2_005E7A79
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005AFA70	0_2_005AFA70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005CDAE0	0_2_005CDAE0

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: String function: 005CF69D appears 69 times
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: String function: 0056F7A0 appears 515 times
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: String function: 005CFC50 appears 54 times
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: String function: 005A17B0 appears 78 times
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: String function: 00578A90 appears 58 times
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: String function: 005797C0 appears 47 times
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: String function: 00567990 appears 63 times
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: String function: 0056F6F0 appears 46 times
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: String function: 005B7C10 appears 60 times
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: String function: 005CF0BB appears 42 times
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: String function: 005CF0D0 appears 42 times

Source: tOE2mg8TbU.exe

Static PE information: invalid certificate

Source: tOE2mg8TbU.exe

Static PE information: Resource name: RT_STRING type: 0420 Alliant virtual executable not stripped

Source: tOE2mg8TbU.exe, 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameMBSetup.exe: vs tOE2mg8TbU.exe
Source: tOE2mg8TbU.exe, 00000000.00000003.2538218929.0000000003393000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMBSetup.exe: vs tOE2mg8TbU.exe
Source: tOE2mg8TbU.exe	Binary or memory string: OriginalFilenameMBSetup.exe: vs tOE2mg8TbU.exe

Source: tOE2mg8TbU.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2580806521.00000000014D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

Code function: 0_2_005852D0 GetDiskFreeSpaceExW,GetLastError,

0_2_005852D0

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

Code function: 0_2_005AE990 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,CloseHandle,

0_2_005AE990

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

Code function: 0_2_0057C0D0 LoadResource,LockResource,SizeofResource,

0_2_0057C0D0

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: mbsetup.log	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: pb	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: pb	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: =====	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: H}d	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: mbuns.exe	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: unins000.exe	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: installing	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: uninstalling	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: X\|d	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: Malwarebytes	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: #32770	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: P~d	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: P~d	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: %hu.%hu.%hu.%hu	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: unknown	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: 2060	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: 2061	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: dtopicon	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: \|d	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: =====	0_2_00581D70
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Command line argument: pb	0_2_00581D70

Source: tOE2mg8TbU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tOE2mg8TbU.exe

ReversingLabs: Detection: 21%

Source: tOE2mg8TbU.exe	String found in binary or memory: " -install -extension "
Source: tOE2mg8TbU.exe	String found in binary or memory: https://links.malwarebytes.com/support/installer/AVBlocking
Source: tOE2mg8TbU.exe	String found in binary or memory: /installdir="
Source: tOE2mg8TbU.exe	String found in binary or memory: https://support.malwarebytes.com/hc/en-us/articles/360039142934-Installation-troubleshooting-for-Malwarebytes-on-Windows-devices
Source: tOE2mg8TbU.exe	String found in binary or memory: DDllGetVersioncomctl32.dllATL:%pstatushttps://support.malwarebytes.com/hc/en-us/articles/360039142934-Installation-troubleshooting-for-Malwarebytes-on-Windows-devices@
Source: tOE2mg8TbU.exe	String found in binary or memory: L'installazione o l'utilizzo questo prodotto costituiscono accettazione del relativo <a>Accordo di licenza per l'utente finale</a> e della relativa <a>Informativa sulla privacy</a>.)De-installatieprogramma voor Malwarebytes3De-installatieprogramma voor Malwarebytes for Teams
Source: tOE2mg8TbU.exe	String found in binary or memory: &De-installeren
Source: tOE2mg8TbU.exe	String found in binary or memory: -Installationspfad kann nicht erstellt werden.:Laufwerksbuchstabe f
Source: tOE2mg8TbU.exe	String found in binary or memory: Bestanden de-installeren&
Source: tOE2mg8TbU.exe	String found in binary or memory: De-installeren... %d%%
Source: tOE2mg8TbU.exe	String found in binary or memory: De-installatie voorbereiden(Verzilvering van licentie ongedaan maken
Source: tOE2mg8TbU.exe	String found in binary or memory: De-installatie voltooid
Source: tOE2mg8TbU.exe	String found in binary or memory: Unable to exit uninstallerdZolang Malwarebytes nog niet gede-installeerd is, kun je het de-installatieprogramma niet afsluiten.
Source: tOE2mg8TbU.exe	String found in binary or memory: Annulla"La password non deve essere vuota.gVoer je wachtwoord voor sabotagebeveiliging of je licentiesleutel in om Malwarebytes te de-installeren.
Source: tOE2mg8TbU.exe	String found in binary or memory: Trend Micro vraagt je kennelijk om ons te de-installeren. Dat is nogal wat, of niet? Dankzij Malwarebytes kunnen jij en andere spelers veilig met elkaar spelen.
Source: tOE2mg8TbU.exe	String found in binary or memory: Bitdefender vraagt je kennelijk om ons te de-installeren. Dat is nogal wat, of niet? Dankzij Malwarebytes kunnen jij en andere spelers veilig met elkaar spelen.
Source: tOE2mg8TbU.exe	String found in binary or memory: oVMalwarebytes for Windows n?o suporta a CPU ou a arquitetura de hardware deste sistema.\Die Malwarebytes-Installationsdatei kann nicht von einem Netzwerklaufwerk ausgef

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

File read: C:\Users\user\Desktop\tOE2mg8TbU.exe

Jump to behavior

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: tOE2mg8TbU.exe

Static file information: File size 2916584 > 1048576

Source: tOE2mg8TbU.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x178a00

Source: tOE2mg8TbU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: tOE2mg8TbU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: tOE2mg8TbU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: tOE2mg8TbU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: tOE2mg8TbU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: tOE2mg8TbU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: tOE2mg8TbU.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: tOE2mg8TbU.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\Jenkins\workspace\MBAM-Windows\A_MB5_MBSetup\bin\Win32\Release\MBSetup.pdb source: tOE2mg8TbU.exe

Source: tOE2mg8TbU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: tOE2mg8TbU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: tOE2mg8TbU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: tOE2mg8TbU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: tOE2mg8TbU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

Code function: 0_2_005AA5C0 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_005AA5C0

Source: tOE2mg8TbU.exe

Static PE information: real checksum: 0x27cb8e should be: 0x2d3c5c

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005D6AD1 pushfd ; iretd	0_2_005D6AD2
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_00580FC0 push ecx; mov dword ptr [esp], 3F800000h	0_2_00581369
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_00617361 push esp; retf 0064h	0_2_00617375
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005CF677 push ecx; ret	0_2_005CF68A
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005AF923 push eax; retf	0_2_005AF924
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005AF98D push esp; retf	0_2_005AF990

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

Code function: 0_2_005CDAE0 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_005CDAE0

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Contain functionality to detect virtual machines

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

Code function: VMwareVMware VBoxVBoxVBox

0_2_00568000

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

API coverage: 0.5 %

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe TID: 7148	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe TID: 6232	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005CC1C8 GetFileAttributesExW,GetLastError,___std_fs_open_handle@16,GetLastError,GetFileInformationByHandle,FindFirstFileExW,FindClose,	0_2_005CC1C8
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_0058720F FindFirstFileW,FindClose,	0_2_0058720F
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_00591970 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	0_2_00591970

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

Code function: 0_2_005CAD53 VirtualQuery,GetSystemInfo,

0_2_005CAD53

Source: tOE2mg8TbU.exe	Binary or memory string: VMware
Source: tOE2mg8TbU.exe	Binary or memory string: O@0S@`y@string too long{ADC340ED-D55E-4E83-92AB-E57BEE7DD6F8}VMwareVMwareVBoxVBoxVBoxXenVMMXenVMMKVMKVMKVMParallels Hv lrpepyh vrbhyve bhyveXenVMwareVRTUALSOFTWARE\MalwarebytesidSoftware\Microsoft\CryptographyMachineGuidHardware\Description\SystemSystemBiosVersionSystemBiosDate\|ROOT\CIMV2WQLSELECT UUID FROM Win32_ComputerSystemProductUUIDSELECT SerialNumber FROM Win32_BIOSSerialNumberSELECT processorID FROM win32_processorprocessorID\\?\%sSELECT Signature FROM Win32_DiskDrive WHERE Index=%uSignature%uSELECT serialNumber FROM Win32_PhysicalMemoryserialNumberSELECT SerialNumber FROM Win32_DiskDrive WHERE Index=%uinvalid string positionvector<T> too long0123456789abcdefTlM
Source: tOE2mg8TbU.exe	Binary or memory string: VMwareVMware
Source: tOE2mg8TbU.exe, 00000000.00000002.2580555776.0000000001203000.00000004.00000020.00020000.00000000.sdmp, tOE2mg8TbU.exe, 00000000.00000003.2579423426.0000000001203000.00000004.00000020.00020000.00000000.sdmp, tOE2mg8TbU.exe, 00000000.00000002.2580455505.00000000011C3000.00000004.00000020.00020000.00000000.sdmp, tOE2mg8TbU.exe, 00000000.00000003.2579115673.0000000001203000.00000004.00000020.00020000.00000000.sdmp, tOE2mg8TbU.exe, 00000000.00000003.2579115673.00000000011C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: tOE2mg8TbU.exe, 00000000.00000000.2401978548.0000000000619000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OV0SV`yVstring too long{ADC340ED-D55E-4E83-92AB-E57BEE7DD6F8}VMwareVMwareVBoxVBoxVBoxXenVMMXenVMMKVMKVMKVMParallels Hv lrpepyh vrbhyve bhyveXenVMwareVRTUALSOFTWARE\MalwarebytesidSoftware\Microsoft\CryptographyMachineGuidHardware\Description\SystemSystemBiosVersionSystemBiosDate\|ROOT\CIMV2WQLSELECT UUID FROM Win32_ComputerSystemProductUUIDSELECT SerialNumber FROM Win32_BIOSSerialNumberSELECT processorID FROM win32_processorprocessorID\\?\%sSELECT Signature FROM Win32_DiskDrive WHERE Index=%uSignature%uSELECT serialNumber FROM Win32_PhysicalMemoryserialNumberSELECT SerialNumber FROM Win32_DiskDrive WHERE Index=%uinvalid string positionvector<T> too long0123456789abcdefTlc

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

Code function: 0_2_005CE685 IsDebuggerPresent,OutputDebugStringW,

0_2_005CE685

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

Code function: 0_2_005AA5C0 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_005AA5C0

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005CE99A mov esi, dword ptr fs:[00000030h]	0_2_005CE99A
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005FF262 mov eax, dword ptr fs:[00000030h]	0_2_005FF262
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005FF21C mov eax, dword ptr fs:[00000030h]	0_2_005FF21C

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

Code function: 0_2_005CE8A4 GetProcessHeap,HeapAlloc,InterlockedPopEntrySList,VirtualAlloc,RaiseException,InterlockedPopEntrySList,VirtualFree,InterlockedPushEntrySList,

0_2_005CE8A4

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005CF11C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_005CF11C
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005CF8BC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_005CF8BC
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005CFA4F SetUnhandledExceptionFilter,	0_2_005CFA4F

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: tOE2mg8TbU.exe	String found in binary or memory: debonairnukk.xyz
Source: tOE2mg8TbU.exe	String found in binary or memory: deafeninggeh.biz
Source: tOE2mg8TbU.exe	String found in binary or memory: immureprech.biz
Source: tOE2mg8TbU.exe	String found in binary or memory: diffuculttan.xyz
Source: tOE2mg8TbU.exe	String found in binary or memory: effecterectz.xyz
Source: tOE2mg8TbU.exe	String found in binary or memory: cycahao.shop

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

Code function: 0_2_00568000 cpuid

0_2_00568000

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_006085C4
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: EnumSystemLocalesW,	0_2_0060886A
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: EnumSystemLocalesW,	0_2_006088B5
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: EnumSystemLocalesW,	0_2_00608950
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_006089DB
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: GetLocaleInfoW,	0_2_00608C30
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00608D58
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: GetLocaleInfoW,	0_2_00608E60
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: EnumSystemLocalesW,	0_2_00600E1C
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00608F33
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: GetLocaleInfoW,	0_2_006013CF

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

Code function: 0_2_005CE043 GetSystemTimeAsFileTime,

0_2_005CE043

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

Code function: 0_2_006029E5 _free,_free,_free,GetTimeZoneInformation,_free,

0_2_006029E5

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005E05B4 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	0_2_005E05B4
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_005E128A Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::InternalContextBase::SwitchOut,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::InternalContextBase::SwitchTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,	0_2_005E128A
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_00561330 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,	0_2_00561330
Source: C:\Users\user\Desktop\tOE2mg8TbU.exe	Code function: 0_2_00561410 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,__ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,__ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,__ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,__ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,__ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,__ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,InitializeCriticalSectionEx,GetLastError,	0_2_00561410

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Deobfuscate/Decode Files or Information	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	113 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	45 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
tOE2mg8TbU.exe	21%	ReversingLabs

Source	Detection	Scanner	Label
https://www.youronlinechoices.eu/	0%	Avira URL Cloud	safe
https://fr.malwarebytes.com/privacy/	0%	Avira URL Cloud	safe
https://cycahao.shop/api	0%	Avira URL Cloud	safe
https://ru.malwarebytes.com/privacy/	0%	Avira URL Cloud	safe
https://www.privacyshield.gov/list	0%	Avira URL Cloud	safe
https://es.malwarebytes.com/privacy/	0%	Avira URL Cloud	safe
https://pt.malwarebytes.com/privacy/	0%	Avira URL Cloud	safe
https://cycahao.shop/apiMP	0%	Avira URL Cloud	safe
https://pl.malwarebytes.com/privacy/	0%	Avira URL Cloud	safe
https://cycahao.shop/X	0%	Avira URL Cloud	safe
cycahao.shop	0%	Avira URL Cloud	safe
https://cycahao.shop/l	0%	Avira URL Cloud	safe
https://www.privacyshield.gov/article?id=How-to-Submit-a-Complaint	0%	Avira URL Cloud	safe
https://cycahao.shop/	0%	Avira URL Cloud	safe
https://nl.malwarebytes.com/privacy/	0%	Avira URL Cloud	safe
https://br.malwarebytes.com/privacy/	0%	Avira URL Cloud	safe
https://de.malwarebytes.com/privacy/	0%	Avira URL Cloud	safe
https://it.malwarebytes.com/privacy/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cycahao.shop	104.21.7.3	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
sordid-snaked.cyou	false		high
deafeninggeh.biz	false		high
diffuculttan.xyz	false		high
effecterectz.xyz	false		high
wrathful-jammy.cyou	false		high
https://cycahao.shop/api	true	Avira URL Cloud: safe	unknown
awake-weaves.cyou	false		high
immureprech.biz	false		high
cycahao.shop	true	Avira URL Cloud: safe	unknown
debonairnukk.xyz	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.malwarebytes.com/images/mb-logo-2.png	tOE2mg8TbU.exe	false		high
https://www.google.com/policies/privacy	tOE2mg8TbU.exe	false		high
https://support.malwarebytes.com/hc/en-us/articles/4402964326419	tOE2mg8TbU.exe	false		high
http://crt.sectigo.com/SectigoRSACodeSigningCA2.crt0#	tOE2mg8TbU.exe	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	tOE2mg8TbU.exe	false		high
http://ocsp.sectigo.com0	tOE2mg8TbU.exe	false		high
http://www.adr.org/Rules	tOE2mg8TbU.exe	false		high
https://ark.mwbsys.com/bgext	tOE2mg8TbU.exe	false		high
https://www.youronlinechoices.eu/	tOE2mg8TbU.exe	false	Avira URL Cloud: safe	unknown
https://www.malwarebytes.com/legal/privacy-policy	tOE2mg8TbU.exe	false		high
https://links.malwarebytes.com/support/installer/AVBlocking	tOE2mg8TbU.exe	false		high
https://support.malwarebytes.com/hc/en-us/articles/360039142934-Installation-troubleshooting-for-Mal	tOE2mg8TbU.exe	false		high
https://links.malwarebytes.com/support/mb/windows/security-other-avhttps://links.malwarebytes.com/su	tOE2mg8TbU.exe	false		high
https://www.malwarebytes.com/images/uploads/2020/07/30233020/EULA_Chart-2.png	tOE2mg8TbU.exe	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	tOE2mg8TbU.exe	false		high
https://www.malwarebytes.com/eula/	tOE2mg8TbU.exe	false		high
https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.6.0/slick.css	tOE2mg8TbU.exe	false		high
https://www.malwarebytes.com/legal/privacy-policyopenhttps://www.malwarebytes.com/eula/MBAM-Crelease	tOE2mg8TbU.exe	false		high
https://fr.malwarebytes.com/privacy/	tOE2mg8TbU.exe	false	Avira URL Cloud: safe	unknown
https://cdn.jsdelivr.net/npm/slick-carousel	tOE2mg8TbU.exe	false		high
https://pt.malwarebytes.com/privacy/	tOE2mg8TbU.exe	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.6.0/slick-theme.css	tOE2mg8TbU.exe	false		high
https://cycahao.shop/X	tOE2mg8TbU.exe, 00000000.00000002.2580555776.0000000001203000.00000004.00000020.00020000.00000000.sdmp, tOE2mg8TbU.exe, 00000000.00000003.2579423426.0000000001203000.00000004.00000020.00020000.00000000.sdmp, tOE2mg8TbU.exe, 00000000.00000003.2579115673.0000000001203000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aws.amazon.com/compliance/	tOE2mg8TbU.exe	false		high
http://crl.sectigo.com/SectigoRSACodeSigningCA2.crl0t	tOE2mg8TbU.exe	false		high
https://www.malwarebytes.com/support/lifecycle/	tOE2mg8TbU.exe	false		high
https://downloads.malwarebytes.com/file/mb4_offline	tOE2mg8TbU.exe	false		high
https://www.malwarebytes.com/jobs	tOE2mg8TbU.exe	false		high
https://www.malwarebytes.com/js/mess.js	tOE2mg8TbU.exe	false		high
https://code.jquery.com/jquery-3.3.1.min.js	tOE2mg8TbU.exe	false		high
https://pl.malwarebytes.com/privacy/	tOE2mg8TbU.exe	false	Avira URL Cloud: safe	unknown
https://ru.malwarebytes.com/privacy/	tOE2mg8TbU.exe	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	tOE2mg8TbU.exe	false		high
http://www.malwarebytes.com/legal	tOE2mg8TbU.exe	false		high
https://links.malwarebytes.com/link/uninstalled?days_since_install=launching	tOE2mg8TbU.exe	false		high
http://www.apache.org/licenses/LICENSE-2.0	tOE2mg8TbU.exe	false		high
https://www.privacyshield.gov/list	tOE2mg8TbU.exe	false	Avira URL Cloud: safe	unknown
https://preferences-mgr.truste.com/	tOE2mg8TbU.exe	false		high
https://sectigo.com/CPS0	tOE2mg8TbU.exe	false		high
https://cdn.cookielaw.org/consent/9530a107-0af8-4204-a2c2-217efb78222b.js	tOE2mg8TbU.exe	false		high
https://es.malwarebytes.com/privacy/	tOE2mg8TbU.exe	false	Avira URL Cloud: safe	unknown
https://cycahao.shop/apiMP	tOE2mg8TbU.exe, 00000000.00000003.2579423426.00000000011EB000.00000004.00000020.00020000.00000000.sdmp, tOE2mg8TbU.exe, 00000000.00000002.2580477957.00000000011EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://links.malwarebytes.com/link/uninstalled?	tOE2mg8TbU.exe	false		high
https://www.jamsadr.com/eu-us-privacy-shield.	tOE2mg8TbU.exe	false		high
https://www.malwarebytes.com/images/share/Malwarebytes-homepage-share.jpg	tOE2mg8TbU.exe	false		high
http://www.google.com/policies/privacy	tOE2mg8TbU.exe	false		high
https://cycahao.shop/l	tOE2mg8TbU.exe, 00000000.00000002.2580455505.00000000011C3000.00000004.00000020.00020000.00000000.sdmp, tOE2mg8TbU.exe, 00000000.00000003.2579115673.00000000011C3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.adr.org/Forms	tOE2mg8TbU.exe	false		high
https://nl.malwarebytes.com/privacy/	tOE2mg8TbU.exe	false	Avira URL Cloud: safe	unknown
http://crl.m	tOE2mg8TbU.exe, 00000000.00000003.2579328135.0000000001247000.00000004.00000020.00020000.00000000.sdmp, tOE2mg8TbU.exe, 00000000.00000003.2579115673.0000000001203000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cycahao.shop/	tOE2mg8TbU.exe, 00000000.00000003.2579115673.0000000001203000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.privacyshield.gov/article?id=How-to-Submit-a-Complaint	tOE2mg8TbU.exe	false	Avira URL Cloud: safe	unknown
https://links.malwarebytes.com/support/mb/windows/security-other-av	tOE2mg8TbU.exe	false		high
https://www.malwarebytes.com/eula/services-agreement/	tOE2mg8TbU.exe	false		high
https://www.malwarebytes.com/privacy/	tOE2mg8TbU.exe	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	tOE2mg8TbU.exe	false		high
https://br.malwarebytes.com/privacy/	tOE2mg8TbU.exe	false	Avira URL Cloud: safe	unknown
https://www.malwarebytes.com/	tOE2mg8TbU.exe	false		high
https://cdnjs.cloudflare.com/ajax/libs/s	tOE2mg8TbU.exe	false		high
https://links.malwarebytes.com/support/general/business/ms-2019-09-security-update	tOE2mg8TbU.exe	false		high
https://it.malwarebytes.com/privacy/	tOE2mg8TbU.exe	false	Avira URL Cloud: safe	unknown
https://links.malwarebytes.com/support/mb/windows/system-requirements	tOE2mg8TbU.exe	false		high
http://www.malwarebytes.com	tOE2mg8TbU.exe	false		high
https://de.malwarebytes.com/privacy/	tOE2mg8TbU.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.7.3	cycahao.shop	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574818
Start date and time:	2024-12-13 16:41:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	tOE2mg8TbU.exe renamed because original name is a hash value
Original Sample Name:	250b19f587575df98fc24e8eb185db8afdadd2b672de55bb9be1982212bc05b3.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 6 Number of non-executed functions: 189
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.63
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: tOE2mg8TbU.exe

Simulations

Behavior and APIs

Time	Type	Description
10:42:43	API Interceptor	2x Sleep call for process: tOE2mg8TbU.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.7.3	luJ1ncVKe3.exe	Get hash	malicious	FormBook	Browse	www.apkreal.net/de74/?YBZD6=rjGIOJfdWgyKy0sSM8EV1DsPSxOh46YUdJYVobQuFiHH7gQJstz2aAa8ukH4MVrfGQ6kqF2JHg==&TVg8xb=yb9P8nIHBZD

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	YzujxlvYB1.exe	Get hash	malicious	LummaC	Browse	104.21.76.144
	DLgUizecOn.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	infrarecorder.exe	Get hash	malicious	LummaC	Browse	172.67.207.38
	AEO7faaL.ps1	Get hash	malicious	LummaC	Browse	104.21.32.1
	https://afw.soundestlink.com/ce/c/675c127e5a5226f9e7b86686/675c13ae85cd17d1e3e2ab54/675c13c9f9a08fb1fbb3e577?signature=3f4d77f7452e61cf1e0cb9ce4a3540d02af0944caf975b089573a2fc1d891103	Get hash	malicious	Unknown	Browse	104.21.32.1
	https://artsofbristy.com/?data=ZGdyaW5zdGVhZEBjaXR5b2Zyb3hib3JvLmNvbQ==	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://poplast-poplast.powerappsportals.com/?e=e83cfd89&h=e7e60467&f=y&p=y&l=1	Get hash	malicious	Unknown	Browse	104.21.37.168
	file.exe	Get hash	malicious	Amadey	Browse	104.21.36.105
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	https://t.co/4MnukUbNZX	Get hash	malicious	Unknown	Browse	172.66.0.227

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	YzujxlvYB1.exe	Get hash	malicious	LummaC	Browse	104.21.7.3
	DLgUizecOn.exe	Get hash	malicious	LummaC	Browse	104.21.7.3
	infrarecorder.exe	Get hash	malicious	LummaC	Browse	104.21.7.3
	AEO7faaL.ps1	Get hash	malicious	LummaC	Browse	104.21.7.3
	PyrNUtAUkw.docx	Get hash	malicious	Unknown	Browse	104.21.7.3
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.7.3
	rcNDmdah2W.doc	Get hash	malicious	Unknown	Browse	104.21.7.3
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Xmrig	Browse	104.21.7.3
	SLNA_Updated_Medical_Grant_Application(1).docx	Get hash	malicious	Unknown	Browse	104.21.7.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.7.3

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.19670760341727
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	tOE2mg8TbU.exe
File size:	2'916'584 bytes
MD5:	007c8d6917cb62d9cf8bc921ff92ae93
SHA1:	de2bef155edeafb67956d1425bcf5a085319a179
SHA256:	250b19f587575df98fc24e8eb185db8afdadd2b672de55bb9be1982212bc05b3
SHA512:	a11e390bcd63bd4e30f27a8efabe99365a097861e8fa83591574545ee80e7eae9af1a305348f964527ade3d0773cf41479e5cfa3a5dbffb48fcad69f7a1e504d
SSDEEP:	49152:kMotPlPU+QG/rOVqVzM2dXidwyPvEUZHRUnxSIapDwfkEarSU5Nv1Y:kMalc+QGjuN2FKtQh4Ea+U5d1Y
TLSH:	88D59D61B2D14125E5B2E6302C7DB7EA0B76BC296F35418F32D8B63C0B729C19D35B26
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Lo.."<.."<.."<..!=.."<..'=C."<..!=.."<..&=.."<..'=t."<..&=.."<..$=.."<..#=.."<..#<8."<R.+=.."<R..<.."<...<.."<R. =.."<Rich.."

File Icon


Icon Hash:	70e8abaa8eccf830

Static PE Info

General

Entrypoint:	0x46f66d
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A912A6 [Tue Jul 30 16:19:50 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	63ccd71a76a39a85385ce6d1810f26c1

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo RSA Code Signing CA 2, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	22/03/2022 20:00:00 16/03/2025 19:59:59
Subject Chain	CN=Malwarebytes Inc., O=Malwarebytes Inc., S=California, C=US
Version:	3
Thumbprint MD5:	ECA3BD5C57433237AA1CE99AD78E0A95
Thumbprint SHA-1:	0A5E143F869DA652384B3EC6E735F6A7D9ADCD41
Thumbprint SHA-256:	DBD30BD9BD76C363B669665083A37B462F3F71F5DB2AB069965F9C7BECEF87D9
Serial:	00A657F778B31AE523D667131718D16EB2

Entrypoint Preview

Instruction
call 00007EFFE08FFB0Bh
jmp 00007EFFE08FF25Fh
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007EFFE08FE8FEh
jmp 00007EFFE08FF3C0h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [004E706Ch]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [004E706Ch]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [004E706Ch]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe50cc	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xed000	0x178869	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x2bbc00	0xc4e8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x266000	0xabf8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xd4e40	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xd4eb0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xbcc98	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb9000	0x2ec	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xe371c	0x1a0	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb7a36	0xb7c00	32f98843af17184b5d5c250395c6085b	False	0.49614822491496596	data	6.592545337295465	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb9000	0x2d220	0x2d400	9bc7d8ff891dbcd12a2198b97e2b31ee	False	0.3807568629143646	data	5.019273831361903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xe7000	0x5c5c	0x4600	b8bfec2e3db0d853c1cad1f68aa2d83a	False	0.22126116071428573	DOS executable (block device driver pyright)	4.715695426686277	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xed000	0x178869	0x178a00	05bdf527abb7436f8c7642ffd8e094a3	False	0.6041742293810156	data	7.130416376543464	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x266000	0x59800	0x59800	6862cdbcfe7bedd20a2c6c3094b522e1	False	0.7062292685055865	data	7.728163425515973	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
BINARY	0xefec0	0x28da8	TrueType Font data, 18 tables, 1st "GDEF", 13 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.RobotoBoldRoboto BoldVersion 2.137; 2017Roboto-Bo	English	United States	0.5296768178993163
BINARY	0x118c68	0x29144	TrueType Font data, 18 tables, 1st "GDEF", 13 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.RobotoRegularVersion 2.137; 2017Roboto-RegularRob	English	United States	0.5236776417449186
PNG	0x141dac	0x2514	PNG image data, 109 x 101, 8-bit/color RGBA, non-interlaced	English	United States	1.001158870627897
PNG	0x1442c0	0x3005	PNG image data, 134 x 124, 8-bit/color RGBA, non-interlaced	English	United States	1.0008948181892134
PNG	0x1472c8	0x40f6	PNG image data, 164 x 152, 8-bit/color RGBA, non-interlaced	English	United States	1.0009621166566447
PNG	0x14b3c0	0x61fe	PNG image data, 218 x 202, 8-bit/color RGBA, non-interlaced	English	United States	1.0005182173323766
PNG	0x1515c0	0x15b	PNG image data, 32 x 32, 8-bit colormap, non-interlaced	English	United States	0.9971181556195965
PNG	0x15171c	0x49a	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0093378607809846
PNG	0x151bb8	0x5ef	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	English	United States	1.0072416063199474
PNG	0x1521a8	0x215	PNG image data, 64 x 64, 8-bit colormap, non-interlaced	English	United States	1.0168855534709194
PNG	0x1523c0	0x1967	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0016915269875442
PNG	0x153d28	0x24b8	PNG image data, 100 x 101, 8-bit/color RGBA, non-interlaced	English	United States	1.0011702127659574
PNG	0x1561e0	0x30f6	PNG image data, 120 x 121, 8-bit/color RGBA, non-interlaced	English	United States	1.0008776128929313
PNG	0x1592d8	0x4fb0	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced	English	United States	1.0007843137254901
PNG	0x15e288	0x156d	PNG image data, 81 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0020054694621696
PNG	0x15f7f8	0x1d9a	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced	English	United States	1.0014515703351807
PNG	0x161594	0x27ae	PNG image data, 121 x 121, 8-bit/color RGBA, non-interlaced	English	United States	1.0010828903327427
PNG	0x163d44	0x3f4a	PNG image data, 161 x 160, 8-bit/color RGBA, non-interlaced	English	United States	1.0006789285273423
PNG	0x167c90	0x340	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0084134615384615
PNG	0x167fd0	0x3d0	PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced	English	United States	1.0112704918032787
PNG	0x1683a0	0x488	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0094827586206896
PNG	0x168828	0x612	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	English	United States	1.007078507078507
PNG	0x168e3c	0x1375	PNG image data, 111 x 70, 8-bit/color RGBA, non-interlaced	English	United States	1.0022083918891789
PNG	0x16a1b4	0x2272	PNG image data, 167 x 105, 8-bit/color RGBA, non-interlaced	English	United States	1.0012474484009979
PNG	0x16c428	0x2272	PNG image data, 167 x 105, 8-bit/color RGBA, non-interlaced	English	United States	1.0012474484009979
PNG	0x16e69c	0x31bd	PNG image data, 222 x 140, 8-bit/color RGBA, non-interlaced	English	United States	1.0008638969606534
PNG	0x17185c	0x114	PNG image data, 13 x 11, 8-bit/color RGBA, non-interlaced	English	United States	1.0072463768115942
PNG	0x171970	0x13f	PNG image data, 17 x 14, 8-bit/color RGBA, non-interlaced	English	United States	1.0125391849529781
PNG	0x171ab0	0x169	PNG image data, 20 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.0221606648199446
PNG	0x171c1c	0x192	PNG image data, 26 x 21, 8-bit/color RGBA, non-interlaced	English	United States	1.027363184079602
PNG	0x171db0	0x1e2d	PNG image data, 222 x 190, 8-bit/color RGBA, non-interlaced	English	United States	0.9800647249190938
PNG	0x173be0	0x2643	PNG image data, 278 x 238, 8-bit/color RGBA, non-interlaced	English	United States	0.9742725880551302
PNG	0x176224	0x2f01	PNG image data, 333 x 285, 8-bit/color RGBA, non-interlaced	English	United States	0.9673398155073548
PNG	0x179128	0x3d85	PNG image data, 444 x 380, 8-bit/color RGBA, non-interlaced	English	United States	0.9634262492856689
PNG	0x17ceb0	0x36fd	PNG image data, 222 x 190, 8-bit/color RGBA, non-interlaced	English	United States	0.987781487532855
PNG	0x1805b0	0x4b8b	PNG image data, 279 x 238, 8-bit/color RGBA, non-interlaced	English	United States	0.9896064946481203
PNG	0x18513c	0x62b6	PNG image data, 334 x 285, 8-bit/color RGBA, non-interlaced	English	United States	0.9856351404827859
PNG	0x18b3f4	0x9877	PNG image data, 444 x 380, 8-bit/color RGBA, non-interlaced	English	United States	0.981834951705055
PNG	0x194c6c	0x2351	PNG image data, 222 x 190, 8-bit/color RGBA, non-interlaced	English	United States	0.9826346643070457
PNG	0x196fc0	0x32bb	PNG image data, 278 x 238, 8-bit/color RGBA, non-interlaced	English	United States	0.977977977977978
PNG	0x19a27c	0x4345	PNG image data, 333 x 285, 8-bit/color RGBA, non-interlaced	English	United States	0.9784565356251089
PNG	0x19e5c4	0x6870	PNG image data, 444 x 380, 8-bit/color RGBA, non-interlaced	English	United States	0.97348144823459
PNG	0x1a4e34	0x2ec1	PNG image data, 222 x 190, 8-bit/color RGBA, non-interlaced	English	United States	0.9812849862143872
PNG	0x1a7cf8	0x3eb9	PNG image data, 278 x 238, 8-bit/color RGBA, non-interlaced	English	United States	0.9794482157314567
PNG	0x1abbb4	0x5176	PNG image data, 334 x 285, 8-bit/color RGBA, non-interlaced	English	United States	0.9782775486717177
PNG	0x1b0d2c	0x7a0a	PNG image data, 444 x 380, 8-bit/color RGBA, non-interlaced	English	United States	0.9715127072530568
PNG	0x1b8738	0x2f93	PNG image data, 222 x 190, 8-bit/color RGBA, non-interlaced	English	United States	0.9830035306675425
PNG	0x1bb6cc	0x4203	PNG image data, 279 x 238, 8-bit/color RGBA, non-interlaced	English	United States	0.9791111900112432
PNG	0x1bf8d0	0x5771	PNG image data, 334 x 285, 8-bit/color RGBA, non-interlaced	English	United States	0.9775742684833594
PNG	0x1c5044	0x8a78	PNG image data, 444 x 380, 8-bit/color RGBA, non-interlaced	English	United States	0.9728898668472128
PNG	0x1cdabc	0x47e	PNG image data, 66 x 66, 8-bit/color RGBA, non-interlaced	English	United States	1.0095652173913043
PNG	0x1cdf3c	0x958	PNG image data, 81 x 81, 8-bit/color RGBA, non-interlaced	English	United States	1.004598662207358
PNG	0x1ce894	0xaf7	PNG image data, 98 x 98, 8-bit/color RGBA, non-interlaced	English	United States	1.0039187744923406
PNG	0x1cf38c	0x901	PNG image data, 131 x 131, 8-bit/color RGBA, non-interlaced	English	United States	1.004772234273319
PNG	0x1cfc90	0x175b	PNG image data, 142 x 142, 8-bit/color RGBA, non-interlaced	English	United States	0.9998327479511624
PNG	0x1d13ec	0x1efd	PNG image data, 178 x 178, 8-bit/color RGBA, non-interlaced	English	United States	1.0013866128828943
PNG	0x1d32ec	0x23e7	PNG image data, 213 x 213, 8-bit/color RGBA, non-interlaced	English	United States	0.9859645305189859
PNG	0x1d56d4	0x3156	PNG image data, 284 x 284, 8-bit/color RGBA, non-interlaced	English	United States	0.9855898653998416
PNG	0x1d882c	0x1524	PNG image data, 142 x 142, 8-bit/color RGBA, non-interlaced	English	United States	1.0020325203252032
PNG	0x1d9d50	0x1b36	PNG image data, 178 x 178, 8-bit/color RGBA, non-interlaced	English	United States	1.0015790984783233
PNG	0x1db888	0x1fb5	PNG image data, 213 x 213, 8-bit/color RGBA, non-interlaced	English	United States	0.9963040532216336
PNG	0x1dd840	0x2bd8	PNG image data, 284 x 284, 8-bit/color RGBA, non-interlaced	English	United States	0.9932287954383464
PNG	0x1e0418	0x493	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0093936806148591
PNG	0x1e08ac	0x596	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	United States	1.0076923076923077
PNG	0x1e0e44	0x68a	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0065710872162486
PNG	0x1e14d0	0x8c7	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0048954161103694
PNG	0x1e1d98	0x469	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0097431355181576
PNG	0x1e2204	0x701	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	United States	1.0061349693251533
PNG	0x1e2908	0x945	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0046354825115886
PNG	0x1e3250	0xa56	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.00151171579743
RESOURCEFILE	0x1e3ca8	0xf5ee	HTML document, Unicode text, UTF-8 text, with very long lines (3413), with CRLF line terminators	Russian	Russia	0.27048190857397
RESOURCEFILE	0x1f3298	0xeb64	HTML document, Unicode text, UTF-8 text, with very long lines (1295), with CRLF line terminators	Russian	Russia	0.2268503153003651
RT_BITMAP	0x201dfc	0x2ae8	Device independent bitmap graphic, 152 x 24 x 24, image size 10944, resolution 3780 x 3780 px/m	Russian	Russia	0.2274217042971595
RT_BITMAP	0x2048e4	0x4330	Device independent bitmap graphic, 190 x 30 x 24, image size 17160, resolution 3780 x 3780 px/m	Russian	Russia	0.19284883720930232
RT_BITMAP	0x208c14	0x5f38	Device independent bitmap graphic, 225 x 36 x 24, image size 24336, resolution 3780 x 3780 px/m	Russian	Russia	0.16212668198227764
RT_BITMAP	0x20eb4c	0xb104	Device independent bitmap graphic, 307 x 49 x 24, image size 45276, resolution 3780 x 3780 px/m	Russian	Russia	0.12234089504810663
RT_ICON	0x219c50	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.62677304964539
RT_ICON	0x21a0b8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.5315573770491804
RT_ICON	0x21aa40	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4699812382739212
RT_ICON	0x21bae8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.3537344398340249
RT_ICON	0x21e090	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.28206188001889465
RT_ICON	0x2222b8	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.20238595753626235
RT_ICON	0x22b760	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.17061989826097243
RT_DIALOG	0x23bf88	0x110	data	English	United States	0.45588235294117646
RT_DIALOG	0x23c098	0x178	data	English	United States	0.3882978723404255
RT_DIALOG	0x23c210	0x104	data	English	United States	0.47692307692307695
RT_DIALOG	0x23c314	0x1f0	data	English	United States	0.3286290322580645
RT_DIALOG	0x23c504	0x180	data	English	United States	0.3541666666666667
RT_DIALOG	0x23c684	0xd8	data	English	United States	0.44907407407407407
RT_DIALOG	0x23c75c	0xe4	data	English	United States	0.5219298245614035
RT_DIALOG	0x23c840	0x120	data	English	United States	0.5972222222222222
RT_STRING	0x23c960	0x48	data	German	Germany	0.6666666666666666
RT_STRING	0x23c9a8	0x4e	data	English	United States	0.6794871794871795
RT_STRING	0x23c9f8	0x48	data	Spanish	Spain	0.6388888888888888
RT_STRING	0x23ca40	0x48	data	French	France	0.6666666666666666
RT_STRING	0x23ca88	0x48	data	Italian	Italy	0.6666666666666666
RT_STRING	0x23cad0	0x48	data	Dutch	Netherlands	0.6666666666666666
RT_STRING	0x23cb18	0x48	data	Polish	Poland	0.6666666666666666
RT_STRING	0x23cb60	0x4e	data	Portuguese	Brazil	0.6923076923076923
RT_STRING	0x23cbb0	0x48	data	Russian	Russia	0.6666666666666666
RT_STRING	0x23cbf8	0x4e	data	Portuguese	Portugal	0.6923076923076923
RT_STRING	0x23cc48	0x158	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	German	Germany	0.48546511627906974
RT_STRING	0x23cda0	0x116	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	English	United States	0.5
RT_STRING	0x23ceb8	0x168	Matlab v4 mat-file (little endian) s, numeric, rows 0, columns 0	Spanish	Spain	0.4444444444444444
RT_STRING	0x23d020	0x17a	Matlab v4 mat-file (little endian) s, numeric, rows 0, columns 0	French	France	0.4312169312169312
RT_STRING	0x23d19c	0x15c	Matlab v4 mat-file (little endian) o, numeric, rows 0, columns 0	Italian	Italy	0.4454022988505747
RT_STRING	0x23d2f8	0x15e	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Dutch	Netherlands	0.44571428571428573
RT_STRING	0x23d458	0x136	Matlab v4 mat-file (little endian) r, numeric, rows 0, columns 0	Polish	Poland	0.4774193548387097
RT_STRING	0x23d590	0x14e	Matlab v4 mat-file (little endian) s, numeric, rows 0, columns 0	Portuguese	Brazil	0.45808383233532934
RT_STRING	0x23d6e0	0x16a	Matlab v4 mat-file (little endian) 0\004A\004B\0045\004@\004 , numeric, rows 0, columns 0	Russian	Russia	0.5220994475138122
RT_STRING	0x23d84c	0x178	Matlab v4 mat-file (little endian) s, numeric, rows 0, columns 0	Portuguese	Portugal	0.4441489361702128
RT_STRING	0x23d9c4	0x20a	data	German	Germany	0.4674329501915709
RT_STRING	0x23dbd0	0x1b8	data	English	United States	0.4772727272727273
RT_STRING	0x23dd88	0x216	data	Spanish	Spain	0.45131086142322097
RT_STRING	0x23dfa0	0x250	data	French	France	0.4172297297297297
RT_STRING	0x23e1f0	0x282	data	Italian	Italy	0.40654205607476634
RT_STRING	0x23e474	0x22e	data	Dutch	Netherlands	0.4121863799283154
RT_STRING	0x23e6a4	0x1f8	data	Polish	Poland	0.501984126984127
RT_STRING	0x23e89c	0x20a	data	Portuguese	Brazil	0.46934865900383144
RT_STRING	0x23eaa8	0x22e	data	Russian	Russia	0.5
RT_STRING	0x23ecd8	0x202	data	Portuguese	Portugal	0.4474708171206226
RT_STRING	0x23eedc	0x140	data	German	Germany	0.43125
RT_STRING	0x23f01c	0x144	data	English	United States	0.41975308641975306
RT_STRING	0x23f160	0x134	data	Spanish	Spain	0.4837662337662338
RT_STRING	0x23f294	0x144	data	French	France	0.4691358024691358
RT_STRING	0x23f3d8	0x142	data	Italian	Italy	0.4472049689440994
RT_STRING	0x23f51c	0x140	data	Dutch	Netherlands	0.453125
RT_STRING	0x23f65c	0x182	data	Polish	Poland	0.42487046632124353
RT_STRING	0x23f7e0	0x12c	data	Portuguese	Brazil	0.4666666666666667
RT_STRING	0x23f90c	0x15c	data	Russian	Russia	0.45977011494252873
RT_STRING	0x23fa68	0x12c	data	Portuguese	Portugal	0.4866666666666667
RT_STRING	0x23fb94	0x142	data	German	Germany	0.5900621118012422
RT_STRING	0x23fcd8	0x130	data	English	United States	0.6085526315789473
RT_STRING	0x23fe08	0x14e	data	Spanish	Spain	0.5748502994011976
RT_STRING	0x23ff58	0x14c	data	French	France	0.5933734939759037
RT_STRING	0x2400a4	0x13a	data	Italian	Italy	0.6050955414012739
RT_STRING	0x2401e0	0x140	data	Dutch	Netherlands	0.603125
RT_STRING	0x240320	0x130	data	Polish	Poland	0.6348684210526315
RT_STRING	0x240450	0x148	data	Portuguese	Brazil	0.5945121951219512
RT_STRING	0x240598	0x140	data	Russian	Russia	0.65
RT_STRING	0x2406d8	0x14c	data	Portuguese	Portugal	0.5843373493975904
RT_STRING	0x240824	0x29e	data	German	Germany	0.34626865671641793
RT_STRING	0x240ac4	0x23c	data	English	United States	0.3409090909090909
RT_STRING	0x240d00	0x294	data	Spanish	Spain	0.3212121212121212
RT_STRING	0x240f94	0x2d2	data	French	France	0.3268698060941828
RT_STRING	0x241268	0x2f2	data	Italian	Italy	0.3116710875331565
RT_STRING	0x24155c	0x28e	data	Dutch	Netherlands	0.3195718654434251
RT_STRING	0x2417ec	0x268	data	Polish	Poland	0.36688311688311687
RT_STRING	0x241a54	0x28a	data	Portuguese	Brazil	0.3384615384615385
RT_STRING	0x241ce0	0x212	data	Russian	Russia	0.37735849056603776
RT_STRING	0x241ef4	0x28a	data	Portuguese	Portugal	0.3415384615384615
RT_STRING	0x242180	0x156	data	German	Germany	0.564327485380117
RT_STRING	0x2422d8	0x10c	data	English	United States	0.5746268656716418
RT_STRING	0x2423e4	0x136	data	Spanish	Spain	0.5612903225806452
RT_STRING	0x24251c	0x144	data	French	France	0.5308641975308642
RT_STRING	0x242660	0x138	data	Italian	Italy	0.5416666666666666
RT_STRING	0x242798	0x12c	data	Dutch	Netherlands	0.5466666666666666
RT_STRING	0x2428c4	0x124	data	Polish	Poland	0.565068493150685
RT_STRING	0x2429e8	0x13c	data	Portuguese	Brazil	0.5379746835443038
RT_STRING	0x242b24	0x126	data	Russian	Russia	0.5578231292517006
RT_STRING	0x242c4c	0x13e	data	Portuguese	Portugal	0.5566037735849056
RT_STRING	0x242d8c	0x2d0	data	German	Germany	0.45555555555555555
RT_STRING	0x24305c	0x262	data	English	United States	0.46885245901639344
RT_STRING	0x2432c0	0x29a	data	Spanish	Spain	0.481981981981982
RT_STRING	0x24355c	0x2f0	data	French	France	0.46808510638297873
RT_STRING	0x24384c	0x280	data	Italian	Italy	0.4828125
RT_STRING	0x243acc	0x27a	data	Dutch	Netherlands	0.4589905362776025
RT_STRING	0x243d48	0x294	data	Polish	Poland	0.49242424242424243
RT_STRING	0x243fdc	0x27a	data	Portuguese	Brazil	0.48580441640378547
RT_STRING	0x244258	0x2e6	data	Russian	Russia	0.4865229110512129
RT_STRING	0x244540	0x2c8	data	Portuguese	Portugal	0.47752808988764045
RT_STRING	0x244808	0x1cc	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	German	Germany	0.4891304347826087
RT_STRING	0x2449d4	0x16c	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.4835164835164835
RT_STRING	0x244b40	0x18e	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Spanish	Spain	0.4949748743718593
RT_STRING	0x244cd0	0x1b8	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	French	France	0.4636363636363636
RT_STRING	0x244e88	0x1aa	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Italian	Italy	0.4694835680751174
RT_STRING	0x245034	0x1b2	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Dutch	Netherlands	0.44930875576036866
RT_STRING	0x2451e8	0x15a	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Polish	Poland	0.5115606936416185
RT_STRING	0x245344	0x184	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Portuguese	Brazil	0.4690721649484536
RT_STRING	0x2454c8	0x1b2	Matlab v4 mat-file (little endian) A\004B\0040\004=\004>\0042\004:\0040\004., numeric, rows 0, columns 0	Russian	Russia	0.5368663594470046
RT_STRING	0x24567c	0x1aa	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0	Portuguese	Portugal	0.45539906103286387
RT_STRING	0x245828	0x82e	data	German	Germany	0.3729703915950334
RT_STRING	0x246058	0x776	data	English	United States	0.3612565445026178
RT_STRING	0x2467d0	0x8a8	data	Spanish	Spain	0.3483754512635379
RT_STRING	0x247078	0x8c0	data	French	France	0.34732142857142856
RT_STRING	0x247938	0x90a	data	Italian	Italy	0.3452895419187554
RT_STRING	0x248244	0x826	data	Dutch	Netherlands	0.34755512943432404
RT_STRING	0x248a6c	0x7c0	data	Polish	Poland	0.38860887096774194
RT_STRING	0x24922c	0x8a8	data	Portuguese	Brazil	0.35694945848375453
RT_STRING	0x249ad4	0x82c	data	Russian	Russia	0.4077437858508604
RT_STRING	0x24a300	0x8b4	data	Portuguese	Portugal	0.3500897666068223
RT_STRING	0x24abb4	0xa2a	data	German	Germany	0.31744811683320523
RT_STRING	0x24b5e0	0x98c	data	English	United States	0.3044189852700491
RT_STRING	0x24bf6c	0xb72	data	Spanish	Spain	0.29215017064846416
RT_STRING	0x24cae0	0xb80	data	French	France	0.29347826086956524
RT_STRING	0x24d660	0xb98	data	Italian	Italy	0.2884097035040431
RT_STRING	0x24e1f8	0xa84	data	Dutch	Netherlands	0.29977711738484397
RT_STRING	0x24ec7c	0x9da	data	Polish	Poland	0.3267248215701824
RT_STRING	0x24f658	0xb90	PDP-11 UNIX/RT ldp	Portuguese	Brazil	0.29493243243243245
RT_STRING	0x2501e8	0xa04	data	Russian	Russia	0.3482839313572543
RT_STRING	0x250bec	0xb58	data	Portuguese	Portugal	0.29338842975206614
RT_STRING	0x251744	0x17a	data	German	Germany	0.42592592592592593
RT_STRING	0x2518c0	0x110	data	English	United States	0.5073529411764706
RT_STRING	0x2519d0	0x148	data	Spanish	Spain	0.4603658536585366
RT_STRING	0x251b18	0x17e	data	French	France	0.45287958115183247
RT_STRING	0x251c98	0x1dc	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0	Italian	Italy	0.3760504201680672
RT_STRING	0x251e74	0x13a	data	Dutch	Netherlands	0.49363057324840764
RT_STRING	0x251fb0	0x13e	data	Polish	Poland	0.5094339622641509
RT_STRING	0x2520f0	0x140	data	Portuguese	Brazil	0.471875
RT_STRING	0x252230	0x11c	data	Russian	Russia	0.528169014084507
RT_STRING	0x25234c	0x134	data	Portuguese	Portugal	0.45454545454545453
RT_STRING	0x252480	0x5f8	data	German	Germany	0.3147905759162304
RT_STRING	0x252a78	0x504	data	English	United States	0.3161993769470405
RT_STRING	0x252f7c	0x5bc	data	Spanish	Spain	0.30381471389645776
RT_STRING	0x253538	0x58a	data	French	France	0.32863187588152326
RT_STRING	0x253ac4	0x68c	data	Italian	Italy	0.2834128878281623
RT_STRING	0x254150	0x53e	data	Dutch	Netherlands	0.3181818181818182
RT_STRING	0x254690	0x4fa	data	Polish	Poland	0.33830455259026687
RT_STRING	0x254b8c	0x54a	data	Portuguese	Brazil	0.3124076809453471
RT_STRING	0x2550d8	0x4d4	data	Russian	Russia	0.37216828478964403
RT_STRING	0x2555ac	0x53e	data	Portuguese	Portugal	0.31296572280178836
RT_STRING	0x255aec	0x234	data	German	Germany	0.4397163120567376
RT_STRING	0x255d20	0x1d4	data	English	United States	0.4230769230769231
RT_STRING	0x255ef4	0x21a	data	Spanish	Spain	0.41263940520446096
RT_STRING	0x256110	0x216	data	French	France	0.45318352059925093
RT_STRING	0x256328	0x216	data	Italian	Italy	0.41947565543071164
RT_STRING	0x256540	0x216	data	Dutch	Netherlands	0.40636704119850187
RT_STRING	0x256758	0x1ca	data	Polish	Poland	0.48253275109170307
RT_STRING	0x256924	0x1f0	data	Portuguese	Brazil	0.4334677419354839
RT_STRING	0x256b14	0x1fc	data	Russian	Russia	0.5255905511811023
RT_STRING	0x256d10	0x1fa	data	Portuguese	Portugal	0.43280632411067194
RT_STRING	0x256f0c	0xd0	data	German	Germany	0.5673076923076923
RT_STRING	0x256fdc	0xac	data	English	United States	0.5872093023255814
RT_STRING	0x257088	0xbc	data	Spanish	Spain	0.5319148936170213
RT_STRING	0x257144	0xf2	data	French	France	0.5165289256198347
RT_STRING	0x257238	0xf2	data	Italian	Italy	0.49586776859504134
RT_STRING	0x25732c	0xe0	data	Dutch	Netherlands	0.5535714285714286
RT_STRING	0x25740c	0xc8	data	Polish	Poland	0.575
RT_STRING	0x2574d4	0xb4	data	Portuguese	Brazil	0.5777777777777777
RT_STRING	0x257588	0x98	data	Russian	Russia	0.6578947368421053
RT_STRING	0x257620	0xba	data	Portuguese	Portugal	0.5752688172043011
RT_STRING	0x2576dc	0xe0	data	German	Germany	0.53125
RT_STRING	0x2577bc	0xc6	data	English	United States	0.5151515151515151
RT_STRING	0x257884	0xde	data	Spanish	Spain	0.49099099099099097
RT_STRING	0x257964	0xde	data	French	France	0.5225225225225225
RT_STRING	0x257a44	0xee	data	Italian	Italy	0.5084033613445378
RT_STRING	0x257b34	0xde	data	Dutch	Netherlands	0.5
RT_STRING	0x257c14	0xc4	data	Polish	Poland	0.5867346938775511
RT_STRING	0x257cd8	0xdc	data	Portuguese	Brazil	0.5181818181818182
RT_STRING	0x257db4	0xae	data	Russian	Russia	0.5344827586206896
RT_STRING	0x257e64	0xca	data	Portuguese	Portugal	0.5099009900990099
RT_STRING	0x257f30	0x16c	data	German	Germany	0.4340659340659341
RT_STRING	0x25809c	0x124	AmigaOS bitmap font "x", fc_YSize 30720, 17664 elements, 2nd "t", 3rd	English	United States	0.4863013698630137
RT_STRING	0x2581c0	0x126	data	Spanish	Spain	0.4897959183673469
RT_STRING	0x2582e8	0x186	data	French	France	0.44358974358974357
RT_STRING	0x258470	0x168	data	Italian	Italy	0.425
RT_STRING	0x2585d8	0x14a	data	Dutch	Netherlands	0.45151515151515154
RT_STRING	0x258724	0x12a	data	Polish	Poland	0.5302013422818792
RT_STRING	0x258850	0x126	data	Portuguese	Brazil	0.5034013605442177
RT_STRING	0x258978	0x136	data	Russian	Russia	0.5161290322580645
RT_STRING	0x258ab0	0xf0	data	Portuguese	Portugal	0.49166666666666664
RT_STRING	0x258ba0	0x116	data	German	Germany	0.5287769784172662
RT_STRING	0x258cb8	0xfc	data	English	United States	0.5119047619047619
RT_STRING	0x258db4	0xf8	data	Spanish	Spain	0.5483870967741935
RT_STRING	0x258eac	0x110	data	French	France	0.5514705882352942
RT_STRING	0x258fbc	0x128	data	Italian	Italy	0.5067567567567568
RT_STRING	0x2590e4	0x112	data	Dutch	Netherlands	0.5583941605839416
RT_STRING	0x2591f8	0xec	data	Polish	Poland	0.6016949152542372
RT_STRING	0x2592e4	0x104	data	Portuguese	Brazil	0.5692307692307692
RT_STRING	0x2593e8	0xf0	data	Russian	Russia	0.6458333333333334
RT_STRING	0x2594d8	0xfe	data	Portuguese	Portugal	0.5748031496062992
RT_STRING	0x2595d8	0x11c	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	German	Germany	0.5176056338028169
RT_STRING	0x2596f4	0x102	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.4844961240310077
RT_STRING	0x2597f8	0xf8	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Spanish	Spain	0.532258064516129
RT_STRING	0x2598f0	0x116	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	French	France	0.5287769784172662
RT_STRING	0x259a08	0x144	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Italian	Italy	0.49691358024691357
RT_STRING	0x259b4c	0x11c	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Dutch	Netherlands	0.5176056338028169
RT_STRING	0x259c68	0xf6	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Polish	Poland	0.5772357723577236
RT_STRING	0x259d60	0x10e	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Portuguese	Brazil	0.5555555555555556
RT_STRING	0x259e70	0xfa	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Russian	Russia	0.652
RT_STRING	0x259f6c	0x108	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Portuguese	Portugal	0.5568181818181818
RT_STRING	0x25a074	0x16e	data	German	Germany	0.5327868852459017
RT_STRING	0x25a1e4	0x112	data	English	United States	0.5474452554744526
RT_STRING	0x25a2f8	0x172	data	Spanish	Spain	0.4648648648648649
RT_STRING	0x25a46c	0x158	data	French	France	0.4738372093023256
RT_STRING	0x25a5c4	0x162	data	Italian	Italy	0.4830508474576271
RT_STRING	0x25a728	0x154	data	Dutch	Netherlands	0.5029411764705882
RT_STRING	0x25a87c	0x144	data	Polish	Poland	0.5555555555555556
RT_STRING	0x25a9c0	0x142	data	Portuguese	Brazil	0.5093167701863354
RT_STRING	0x25ab04	0x166	data	Russian	Russia	0.5893854748603352
RT_STRING	0x25ac6c	0x192	data	Portuguese	Portugal	0.48258706467661694
RT_STRING	0x25ae00	0x78	data	German	Germany	0.6666666666666666
RT_STRING	0x25ae78	0x70	data	English	United States	0.625
RT_STRING	0x25aee8	0xae	data	Spanish	Spain	0.5919540229885057
RT_STRING	0x25af98	0x86	data	French	France	0.6343283582089553
RT_STRING	0x25b020	0x80	AmigaOS bitmap font "a", 20480 elements, 2nd, 3rd	Italian	Italy	0.6328125
RT_STRING	0x25b0a0	0x88	data	Dutch	Netherlands	0.6691176470588235
RT_STRING	0x25b128	0x96	data	Polish	Poland	0.6866666666666666
RT_STRING	0x25b1c0	0x82	data	Portuguese	Brazil	0.6076923076923076
RT_STRING	0x25b244	0x86	AmigaOS bitmap font "5\0042\0045\004@\004=\004K\0049\004 ", 7428 elements, 2nd, 3rd	Russian	Russia	0.6940298507462687
RT_STRING	0x25b2cc	0x82	data	Portuguese	Portugal	0.6461538461538462
RT_STRING	0x25b350	0x492	data	German	Germany	0.26324786324786326
RT_STRING	0x25b7e4	0x352	data	English	United States	0.30117647058823527
RT_STRING	0x25bb38	0x38a	data	Spanish	Spain	0.2924944812362031
RT_STRING	0x25bec4	0x3ee	data	French	France	0.2823061630218688
RT_STRING	0x25c2b4	0x4a8	0420 Alliant virtual executable not stripped	Italian	Italy	0.27348993288590606
RT_STRING	0x25c75c	0x2f2	data	Dutch	Netherlands	0.3076923076923077
RT_STRING	0x25ca50	0x44c	data	Polish	Poland	0.28909090909090907
RT_STRING	0x25ce9c	0x382	data	Portuguese	Brazil	0.2984409799554566
RT_STRING	0x25d220	0x356	data	Russian	Russia	0.319672131147541
RT_STRING	0x25d578	0x36e	OpenPGP Secret Key	Portuguese	Portugal	0.296127562642369
RT_STRING	0x25d8e8	0x84	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	German	Germany	0.5681818181818182
RT_STRING	0x25d96c	0x84	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	English	United States	0.5681818181818182
RT_STRING	0x25d9f0	0x8a	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	Spanish	Spain	0.5869565217391305
RT_STRING	0x25da7c	0x84	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	French	France	0.5681818181818182
RT_STRING	0x25db00	0x84	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	Italian	Italy	0.5681818181818182
RT_STRING	0x25db84	0x84	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	Dutch	Netherlands	0.5681818181818182
RT_STRING	0x25dc08	0xb4	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	Polish	Poland	0.5888888888888889
RT_STRING	0x25dcbc	0x84	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	Portuguese	Brazil	0.5681818181818182
RT_STRING	0x25dd40	0x84	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	Russian	Russia	0.5681818181818182
RT_STRING	0x25ddc4	0x84	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	Portuguese	Portugal	0.5681818181818182
RT_STRING	0x25de48	0xe8	data	German	Germany	0.625
RT_STRING	0x25df30	0xd8	data	English	United States	0.6018518518518519
RT_STRING	0x25e008	0xf4	data	Spanish	Spain	0.5860655737704918
RT_STRING	0x25e0fc	0xf4	data	French	France	0.5819672131147541
RT_STRING	0x25e1f0	0xde	data	Italian	Italy	0.6216216216216216
RT_STRING	0x25e2d0	0xe0	data	Dutch	Netherlands	0.6071428571428571
RT_STRING	0x25e3b0	0xda	data	Polish	Poland	0.6330275229357798
RT_STRING	0x25e48c	0xee	data	Portuguese	Brazil	0.6050420168067226
RT_STRING	0x25e57c	0x116	data	Russian	Russia	0.6438848920863309
RT_STRING	0x25e694	0xdc	data	Portuguese	Portugal	0.6090909090909091
RT_STRING	0x25e770	0x4b8	data	German	Germany	0.34602649006622516
RT_STRING	0x25ec28	0x374	data	English	United States	0.3778280542986425
RT_STRING	0x25ef9c	0x3c6	data	Spanish	Spain	0.35714285714285715
RT_STRING	0x25f364	0x42a	data	French	France	0.34615384615384615
RT_STRING	0x25f790	0x416	data	Italian	Italy	0.3441682600382409
RT_STRING	0x25fba8	0x44c	data	Dutch	Netherlands	0.33
RT_STRING	0x25fff4	0x428	data	Polish	Poland	0.37218045112781956
RT_STRING	0x26041c	0x394	data	Portuguese	Brazil	0.3548034934497817
RT_STRING	0x2607b0	0x378	data	Russian	Russia	0.4189189189189189
RT_STRING	0x260b28	0x3ce	data	Portuguese	Portugal	0.3480492813141684
RT_STRING	0x260ef8	0x55c	data	German	Germany	0.3629737609329446
RT_STRING	0x261454	0x4e6	data	English	United States	0.33811802232854865
RT_STRING	0x26193c	0x526	data	Spanish	Spain	0.3482549317147193
RT_STRING	0x261e64	0x536	data	French	France	0.3613193403298351
RT_STRING	0x26239c	0x538	data	Italian	Italy	0.34880239520958084
RT_STRING	0x2628d4	0x53e	data	Dutch	Netherlands	0.3502235469448584
RT_STRING	0x262e14	0x4b4	data	Polish	Poland	0.3920265780730897
RT_STRING	0x2632c8	0x4ee	data	Portuguese	Brazil	0.3589540412044374
RT_STRING	0x2637b8	0x4f0	data	Russian	Russia	0.4185126582278481
RT_STRING	0x263ca8	0x4ee	data	Portuguese	Portugal	0.358161648177496
RT_STRING	0x264198	0x1fa	data	German	Germany	0.4762845849802372
RT_STRING	0x264394	0x194	data	English	United States	0.504950495049505
RT_STRING	0x264528	0x1be	data	Spanish	Spain	0.4910313901345291
RT_STRING	0x2646e8	0x1e0	data	French	France	0.49583333333333335
RT_STRING	0x2648c8	0x1ee	data	Italian	Italy	0.4797570850202429
RT_STRING	0x264ab8	0x1a2	data	Dutch	Netherlands	0.5311004784688995
RT_STRING	0x264c5c	0x1e4	data	Polish	Poland	0.5351239669421488
RT_STRING	0x264e40	0x1b6	data	Portuguese	Brazil	0.5091324200913242
RT_STRING	0x264ff8	0x1de	data	Russian	Russia	0.5648535564853556
RT_STRING	0x2651d8	0x1b4	data	Portuguese	Portugal	0.5114678899082569
RT_GROUP_ICON	0x26538c	0x68	data	English	United States	0.7403846153846154
RT_VERSION	0x2653f4	0x2f8	data	English	United States	0.4605263157894737
RT_MANIFEST	0x2656ec	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	LeaveCriticalSection, RaiseException, EnterCriticalSection, GetLastError, MultiByteToWideChar, SizeofResource, LoadResource, FindResourceW, LoadLibraryExW, GetModuleFileNameW, InitializeCriticalSectionEx, DeleteCriticalSection, IsWow64Process, GetCurrentProcess, VerifyVersionInfoW, VerSetConditionMask, GetSystemDirectoryW, CreateFileW, DeviceIoControl, CloseHandle, GetCurrentThreadId, SetLastError, Sleep, DeleteFileW, GlobalFree, LockResource, FindResourceExW, LocalFree, FormatMessageW, LocalAlloc, CallNamedPipeW, GetWindowsDirectoryW, SetCurrentDirectoryW, GetCommandLineW, lstrcmpiW, CreateMutexW, GetNativeSystemInfo, GetDiskFreeSpaceExW, FindFirstFileW, FindClose, CreateProcessW, FindNextFileW, WideCharToMultiByte, GlobalAlloc, GlobalLock, SetThreadUILanguage, LoadLibraryW, CreateDirectoryW, GetLogicalDrives, GetTempPathW, MoveFileExW, InitializeProcThreadAttributeList, UpdateProcThreadAttribute, DeleteProcThreadAttributeList, OpenProcess, ResumeThread, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, K32GetModuleFileNameExW, GetCurrentDirectoryW, GetCurrentProcessId, GetModuleFileNameA, OutputDebugStringW, SetEndOfFile, WriteConsoleW, SetStdHandle, GetProcAddress, GetModuleHandleW, FreeLibrary, GetProcessHeap, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, HeapDestroy, DecodePointer, MulDiv, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetOEMCP, GetACP, IsValidCodePage, GetTimeZoneInformation, ReadConsoleW, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetTimeFormatW, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, GetStringTypeW, FindFirstFileExW, GetFileAttributesW, GetFileAttributesExW, GetFileInformationByHandle, RemoveDirectoryW, AreFileApisANSI, CopyFileW, DuplicateHandle, WaitForSingleObjectEx, SwitchToThread, GetCurrentThread, QueryPerformanceCounter, TryEnterCriticalSection, EncodePointer, InitializeCriticalSectionAndSpinCount, CreateEventW, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetTickCount, CompareStringW, LCMapStringW, GetLocaleInfoW, GetCPInfo, IsDebuggerPresent, InitializeSListHead, InterlockedPopEntrySList, InterlockedPushEntrySList, FlushInstructionCache, IsProcessorFeaturePresent, VirtualAlloc, VirtualFree, SetEvent, ResetEvent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, CreateTimerQueue, SignalObjectAndWait, CreateThread, SetThreadPriority, GetThreadPriority, GetLogicalProcessorInformation, CreateTimerQueueTimer, ChangeTimerQueueTimer, DeleteTimerQueueTimer, GetNumaHighestNodeNumber, GetProcessAffinityMask, SetThreadAffinityMask, RegisterWaitForSingleObject, UnregisterWait, GetThreadTimes, FreeLibraryAndExitThread, GetModuleHandleA, GetVersionExW, ReleaseSemaphore, InterlockedFlushSList, QueryDepthSList, UnregisterWaitEx, RtlUnwind, ExitProcess, GetModuleHandleExW, GetCommandLineA, ExitThread, GetStdHandle, WriteFile, GetFileType, FlushFileBuffers, GetConsoleCP, GetConsoleMode, ReadFile, SetFilePointerEx, GetFileSizeEx, GetDateFormatW
dwmapi.dll	DwmGetWindowAttribute
CRYPT32.dll	CryptMsgClose, CertCloseStore, CertFreeCertificateContext, CertGetNameStringW, CertFindCertificateInStore, CryptMsgGetParam, CryptQueryObject
RPCRT4.dll	UuidToStringW, RpcStringFreeW, UuidCreate

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Russian	Russia
German	Germany
Spanish	Spain
French	France
Italian	Italy
Dutch	Netherlands
Polish	Poland
Portuguese	Brazil
Portuguese	Portugal

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-13T16:42:43.535259+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.12	49717	104.21.7.3	443	TCP
2024-12-13T16:42:44.542927+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.12	49717	104.21.7.3	443	TCP
2024-12-13T16:42:44.542927+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.12	49717	104.21.7.3	443	TCP
2024-12-13T16:42:45.967011+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.12	49719	104.21.7.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 16:42:42.308744907 CET	49717	443	192.168.2.12	104.21.7.3
Dec 13, 2024 16:42:42.308793068 CET	443	49717	104.21.7.3	192.168.2.12
Dec 13, 2024 16:42:42.308871031 CET	49717	443	192.168.2.12	104.21.7.3
Dec 13, 2024 16:42:42.314730883 CET	49717	443	192.168.2.12	104.21.7.3
Dec 13, 2024 16:42:42.314749002 CET	443	49717	104.21.7.3	192.168.2.12
Dec 13, 2024 16:42:43.535162926 CET	443	49717	104.21.7.3	192.168.2.12
Dec 13, 2024 16:42:43.535259008 CET	49717	443	192.168.2.12	104.21.7.3
Dec 13, 2024 16:42:43.545485973 CET	49717	443	192.168.2.12	104.21.7.3
Dec 13, 2024 16:42:43.545504093 CET	443	49717	104.21.7.3	192.168.2.12
Dec 13, 2024 16:42:43.545778990 CET	443	49717	104.21.7.3	192.168.2.12
Dec 13, 2024 16:42:43.591824055 CET	49717	443	192.168.2.12	104.21.7.3
Dec 13, 2024 16:42:43.596429110 CET	49717	443	192.168.2.12	104.21.7.3
Dec 13, 2024 16:42:43.596466064 CET	49717	443	192.168.2.12	104.21.7.3
Dec 13, 2024 16:42:43.596579075 CET	443	49717	104.21.7.3	192.168.2.12
Dec 13, 2024 16:42:44.542813063 CET	443	49717	104.21.7.3	192.168.2.12
Dec 13, 2024 16:42:44.542903900 CET	443	49717	104.21.7.3	192.168.2.12
Dec 13, 2024 16:42:44.543098927 CET	49717	443	192.168.2.12	104.21.7.3
Dec 13, 2024 16:42:44.544280052 CET	49717	443	192.168.2.12	104.21.7.3
Dec 13, 2024 16:42:44.544296980 CET	443	49717	104.21.7.3	192.168.2.12
Dec 13, 2024 16:42:44.544336081 CET	49717	443	192.168.2.12	104.21.7.3
Dec 13, 2024 16:42:44.544342995 CET	443	49717	104.21.7.3	192.168.2.12
Dec 13, 2024 16:42:44.593765020 CET	49719	443	192.168.2.12	104.21.7.3
Dec 13, 2024 16:42:44.593806028 CET	443	49719	104.21.7.3	192.168.2.12
Dec 13, 2024 16:42:44.593904018 CET	49719	443	192.168.2.12	104.21.7.3
Dec 13, 2024 16:42:44.594270945 CET	49719	443	192.168.2.12	104.21.7.3
Dec 13, 2024 16:42:44.594285011 CET	443	49719	104.21.7.3	192.168.2.12
Dec 13, 2024 16:42:45.967010975 CET	49719	443	192.168.2.12	104.21.7.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 16:42:41.995201111 CET	60902	53	192.168.2.12	1.1.1.1
Dec 13, 2024 16:42:42.302823067 CET	53	60902	1.1.1.1	192.168.2.12

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 13, 2024 16:42:41.995201111 CET	192.168.2.12	1.1.1.1	0xc22f	Standard query (0)	cycahao.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 13, 2024 16:42:42.302823067 CET	1.1.1.1	192.168.2.12	0xc22f	No error (0)	cycahao.shop		104.21.7.3	A (IP address)	IN (0x0001)	false
Dec 13, 2024 16:42:42.302823067 CET	1.1.1.1	192.168.2.12	0xc22f	No error (0)	cycahao.shop		172.67.135.139	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cycahao.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49717	104.21.7.3	443	6908	C:\Users\user\Desktop\tOE2mg8TbU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 15:42:43 UTC	259	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cycahao.shop
2024-12-13 15:42:43 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-13 15:42:44 UTC	1010	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 15:42:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9v1jqueg9emegdr1ic3t3a71uf; expires=Tue, 08-Apr-2025 09:29:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VYEqwUiaFIJMu5JOyy3AXgkAzGJ%2FlCDIK4DAaj1dqbxsNxeZXgoI1vFCi7q3gj7d%2FlVrbiLl8PA4RfHX1cDLMigUGRctp2rxkN%2F7bRcIRbtyLG%2FO6Dq9coXbB9ZGHMg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1710d3cc26de9a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1748&min_rtt=1707&rtt_var=669&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=903&delivery_rate=1710603&cwnd=209&unsent_bytes=0&cid=6d84c882c92b7a18&ts=1020&x=0"
2024-12-13 15:42:44 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-13 15:42:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	10:42:27
Start date:	13/12/2024
Path:	C:\Users\user\Desktop\tOE2mg8TbU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\tOE2mg8TbU.exe"
Imagebase:	0x560000
File size:	2'916'584 bytes
MD5 hash:	007C8D6917CB62D9CF8BC921FF92AE93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2580806521.00000000014D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	40.9%
Total number of Nodes:	479
Total number of Limit Nodes:	6

Executed Functions

Function 00581D70 Relevance: 110.3, APIs: 10, Strings: 52, Instructions: 1755synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 005A03A0: ___std_fs_get_temp_path@4.LIBCPMT ref: 005A0457

Part of subcall function 0059CFE0: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0059D05A
Part of subcall function 0059CFE0: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0059D081

GetWindowsDirectoryW.KERNEL32(00000010,00000104,?,?,00000000,?,?,0000000A,?,A7D6A816), ref: 005820E7
SetCurrentDirectoryW.KERNEL32(00000010,?,?,?,?,00000000,?,?,0000000A,?,A7D6A816), ref: 00582114
GetCommandLineW.KERNEL32(?,?,?,000000DA,?,?,?,?,?,?,?,00000000,?,?,0000000A,?), ref: 0058237C
LocalFree.KERNEL32(00000000,?,00000000,?,?,?,?,?,00000000,?,?,0000000A,?,A7D6A816), ref: 005823DE
GetLastError.KERNEL32(000000EF,?,?,?,?,?,?,?,?,?,00000000,?,?,0000000A,?,A7D6A816), ref: 00582676

Part of subcall function 005AC510: FindResourceW.KERNEL32(00000000,?,BINARY), ref: 005AC532
Part of subcall function 005AC510: SizeofResource.KERNEL32(00000000,00000000), ref: 005AC545
Part of subcall function 005AC510: LoadResource.KERNEL32(00000000,00000000), ref: 005AC558
Part of subcall function 005AC510: LockResource.KERNEL32(00000000), ref: 005AC567

CreateMutexW.KERNEL32(00000000,00000001,?,00000000,?,?,00000000,0000012C,?,000000F2,?,00000000), ref: 00582A4D
GetLastError.KERNEL32(?,000000F2,?,00000000,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00582A55
GetNativeSystemInfo.KERNEL32(?,00000145,00000000,0000012C,?,000000F2,?,00000000), ref: 00582CCA
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 005837FF
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00583878

Part of subcall function 005BF3E0: _strftime.LIBCMT ref: 005BF444

Strings

DoInstall complete. Returned: , xrefs: 00583543
Windows Booted Normally., xrefs: 00582F4D
: MBSetup mode : , xrefs: 00582717
Supported language is: , xrefs: 0058307A
P~d, xrefs: 0058301A
~d, xrefs: 0058342F
: Problem saving state of create-desktop-icon option, xrefs: 0058360A
Windows Booted in Directory Services Restore/Repair Mode., xrefs: 00582F80
dtopicon, xrefs: 00583500
pb, xrefs: 00583797
~d, xrefs: 005833F4
unins000.exe, xrefs: 005824BB
32 Bit Processor. , xrefs: 00582F18
#32770, xrefs: 00582B70
2061, xrefs: 0058343D
: CommandLineToArgvW failed: , xrefs: 00582668
[MB5 migration check] Privacy VPN is installed, xrefs: 00582E0C
SOFTWARE\Malwarebytes\mbam, xrefs: 005834CA
mbuns.exe, xrefs: 00582495
===== Install finished (, xrefs: 005836A2
P~d, xrefs: 0058308D
uninstalling, xrefs: 0058272F
=====, xrefs: 00582018, 005836F2
: MBSetup version 5.1.8.108, xrefs: 00582C53
[MB5 migration check] OK to proceed with MB5 migration, xrefs: 00582E38
Error obtaining mutex, installing , xrefs: 00582ABF
%hu.%hu.%hu.%hu, xrefs: 005831CD
mbsetup.log, xrefs: 00581DD4
X|d, xrefs: 0058293E
Parsing Command Line: , xrefs: 00582284
Windows Booted in Safe Mode with Networking., xrefs: 00582F6F
: Uninstall implied by filename, xrefs: 00582522
2060, xrefs: 00583410
Malwarebytes, xrefs: 00582B6B
Windows Booted in Safe Mode., xrefs: 00582F5E
[MB5 migration check] Prerequisie check failed, xrefs: 00582DAA
installing, xrefs: 0058272A
64 Bit Processor. , xrefs: 00582F13
32 Bit Process. , xrefs: 00582F32
===== Install started , xrefs: 00581FE7
H}d, xrefs: 00582224
%s - can't run on ARM, xrefs: 00583289
|d, xrefs: 00583644
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp, xrefs: 00582140, 00582D07, 00582D4A, 00582E03, 00583573
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp, xrefs: 00582254, 005824FE, 00582644, 005826F3, 00582883, 00582A8F, 00582C2F, 00582EDC, 0058304A, 005832E9, 005835E6
[MB5 migration check] Error getting installation directory, xrefs: 00582D40
: setting working directory to ', xrefs: 00582164
: This is an ONLINE installer build., xrefs: 005828A7
Unknown Windows Boot Mode #, xrefs: 00582F91
-useDevEndpoints, xrefs: 00583591
Doing MB5 migration checks., xrefs: 00582CFD
unknown, xrefs: 005831E3

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Resource$DirectoryErrorIos_base_dtorLast___std_fs_convert_narrow_to_wide@20std::ios_base::_$CommandCreateCurrentFindFreeInfoLineLoadLocalLockMutexNativeSizeofSystemWindows___std_fs_get_temp_path@4_strftime
String ID: -useDevEndpoints$ ~d$ ~d$#32770$%hu.%hu.%hu.%hu$%s - can't run on ARM$2060$2061$32 Bit Process. $32 Bit Processor. $64 Bit Processor. $: CommandLineToArgvW failed: $: MBSetup mode : $: MBSetup version 5.1.8.108$: Problem saving state of create-desktop-icon option$: This is an ONLINE installer build.$: Uninstall implied by filename$: setting working directory to '$=====$===== Install finished ($===== Install started $DoInstall complete. Returned: $Doing MB5 migration checks.$Error obtaining mutex, installing $H}d$Malwarebytes$Parsing Command Line: $P~d$P~d$SOFTWARE\Malwarebytes\mbam$Supported language is: $Unknown Windows Boot Mode #$Windows Booted Normally.$Windows Booted in Directory Services Restore/Repair Mode.$Windows Booted in Safe Mode with Networking.$Windows Booted in Safe Mode.$X|d$[MB5 migration check] Error getting installation directory$[MB5 migration check] OK to proceed with MB5 migration$[MB5 migration check] Prerequisie check failed$[MB5 migration check] Privacy VPN is installed$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp$dtopicon$installing$mbsetup.log$mbuns.exe$pb$unins000.exe$uninstalling$unknown$|d
API String ID: 1638454356-306563725
Opcode ID: f14d32b6e3e09593d3b6d2b69ec0071651c004f5560b3e58de68fceaf7a76d48
Instruction ID: 0fe9d1790c14f801f198ca6105634e52b7219b4162b75d6966a0aa0ce13f7402
Opcode Fuzzy Hash: f14d32b6e3e09593d3b6d2b69ec0071651c004f5560b3e58de68fceaf7a76d48
Instruction Fuzzy Hash: 4FE2D170A002158BDF14EB24DC59BAE7FB6BFC5304F1485A8E449A7296EF349E80CF91

Function 005A0310 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 005A038D

Part of subcall function 005E66D1: RaiseException.KERNEL32(?,?,?,?), ref: 005E6731

___std_fs_get_temp_path@4.LIBCPMT ref: 005A0457

Strings

ing the license, xrefs: 005A0581
temp_directory_path, xrefs: 005A0359
Welcome, xrefs: 005A06D3

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow___std_fs_get_temp_path@4
String ID: Welcome$ing the license$temp_directory_path
API String ID: 3877970357-3765240513
Opcode ID: af73a53976c051da4e82be44310f47015fef20ce694ed932d7af47faff3e61dd
Instruction ID: c060f40fe406fc7080f2d2d382e26ca6be8bc9eb18034ff75893c56167217d3c
Opcode Fuzzy Hash: af73a53976c051da4e82be44310f47015fef20ce694ed932d7af47faff3e61dd
Instruction Fuzzy Hash: DFC1F231A103059BCB20EF64DC47BAEBBA5FBC9710F00561AF846962C0DBB5A954CBA1

Function 0059D0F0 Relevance: 8.0, APIs: 1, Strings: 4, Instructions: 455
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(?,0004EA04,3C442D4A,?,?,?,?,?,?,?,?,?,00612FD9,000000FF), ref: 0059D789

Strings

J-D<, xrefs: 0059D3BB
B'y, xrefs: 0059D174
}oEu, xrefs: 0059D0FA
H&UN, xrefs: 0059D5BE

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: AllocVirtual
String ID: B'y$H&UN$J-D<$}oEu
API String ID: 4275171209-190170407
Opcode ID: 5d1117315f8d33c5e51c3c579eca432ab20d94d68c939cc85f37a5e820e589d8
Instruction ID: 1b8d7079d97ddf172849380f158f84930c24194393b764e358cc46a794f3a034
Opcode Fuzzy Hash: 5d1117315f8d33c5e51c3c579eca432ab20d94d68c939cc85f37a5e820e589d8
Instruction Fuzzy Hash: 01F1163ED567218FDBC8DF75EC9A52A3A63BBC2320346A13AD40697765DF385401CA81

Function 0059D150 Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 430
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(?,0004EA04,3C442D4A,?,?,?,?,?,?,?,?,?,00612FD9,000000FF), ref: 0059D789

Strings

J-D<, xrefs: 0059D3BB
B'y, xrefs: 0059D174
H&UN, xrefs: 0059D5BE

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: AllocVirtual
String ID: B'y$H&UN$J-D<
API String ID: 4275171209-2042745134
Opcode ID: 59b87cff4cdee91c1756d9e021cf650aa4a55b19f417b65d8e3493d35a0f1a75
Instruction ID: cb5d22d7ccb77a22291ea7c09cad77c01ec95496fcbdaefee92a7172aceec016
Opcode Fuzzy Hash: 59b87cff4cdee91c1756d9e021cf650aa4a55b19f417b65d8e3493d35a0f1a75
Instruction Fuzzy Hash: 85E1253ED567218FDBC8EF75EC9A52A3E63BBC2320346A13AD40697765DF384401CA81

Function 0059D800 Relevance: .3, Instructions: 261
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8690675141fea246aa066469973d291aaf0464a2aba4c940e9a220720c2f5828
Instruction ID: 08ecf76caa389ae552152d406d742f536993979050f8c26e84c633b6490c5af2
Opcode Fuzzy Hash: 8690675141fea246aa066469973d291aaf0464a2aba4c940e9a220720c2f5828
Instruction Fuzzy Hash: E7A1047AD123158FDB88DF78EC891A97FB3FB86324705A13AD846A7721DB355801CB90

Function 005A03A0 Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_fs_get_temp_path@4.LIBCPMT ref: 005A0457

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ___std_fs_get_temp_path@4
String ID:
API String ID: 3101398632-0
Opcode ID: bfc63926b0b205d9d6372992e785cf82847d56ebbddfe3199947e26f8cd4c647
Instruction ID: c2f5ccd45eaa3a74094979224a997a1a72d0d81fc93bc964a1a74cfae20ef02d
Opcode Fuzzy Hash: bfc63926b0b205d9d6372992e785cf82847d56ebbddfe3199947e26f8cd4c647
Instruction Fuzzy Hash: F841A671A103059BDB20AF69CC0BBAFBFB5FB85710F10051AE815973C1D7B55904CBA5

Non-executed Functions

Function 005885C0 Relevance: 69.6, APIs: 1, Strings: 44, Instructions: 2126sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00563AB0: GetProcessHeap.KERNEL32 ref: 00563AF1
Part of subcall function 00563AB0: __Init_thread_footer.LIBCMT ref: 00563B1C
Part of subcall function 00563AB0: __Init_thread_footer.LIBCMT ref: 00563B9A

Sleep.KERNEL32(000003E8,?,000006C3,?,00000001,00000000,00000010), ref: 0058A435

Strings

~d, xrefs: 005889B6
~d, xrefs: 005889DF
: Warning - This computer appears to be missing patch KB4474419, xrefs: 00589F39
Malwarebytes Anti-Malware, xrefs: 005893BB
We have detected , xrefs: 00588DF5
Failed to download and run offline installer, xrefs: 0058A4DA
https://links.malwarebytes.com/support/general/business/ms-2019-09-security-update, xrefs: 0058A009, 0058A011, 0058A017
\data, xrefs: 0058882A
: User chose to continue the installation, xrefs: 00589D27
%s - prerequisite failure MissingSHA2CodeSigningSupportPatch, xrefs: 00589F9F
event_properties, xrefs: 0058A365
the installation of Malwarebytes. Please click Yes to find out how to safely install Malwarebytes. You can click No to proceed wit, xrefs: 00588E21
installed on your computer. This product may interfere with , xrefs: 00588E08
%s - can't install ARW over MBAM 3.0 or newer, xrefs: 00589485
: Exit due to missing SHA-2 code signing support patch (KB4474419), xrefs: 0058A08F
%s - can't install over business products, xrefs: 00589153
: MB Teams / MDAM-B implied by filename or cmd line option, xrefs: 0058993E
%s - prerequisite failure %s, xrefs: 00589B1D
NCEP-WIN, xrefs: 005898C0
: Error - could not create data directory. Error: , xrefs: 00588AC6
Malwarebytes Installer, xrefs: 00588EF2
~d, xrefs: 005887B8
: Error - could not create install directory. Error: , xrefs: 0058894D
: Not showing BrowserGuard screen, xrefs: 0058A1CB
https://links.malwarebytes.com/support/installer/AVBlocking, xrefs: 00588DC5
: User chose to cancel the installation, xrefs: 00589C92, 00589DF9
Close Installer, xrefs: 0058A2F8
lastScreenShown, xrefs: 0058A38B
: Pre-check(s) failed but in silent mode - will try to continue the installation, xrefs: 005899D0
https://links.malwarebytes.com/support/mb/windows/system-requirements, xrefs: 0058A004
MBAM-C, xrefs: 005898B4, 005898C5
undefined (%d), xrefs: 00589AEF
V\, xrefs: 005888BE
%s - can't install over MBAM 2.x or earlier, xrefs: 005895F7
: Displaying User Interface, xrefs: 0058A150
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp, xrefs: 0058A23C
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp, xrefs: 005886D3, 00588929, 00588AA2, 00588C5A, 005891B3, 005894E5, 00589657, 0058991A, 005899AC, 00589B95, 00589C6E, 00589D03, 00589DD5, 00589E7E, 00589F15, 0058A06B, 0058A12C, 0058A1A7
%s - could not determine install and/or data directories, xrefs: 00588673
MBAM-C, xrefs: 00588B3B, 005890B7
changing service install status code from %u to %d, xrefs: 0058A228
Malwarebytes.exe, xrefs: 00589AAD
event_type, xrefs: 0058A30B
%s - unsupported operating system, xrefs: 00588BFA
: All installation pre-checks passed, xrefs: 00589EA2

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Init_thread_footer$HeapProcessSleep
String ID: installed on your computer. This product may interfere with $%s - can't install ARW over MBAM 3.0 or newer$%s - can't install over MBAM 2.x or earlier$%s - can't install over business products$%s - could not determine install and/or data directories$%s - prerequisite failure %s$%s - prerequisite failure MissingSHA2CodeSigningSupportPatch$%s - unsupported operating system$: All installation pre-checks passed$: Displaying User Interface$: Error - could not create data directory. Error: $: Error - could not create install directory. Error: $: Exit due to missing SHA-2 code signing support patch (KB4474419)$: MB Teams / MDAM-B implied by filename or cmd line option$: Not showing BrowserGuard screen$: Pre-check(s) failed but in silent mode - will try to continue the installation$: User chose to cancel the installation$: User chose to continue the installation$: Warning - This computer appears to be missing patch KB4474419$Close Installer$Failed to download and run offline installer$MBAM-C$MBAM-C$Malwarebytes Anti-Malware$Malwarebytes Installer$Malwarebytes.exe$NCEP-WIN$V\$We have detected $\data$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp$changing service install status code from %u to %d$event_properties$event_type$https://links.malwarebytes.com/support/general/business/ms-2019-09-security-update$https://links.malwarebytes.com/support/installer/AVBlocking$https://links.malwarebytes.com/support/mb/windows/system-requirements$lastScreenShown$the installation of Malwarebytes. Please click Yes to find out how to safely install Malwarebytes. You can click No to proceed wit$undefined (%d)$~d$~d$~d
API String ID: 733474400-1122280409
Opcode ID: f7b76d4657f01bc5f36e70eed1bde8eb32053b56f339a19c4457e16acc9c0be2
Instruction ID: 8291b0fd4f4a8f62f4f38d1980b48cfb887b5050b1b36fc17f1798b97e7bb59f
Opcode Fuzzy Hash: f7b76d4657f01bc5f36e70eed1bde8eb32053b56f339a19c4457e16acc9c0be2
Instruction Fuzzy Hash: 5E03E370E012498BEF14EB74DC59BAE7FB2BF81304F5445A8E405AB292DF749E44CB62

Function 00591970 Relevance: 60.8, APIs: 3, Strings: 31, Instructions: 1290COMMON

Download Yara Rule

Strings

: profilePath: , xrefs: 00592A02
: Found Chrome Ext Folder, xrefs: 00591F2D
: Edge Ext Folder not found - prompt to install BG, xrefs: 00592535
: Found Edge Ext Folder, xrefs: 0059265C
\Profiles\*, xrefs: 005927FA
\Microsoft\Edge\User Data\Default\Extensions\ihcjicgdanjaechkgeegckofjjedodee, xrefs: 00592213
SOFTWARE\Microsoft\Edge\Extensions\bojobppfploabceghnmlahpoonbcbacn, xrefs: 00592162, 00592180
\Mozilla\Firefox, xrefs: 005927AB
MBRW-B, xrefs: 005919B4
: Chrome Ext Folder: , xrefs: 00591D28
\Google\Chrome\User Data\Default\Extensions\ihcjicgdanjaechkgeegckofjjedodee, xrefs: 00591CC0
: BrowserGuard extension key for chrome already exists., xrefs: 00591C64
: Chrome Ext Folder not found - prompt to install BG, xrefs: 00591E54
: Edge Ext Folder (2): , xrefs: 00592354
4b, xrefs: 00592860
8b, xrefs: 005928A3
\Profiles\, xrefs: 005928E3
: Checking BG for Firefox: , xrefs: 0059271E
{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi, xrefs: 00592931
: Checking BG for Chrome: , xrefs: 00591ADC
SOFTWARE\Microsoft\Edge\Extensions\ihcjicgdanjaechkgeegckofjjedodee, xrefs: 00592126, 00592144
: BrowserGuard ext for Firefox already exists., xrefs: 00592B30
\extensions\, xrefs: 00592922
: BrowserGuard extension key for Edge already exists., xrefs: 005921EA
: Firefox Ext not found - prompt to install BG, xrefs: 00592AC1
SOFTWARE\Google\Chrome\Extensions\ihcjicgdanjaechkgeegckofjjedodee, xrefs: 00591BDC, 00591BFA
MBAM-C, xrefs: 005919A8, 005919C0
\Microsoft\Edge\User Data\Default\Extensions\bojobppfploabceghnmlahpoonbcbacn, xrefs: 00592229
: Checking BG for Edge: , xrefs: 00592033
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp, xrefs: 00591AB8, 00591C40, 00591D04, 00591E30, 00591F09, 0059200F, 005921C6, 00592271, 00592330, 00592511, 00592638, 005926FA, 005929DE, 00592A9D, 00592B0C
: Edge Ext Folder: , xrefs: 00592295

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID: 4b$8b$: BrowserGuard ext for Firefox already exists.$: BrowserGuard extension key for Edge already exists.$: BrowserGuard extension key for chrome already exists.$: Checking BG for Chrome: $: Checking BG for Edge: $: Checking BG for Firefox: $: Chrome Ext Folder not found - prompt to install BG$: Chrome Ext Folder: $: Edge Ext Folder (2): $: Edge Ext Folder not found - prompt to install BG$: Edge Ext Folder: $: Firefox Ext not found - prompt to install BG$: Found Chrome Ext Folder$: Found Edge Ext Folder$: profilePath: $MBAM-C$MBRW-B$SOFTWARE\Google\Chrome\Extensions\ihcjicgdanjaechkgeegckofjjedodee$SOFTWARE\Microsoft\Edge\Extensions\bojobppfploabceghnmlahpoonbcbacn$SOFTWARE\Microsoft\Edge\Extensions\ihcjicgdanjaechkgeegckofjjedodee$\Google\Chrome\User Data\Default\Extensions\ihcjicgdanjaechkgeegckofjjedodee$\Microsoft\Edge\User Data\Default\Extensions\bojobppfploabceghnmlahpoonbcbacn$\Microsoft\Edge\User Data\Default\Extensions\ihcjicgdanjaechkgeegckofjjedodee$\Mozilla\Firefox$\Profiles\$\Profiles\*$\extensions\$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp${242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi
API String ID: 0-3323187198
Opcode ID: e120da7a29dcf1f6a62d63c9835679d4ff1a9baffc64f7321b36388a3738da59
Instruction ID: cece2afcc2487f5b603da51cb556b80286d8f2883009b7b780fcfe23a24a9ad1
Opcode Fuzzy Hash: e120da7a29dcf1f6a62d63c9835679d4ff1a9baffc64f7321b36388a3738da59
Instruction Fuzzy Hash: 4DA2F570E002569BDF08EB74EC9AB9D7F77BFC5304F5444A8E005AB296EA349B44CB61

Function 00592C10 Relevance: 54.3, APIs: 5, Strings: 25, Instructions: 1813sleepprocessCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000009C4,?,https://ark.mwbsys.com/bgext,0000001C,?,?,?,?,?,?,?,00000E24,?,?,?,00000E20), ref: 005939D6
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,00000E20,00000E50,?,?,?,000000B0), ref: 00593F90
GetLastError.KERNEL32(?,?,?,000000B0,?,?,?,?,00000E44,?,00000E38,?), ref: 00593F9E
CloseHandle.KERNEL32(?,00000E58,?,?,?,?,?,000000B0,?,?,?,?,00000E44,?,00000E38,?), ref: 00594201
CloseHandle.KERNEL32(?,?,?,?,?,?,000000B0,?,?,?,?,00000E44,?,00000E38,?), ref: 00594209

Part of subcall function 005BF3E0: _strftime.LIBCMT ref: 005BF444

Strings

firefox.exe, xrefs: 00592D4F
: Found firefox installed, xrefs: 0059387E
: Successfully launched firefox to install BrowserGuard extension., xrefs: 00594101
: Firefox not found, skipping BrowserGuard extension for firefox., xrefs: 00594570
{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi, xrefs: 00593904
: Launching firefox.exe to install BrowserGuard extension, xrefs: 00593BF8
: FF Cmd: , xrefs: 00593E72
" -install -extension ", xrefs: 00593C65
: Could not find: , xrefs: 0059436E
msedge.exe, xrefs: 00592D85
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00592C67
cmd.exe /C timeout /t 1 & , xrefs: 00593D88
Mozilla Firefox, xrefs: 00592D3D
Microsoft Edge, xrefs: 00592D73
CreateProcess failed: , xrefs: 00594000
: Failed to download BrowserGuard extension, xrefs: 0059447C
: Trying to download BrowserGuard extension, xrefs: 00593A23
https://ark.mwbsys.com/bgext, xrefs: 00593980
chrome.exe, xrefs: 00592D6A
InstallLocation, xrefs: 0059309C
: Installing BrowserGuard extension for firefox, xrefs: 005937AC
: Successfully downloaded BrowserGuard extension, xrefs: 00593B42
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp, xrefs: 00593788, 0059385A, 005939FF, 00593B1E, 00593BD4, 00593E4E, 00593FD0, 005940DD, 0059417C, 0059434A, 00594458, 0059454C
Google Chrome, xrefs: 00592D58
: Failed to launch firefox to install BrowserGuard extension., xrefs: 005941A0

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: CloseHandle$CreateErrorLastProcessSleep_strftime
String ID: " -install -extension "$: Could not find: $: FF Cmd: $: Failed to download BrowserGuard extension$: Failed to launch firefox to install BrowserGuard extension.$: Firefox not found, skipping BrowserGuard extension for firefox.$: Found firefox installed$: Installing BrowserGuard extension for firefox$: Launching firefox.exe to install BrowserGuard extension$: Successfully downloaded BrowserGuard extension$: Successfully launched firefox to install BrowserGuard extension.$: Trying to download BrowserGuard extension$CreateProcess failed: $Google Chrome$InstallLocation$Microsoft Edge$Mozilla Firefox$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp$chrome.exe$cmd.exe /C timeout /t 1 & $firefox.exe$https://ark.mwbsys.com/bgext$msedge.exe${242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi
API String ID: 3418262120-2037496714
Opcode ID: 38c64d74f5418f202f36c8ebd53b60af0ca8d638ff05b75f717adacdcca5a09d
Instruction ID: 1ec955ec56213643cf40f9e19754085714312889c0d68c6fa1c696c9cebc89a0
Opcode Fuzzy Hash: 38c64d74f5418f202f36c8ebd53b60af0ca8d638ff05b75f717adacdcca5a09d
Instruction Fuzzy Hash: 7FE214B1E001598BDF18DB64DC8DB9D7B76BBC4304F1085A8E109AB296EB34AF85CF54

Function 00586149 Relevance: 50.6, APIs: 1, Strings: 32, Instructions: 1053
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005BF3E0: _strftime.LIBCMT ref: 005BF444

GetLastError.KERNEL32(000003E3,00000000), ref: 00586608

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootInProgress, xrefs: 00586BCD
calling RegDeleteKeyW, xrefs: 00587882
SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending, xrefs: 00586B9A
' exists, xrefs: 00586E9C
calling RegOpenKeyEx, xrefs: 00587963
MBAMFarflt, xrefs: 00586463
Debugger, xrefs: 005876DF
: Error RegQueryInfoKeyW: , xrefs: 005861EE
: Error , xrefs: 0058786E, 005878E0, 0058794F
MBAMSwissArmy, xrefs: 005864C9
MBAMInstallerService.exe, xrefs: 005875B5
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 00587616
MBAMInstallerService, xrefs: 00586384
: HKLM subkey ', xrefs: 00586E78
: Found IFEO key, trying to delete: , xrefs: 0058774F
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired, xrefs: 00586B4A
ESProtectionDriver, xrefs: 0058652C
MBAMService, xrefs: 005863CA
MBAMWebProtection, xrefs: 00586430
' has subkeys, xrefs: 00586F6E
: OpenSCManager failed: , xrefs: 005865FA
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp, xrefs: 005861CA, 005865D6, 00586CF8, 00586E54, 00586F32, 0058772B, 005877FD, 0058784A, 005878BC, 0058792B
MBAMProtection, xrefs: 005863FD
MBAMChameleon, xrefs: 00586496
MBAMElam, xrefs: 005864FC
: Error RegOpenKeyEx: , xrefs: 00586D1C
Malwarebytes.exe, xrefs: 0058754F
: HKLM key ', xrefs: 00586F56
MBAMService.exe, xrefs: 00587586
SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Services\Pending, xrefs: 00586DAD, 00586F62
calling RegQueryValueEx, xrefs: 005878F4
: Successfully deleted IFEO key, xrefs: 00587821

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast_strftime
String ID: calling RegDeleteKeyW$ calling RegOpenKeyEx$ calling RegQueryValueEx$' exists$' has subkeys$: Error $: Error RegOpenKeyEx: $: Error RegQueryInfoKeyW: $: Found IFEO key, trying to delete: $: HKLM key '$: HKLM subkey '$: OpenSCManager failed: $: Successfully deleted IFEO key$Debugger$ESProtectionDriver$MBAMChameleon$MBAMElam$MBAMFarflt$MBAMInstallerService$MBAMInstallerService.exe$MBAMProtection$MBAMService$MBAMService.exe$MBAMSwissArmy$MBAMWebProtection$Malwarebytes.exe$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootInProgress$SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending$SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired$SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Services\Pending$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp
API String ID: 1231846183-320866538
Opcode ID: be3767a0ce681fcc9186ee458939104299de2c596c44c64fea3fef56b273c90d
Instruction ID: 89cd55f6ca30ebf438a74ece7bfb235743ec8fc004de7c4f556a9febad6ca016
Opcode Fuzzy Hash: be3767a0ce681fcc9186ee458939104299de2c596c44c64fea3fef56b273c90d
Instruction Fuzzy Hash: B882A470E002599BDF14EFA4DC4AB9EBFB2FF85304F1045A8E509AB382DB749A44CB55

Function 005AFA70 Relevance: 46.5, APIs: 2, Strings: 24, Instructions: 1020
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00563AB0: GetProcessHeap.KERNEL32 ref: 00563AF1
Part of subcall function 00563AB0: __Init_thread_footer.LIBCMT ref: 00563B1C
Part of subcall function 00563AB0: __Init_thread_footer.LIBCMT ref: 00563B9A

GetCurrentProcessId.KERNEL32 ref: 005AFADE

Part of subcall function 005AE990: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00000001), ref: 005AE9AD
Part of subcall function 005AE990: Process32FirstW.KERNEL32(00000000,0000022C), ref: 005AE9E5
Part of subcall function 005AE990: Process32NextW.KERNEL32(00000000,0000022C), ref: 005AEA05
Part of subcall function 005AE990: CloseHandle.KERNEL32(00000000), ref: 005AEA0E

Part of subcall function 005AEA80: OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 005AEAF8
Part of subcall function 005AEA80: K32GetModuleFileNameExW.KERNEL32(00000000,00000000,?,00000104), ref: 005AEB53
Part of subcall function 005AEA80: CloseHandle.KERNEL32(00000000), ref: 005AEB90

Part of subcall function 005AEE40: CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,00000000,?,?,?,?,00000000), ref: 005AEF10
Part of subcall function 005AEE40: CryptMsgGetParam.CRYPT32(00000000,00000006,00000000,00000000,?), ref: 005AEF41
Part of subcall function 005AEE40: CryptMsgGetParam.CRYPT32(00000000,00000006,00000000,00000000,00000000), ref: 005AEF6B
Part of subcall function 005AEE40: CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,?,00000000), ref: 005AEFB9

Part of subcall function 005EA50D: _free.LIBCMT ref: 005EA520

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,0000000F,00000010,?,?,00000000), ref: 005B074D

Part of subcall function 005B7C10: __CxxThrowException@8.LIBVCRUNTIME ref: 005B7D64

Strings

c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\setuputils.cpp, xrefs: 005AFB25, 005AFB7C
callerSignatureName, xrefs: 005B0171
user_properties, xrefs: 005B0341, 005B04FD, 005B059F, 005B066B
ChannelSource, xrefs: 005B05E1
PathName, xrefs: 005B0849
~d, xrefs: 005B04EB
Signer name is '%s', xrefs: 005AFB63
FileVersion, xrefs: 005B09D0
$set, xrefs: 005B0355, 005B05B3, 005B067F
InitialChannelSource, xrefs: 005B053F
webGUID, xrefs: 005B0421
Start Installer, xrefs: 005AFEF7
~d, xrefs: 005B049F
72X, xrefs: 005AFA7D
AffiliateID, xrefs: 005B06AD
5.1.8.108, xrefs: 005B09B3
Parent pathname is '%s', xrefs: 005AFB12
$setOnce, xrefs: 005B0511
event_type, xrefs: 005AFF0A
callerApplication, xrefs: 005B0041
~d, xrefs: 005B0659
event_properties, xrefs: 005AFF6E, 005B009B, 005B01CB, 005B0793, 005B0934
commandLine, xrefs: 005B02A1
8~d, xrefs: 005B032F

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: CryptProcess$CloseFileHandleInit_thread_footerModuleNameParamProcess32$CertCertificateCreateCurrentException@8FindFirstHeapNextObjectOpenQuerySnapshotStoreThrowToolhelp32_free
String ID: ~d$ ~d$ ~d$$set$$setOnce$5.1.8.108$72X$8~d$AffiliateID$ChannelSource$FileVersion$InitialChannelSource$Parent pathname is '%s'$PathName$Signer name is '%s'$Start Installer$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\setuputils.cpp$callerApplication$callerSignatureName$commandLine$event_properties$event_type$user_properties$webGUID
API String ID: 3981520396-3114603661
Opcode ID: cb2143828e35b264ba2697a60292ba5f7d2fc37565ad30c2b7e9401b165ed9c0
Instruction ID: 6a6839f6b176c96bca8a3766cc9a3da6006db341833380a7fd41d731d883af3d
Opcode Fuzzy Hash: cb2143828e35b264ba2697a60292ba5f7d2fc37565ad30c2b7e9401b165ed9c0
Instruction Fuzzy Hash: 70A25B70D002599FDB26DB24C859BDDBBB5BF9A300F1481D9E488A7292DB706F84CF91

Function 005B4E00 Relevance: 34.3, APIs: 5, Strings: 14, Instructions: 1006COMMON

Download Yara Rule

APIs

Part of subcall function 00563AB0: GetProcessHeap.KERNEL32 ref: 00563AF1
Part of subcall function 00563AB0: __Init_thread_footer.LIBCMT ref: 00563B1C
Part of subcall function 00563AB0: __Init_thread_footer.LIBCMT ref: 00563B9A

GetCurrentProcessId.KERNEL32 ref: 005B510B

Part of subcall function 005AEA80: OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 005AEAF8
Part of subcall function 005AEA80: K32GetModuleFileNameExW.KERNEL32(00000000,00000000,?,00000104), ref: 005AEB53
Part of subcall function 005AEA80: CloseHandle.KERNEL32(00000000), ref: 005AEB90

Part of subcall function 005AEE40: CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,00000000,?,?,?,?,00000000), ref: 005AEF10
Part of subcall function 005AEE40: CryptMsgGetParam.CRYPT32(00000000,00000006,00000000,00000000,?), ref: 005AEF41
Part of subcall function 005AEE40: CryptMsgGetParam.CRYPT32(00000000,00000006,00000000,00000000,00000000), ref: 005AEF6B
Part of subcall function 005AEE40: CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,?,00000000), ref: 005AEFB9

_wcsstr.LIBVCRUNTIME ref: 005B526C
_wcsstr.LIBVCRUNTIME ref: 005B53C0

Part of subcall function 00563C20: __CxxThrowException@8.LIBVCRUNTIME ref: 00563C36

GetCurrentProcessId.KERNEL32(A7D6A816,00647C88,?), ref: 005B56AE

Part of subcall function 005AE990: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00000001), ref: 005AE9AD
Part of subcall function 005AE990: Process32FirstW.KERNEL32(00000000,0000022C), ref: 005AE9E5
Part of subcall function 005AE990: Process32NextW.KERNEL32(00000000,0000022C), ref: 005AEA05
Part of subcall function 005AE990: CloseHandle.KERNEL32(00000000), ref: 005AEA0E

_wcsstr.LIBVCRUNTIME ref: 005B582B

Strings

Malwarebytes, xrefs: 005B5266, 005B53BA, 005B5825
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\setuputils.cpp, xrefs: 005B4EA1, 005B4EEA, 005B4FD7, 005B501F, 005B5414, 005B54D6, 005B5590, 005B55AB, 005B572C, 005B5893, 005B58AE
mbupdatr.exe, xrefs: 005B584F
failed to get pathname for process 0x%08X, xrefs: 005B5009
support tool is *not* calling us, xrefs: 005B55A1
failed to get info for process 0x%08X, xrefs: 005B54C0, 005B557A
Failed to query parent process, xrefs: 005B5722
mb-support.exe, xrefs: 005B5291, 005B53F5
This is not an automatic MB4 migration, xrefs: 005B58A4
This is an automatic MB4 migration, xrefs: 005B5889
signer name for process 0x%08X is '%s', xrefs: 005B4ED6
failed to get signer name for process 0x%08X, xrefs: 005B4FC1
support tool *is* calling us, xrefs: 005B540F
pathname for process 0x%08X is '%s', xrefs: 005B4E8E

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Process$Crypt_wcsstr$CloseCurrentHandleInit_thread_footerParamProcess32$CertCertificateCreateException@8FileFindFirstHeapModuleNameNextObjectOpenQuerySnapshotStoreThrowToolhelp32
String ID: Failed to query parent process$Malwarebytes$This is an automatic MB4 migration$This is not an automatic MB4 migration$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\setuputils.cpp$failed to get info for process 0x%08X$failed to get pathname for process 0x%08X$failed to get signer name for process 0x%08X$mb-support.exe$mbupdatr.exe$pathname for process 0x%08X is '%s'$signer name for process 0x%08X is '%s'$support tool *is* calling us$support tool is *not* calling us
API String ID: 1363576648-451856012
Opcode ID: 867f544d02fab213589f1cf3656ddc0db6b5fa9499517ebe8555e9c0cde0c699
Instruction ID: 030d75e1a4c1ac9989566e7edf4fa3f2c73e072b78f060699d85f9478c316f39
Opcode Fuzzy Hash: 867f544d02fab213589f1cf3656ddc0db6b5fa9499517ebe8555e9c0cde0c699
Instruction Fuzzy Hash: A072F8719005059FDB08DFA8D849BEEBFB6FF85314F148168E405AB392EB35AE44CB91

Function 005A4010 Relevance: 23.4, APIs: 8, Strings: 5, Instructions: 644threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0064CA84,A7D6A816,?,00000000), ref: 005A40A7
GetCurrentThreadId.KERNEL32 ref: 005A40B3
LeaveCriticalSection.KERNEL32(0064CA84,?,?,?,?,?,00000000), ref: 005A412A
MulDiv.KERNEL32(00000320,00000064), ref: 005A419E
MulDiv.KERNEL32(000001F8,00000064), ref: 005A41B5
DwmGetWindowAttribute.DWMAPI(?,00000009,?,00000010), ref: 005A4324
EnterCriticalSection.KERNEL32(0064CA84), ref: 005A46C2
LeaveCriticalSection.KERNEL32(00000000), ref: 005A472A

Part of subcall function 005EA50D: _free.LIBCMT ref: 005EA520

Strings

After message loop. Returned: %d, xrefs: 005A468A
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp, xrefs: 005A4597, 005A46A0
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp, xrefs: 005A43CC
: Detected DWM margins { , xrefs: 005A43F0
unable to center main window, xrefs: 005A458D

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AttributeCurrentThreadWindow_free
String ID: : Detected DWM margins { $After message loop. Returned: %d$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp$unable to center main window
API String ID: 3330004619-3969403291
Opcode ID: 3f0b526fd80ff6a21faea7a7cb709f4c05cbc0119b65cac6c9bf43cc7628cc35
Instruction ID: e051ebb7035bfe19c7b55d33339924f0ebc3f72d6613d585b5a747bac5d9af01
Opcode Fuzzy Hash: 3f0b526fd80ff6a21faea7a7cb709f4c05cbc0119b65cac6c9bf43cc7628cc35
Instruction Fuzzy Hash: C9427371E0021A9FDB14DFA4DD45BAEBBB6FF85300F144168E509A7291EB70AE85CF90

Function 0058720F Relevance: 21.5, APIs: 2, Strings: 10, Instructions: 458fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000014,?,?), ref: 00587290
FindClose.KERNEL32(00000000,?,00000476), ref: 00587375

Strings

Debugger, xrefs: 005876DF
WinSxS\*pending.xml*, xrefs: 0058724E
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 00587616
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp, xrefs: 005872CB, 0058772B, 005877FD
MBAMInstallerService.exe, xrefs: 005875B5
Malwarebytes.exe, xrefs: 0058754F
MBAMService.exe, xrefs: 00587586
: Found at least one match for ', xrefs: 005872EF
: Found IFEO key, trying to delete: , xrefs: 0058774F
: Successfully deleted IFEO key, xrefs: 00587821

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: : Found IFEO key, trying to delete: $: Found at least one match for '$: Successfully deleted IFEO key$Debugger$MBAMInstallerService.exe$MBAMService.exe$Malwarebytes.exe$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$WinSxS\*pending.xml*$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp
API String ID: 2295610775-172558850
Opcode ID: cd792589ad845f4d570bfbcc1303570d283d7f38f0781397d95ff43963e229ec
Instruction ID: d9fecff1d9396c87023329b1e3227083a5440a6c91fdd098f7b9e69dbdef8070
Opcode Fuzzy Hash: cd792589ad845f4d570bfbcc1303570d283d7f38f0781397d95ff43963e229ec
Instruction Fuzzy Hash: 4F02E671E002599FDF14EFA4DC89B9DBFB2FF85304F2045A8E409A7291EB349A44CB95

Function 005AEE40 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 252encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00563AB0: GetProcessHeap.KERNEL32 ref: 00563AF1
Part of subcall function 00563AB0: __Init_thread_footer.LIBCMT ref: 00563B1C
Part of subcall function 00563AB0: __Init_thread_footer.LIBCMT ref: 00563B9A

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,00000000,?,?,?,?,00000000), ref: 005AEF10
CryptMsgGetParam.CRYPT32(00000000,00000006,00000000,00000000,?), ref: 005AEF41
CryptMsgGetParam.CRYPT32(00000000,00000006,00000000,00000000,00000000), ref: 005AEF6B
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,?,00000000), ref: 005AEFB9
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 005AEFE0
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,?), ref: 005AF028
CertFreeCertificateContext.CRYPT32(?), ref: 005AF0CA
CertCloseStore.CRYPT32(00000000,00000000), ref: 005AF11B
CryptMsgClose.CRYPT32(00000000), ref: 005AF127

Strings

c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\setuputils.cpp, xrefs: 005AF0F8, 005AF139
CreateToolhelp32Snapshot() failed, xrefs: 005AF12F
CertFindCertificateInStore() failed, xrefs: 005AF0EE

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Cert$Crypt$CertificateCloseInit_thread_footerNameParamStoreString$ContextFindFreeHeapObjectProcessQuery
String ID: CertFindCertificateInStore() failed$CreateToolhelp32Snapshot() failed$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\setuputils.cpp
API String ID: 2016441274-1377922825
Opcode ID: 80d2f5bc1813d26e757ecf1cddfe7c75b88b6b4f0e511ef1603c389540935b24
Instruction ID: 90313131a37adc9bb288184c99ff800628fe8041fcf3b4fc8e871bfb8c723eb1
Opcode Fuzzy Hash: 80d2f5bc1813d26e757ecf1cddfe7c75b88b6b4f0e511ef1603c389540935b24
Instruction Fuzzy Hash: 5C918D70A00219EFEB20DF64CC45F9EBBB5FF45714F1081A9E609AB291DB71AA44CF91

Function 0056A370 Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 418fileCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000102), ref: 0056A3C9
CreateFileW.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 0056A44F
DeviceIoControl.KERNEL32(00000000,002D1080,00000000,00000000,?,0000000C,00000000,00000000), ref: 0056A47C
GetLastError.KERNEL32 ref: 0056A486
CloseHandle.KERNEL32(00000000), ref: 0056A48D
CloseHandle.KERNEL32(00000000), ref: 0056A4B8
GetLastError.KERNEL32 ref: 0056A8C3

Strings

\\?\%s, xrefs: 0056A404
Signature, xrefs: 0056A7AB
SELECT Signature FROM Win32_DiskDrive WHERE Index=%u, xrefs: 0056A4A4
WQL, xrefs: 0056A625

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: CloseErrorHandleLast$ControlCreateDeviceDirectoryFileSystem
String ID: SELECT Signature FROM Win32_DiskDrive WHERE Index=%u$Signature$WQL$\\?\%s
API String ID: 2698147214-1383269958
Opcode ID: adf34e149a3f3a8c231ae7f36cca78dbdea3c85f62999f99880648760f2498ef
Instruction ID: cb970f95477d854ab07a419170594e2e9306eedf6e31213a90023f1e3eac061e
Opcode Fuzzy Hash: adf34e149a3f3a8c231ae7f36cca78dbdea3c85f62999f99880648760f2498ef
Instruction Fuzzy Hash: 3CF18F70A017149FEB20DB64DC45BAABBB9BF04705F144598E509FB2C1EBB4AE80CF51

Function 00590790 Relevance: 16.1, Strings: 12, Instructions: 1123COMMON

Download Yara Rule

Strings

: Password does not match., xrefs: 00591106
: Password matches., xrefs: 0059105E
ANTI-VIRUS, xrefs: 00591488
PROTECTION, xrefs: 005914BB
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp, xrefs: 005908CD, 00590DDE, 0059103A, 005910E2
SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0059133A
SECURITY, xrefs: 005914EE
ANTIVIRUS, xrefs: 00591441
: license key is empty., xrefs: 005908F1
: TP is enabled., xrefs: 00590E02
DisplayName, xrefs: 0059171E
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00591380

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID: : Password does not match.$: Password matches.$: TP is enabled.$: license key is empty.$ANTI-VIRUS$ANTIVIRUS$DisplayName$PROTECTION$SECURITY$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall$SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp
API String ID: 0-3468487536
Opcode ID: 66e22d88b07eb8cb8198a9c01a28ffab02e74c97b505a4c91b2fd17e6867aa12
Instruction ID: 5f8779331c67de6051b4117fe570c32352529e3ecd3ef2df72fce8fd72a5ef55
Opcode Fuzzy Hash: 66e22d88b07eb8cb8198a9c01a28ffab02e74c97b505a4c91b2fd17e6867aa12
Instruction Fuzzy Hash: 7392D370E00219DFDF14DF64CC89B9EBBB6FF85304F1445A9E509AB281DB34AA84CB95

Function 005AA5C0 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 256libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0056C040: VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003), ref: 0056C0C1
Part of subcall function 0056C040: VerSetConditionMask.KERNEL32(00000000), ref: 0056C0C5
Part of subcall function 0056C040: VerSetConditionMask.KERNEL32(00000000), ref: 0056C0C9
Part of subcall function 0056C040: VerifyVersionInfoW.KERNEL32(0000011C,00000023,00000000), ref: 0056C0EF

LoadLibraryW.KERNEL32(comctl32.dll), ref: 005AA612
GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 005AA624
FreeLibrary.KERNEL32(00000000), ref: 005AA641

Strings

, xrefs: 005AA88C
DllGetVersion, xrefs: 005AA61E
comctl32.dll, xrefs: 005AA5FB
0, xrefs: 005AA83B

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ConditionMask$Library$AddressFreeInfoLoadProcVerifyVersion
String ID: $0$DllGetVersion$comctl32.dll
API String ID: 3074748777-3658545931
Opcode ID: 355af1de2bfbb5497a9939231966cdd06c57eb63d49ce67c288f0aeb02446ba5
Instruction ID: 873c767be8f81114ccd2ab237ff5141d4d7b57591e0dff10929aafa784b7e610
Opcode Fuzzy Hash: 355af1de2bfbb5497a9939231966cdd06c57eb63d49ce67c288f0aeb02446ba5
Instruction Fuzzy Hash: 66A1AE71D002289FDB229F24CC89BAEBBB9BF4A704F0051D9F608A6151D7709BC4CF55

Function 005AE990 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 75processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00000001), ref: 005AE9AD
Process32FirstW.KERNEL32(00000000,0000022C), ref: 005AE9E5
Process32NextW.KERNEL32(00000000,0000022C), ref: 005AEA05
CloseHandle.KERNEL32(00000000), ref: 005AEA0E

Strings

c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\setuputils.cpp, xrefs: 005AEA39, 005AEA52
Process32First() failed, xrefs: 005AEA2F
CreateToolhelp32Snapshot() failed, xrefs: 005AEA48

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: CreateToolhelp32Snapshot() failed$Process32First() failed$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\setuputils.cpp
API String ID: 420147892-2068953443
Opcode ID: d7de9d503123e3f93f7db67d26fd9459a6d09bca9468cee9b394e45eafa6de1a
Instruction ID: 8e487ff9203bed610d55b812d645aa6cacb31fa24e5edc6f4eb0aded5cd38b9e
Opcode Fuzzy Hash: d7de9d503123e3f93f7db67d26fd9459a6d09bca9468cee9b394e45eafa6de1a
Instruction Fuzzy Hash: FD213D31B00219ABD710EBA4BCDFABEB76AFB85310F0441B9F90597281DB355E48C7A1

Function 005CE8A4 Relevance: 12.1, APIs: 8, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,005CEA4D,00648398), ref: 005CE8C8
HeapAlloc.KERNEL32(00000000,?,005CEA4D,00648398), ref: 005CE8CF

Part of subcall function 005CE99A: IsProcessorFeaturePresent.KERNEL32(0000000C,005CE8B6,00000000,?,005CEA4D,00648398), ref: 005CE99C

InterlockedPopEntrySList.KERNEL32(00000000,00000000,?,005CEA4D,00648398), ref: 005CE8DF
VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,005CEA4D,00648398), ref: 005CE906
RaiseException.KERNEL32(C0000017,00000000,00000000,00000000,?,005CEA4D,00648398), ref: 005CE91A
InterlockedPopEntrySList.KERNEL32(00000000,?,005CEA4D,00648398), ref: 005CE92D
VirtualFree.KERNEL32(00000000,00000000,00008000,?,005CEA4D,00648398), ref: 005CE940

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: AllocEntryHeapInterlockedListVirtual$ExceptionFeatureFreePresentProcessProcessorRaise
String ID:
API String ID: 2460949444-0
Opcode ID: 8387b3b3047014627d80a2865a6a45e63ad99cdd45a02a67384ba41c028630e0
Instruction ID: 5ad35f805742f02a1909957d60317cee5036d76ef420792ce0d866c50738ab78
Opcode Fuzzy Hash: 8387b3b3047014627d80a2865a6a45e63ad99cdd45a02a67384ba41c028630e0
Instruction Fuzzy Hash: D3110175640612BFEB6117B4AC1AF6B3E6EFB49B81F08143AF941E6160CB30CD0087B0

Function 006029E5 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 376timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00602A67
_free.LIBCMT ref: 00602A8B
_free.LIBCMT ref: 00602C1A
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00620C1C), ref: 00602C2C
_free.LIBCMT ref: 00602DE8

Strings

-`, xrefs: 00602BD5, 00602CF0, 00602BDB

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: _free$InformationTimeZone
String ID: -`
API String ID: 597776487-2309599019
Opcode ID: 4983cd41dc9d5aa23800320502679d1f39e6fabe4c74869d5c1d94245bce2d77
Instruction ID: a29e21c2818ba2b4f057ef1b3bbd769fe6f03fdbf9b8c78eb8b7058f773f9310
Opcode Fuzzy Hash: 4983cd41dc9d5aa23800320502679d1f39e6fabe4c74869d5c1d94245bce2d77
Instruction Fuzzy Hash: D6C12875A8020B9FDB29AF68CCA9AEB7BBFEF55314F144199E844973C1E7308E018754

Function 006085C4 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

Part of subcall function 005FD002: GetLastError.KERNEL32(?,006483A8,?,005EB249,006483A8,00560000,00000000,?,005EA77A,006483EA,00560000,006483A8,006483A8), ref: 005FD007
Part of subcall function 005FD002: SetLastError.KERNEL32(00000000,00000006,000000FF,?,005EA77A,006483EA,00560000,006483A8,006483A8), ref: 005FD0A5

GetACP.KERNEL32(00000055,?,?,?,?,?,005FBEDF,?,?,?,?,?,?,00000004), ref: 00608685
IsValidCodePage.KERNEL32(00000000,00000055,?,?,?,?,?,005FBEDF,?,?,?,?,?,?,00000004), ref: 006086B0
_wcschr.LIBVCRUNTIME ref: 00608744
_wcschr.LIBVCRUNTIME ref: 00608752
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,005FBEDF,00000000,005FBFFF), ref: 00608815

Strings

utf8, xrefs: 00608782

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: c7d53b86dde9a87db34a2d0cf0bac877ca830c9d54f49d4303d6375cd583fa14
Instruction ID: 23cf29fc6512527bc4e244a20613780934f45f42a7cec19e839df9baf0eb210d
Opcode Fuzzy Hash: c7d53b86dde9a87db34a2d0cf0bac877ca830c9d54f49d4303d6375cd583fa14
Instruction Fuzzy Hash: 55710731A80202AEDB2CEB34CC46EFB77AAEF44710F154429F5859B2C1FE71E9418764

Function 005CE99A Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,005CE8B6,00000000,?,005CEA4D,00648398), ref: 005CE99C
GetProcessHeap.KERNEL32(00000008,00000008,00000000,00000000,0000000C,005CE8B6,00000000,?,005CEA4D,00648398), ref: 005CE9C2
HeapAlloc.KERNEL32(00000000,?,005CEA4D,00648398), ref: 005CE9C9
InitializeSListHead.KERNEL32(00000000,?,005CEA4D,00648398), ref: 005CE9D6
GetProcessHeap.KERNEL32(00000000,00000000,?,005CEA4D,00648398), ref: 005CE9EB
HeapFree.KERNEL32(00000000,?,005CEA4D,00648398), ref: 005CE9F2

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Heap$Process$AllocFeatureFreeHeadInitializeListPresentProcessor
String ID:
API String ID: 1475849761-0
Opcode ID: a8ea3b9f967d0f7ec0f0f0f20ef463f7f6c5ed99c702e5ae142943b384c11f86
Instruction ID: 334606690bdc28544558afc03e9bec0f7477532331cb615c2f612e529277e2c4
Opcode Fuzzy Hash: a8ea3b9f967d0f7ec0f0f0f20ef463f7f6c5ed99c702e5ae142943b384c11f86
Instruction Fuzzy Hash: 25F0AF3A640202AFDB51DBB9DC1AB467BAAFB99B12F04902DE942C3250DF30C8008A60

Function 00568000 Relevance: 8.9, Strings: 7, Instructions: 131COMMON

Download Yara Rule

Strings

VMwareVMware, xrefs: 005680BD
lrpepyh vr, xrefs: 0056812D
bhyve bhyve, xrefs: 00568142
XenVMMXenVMM, xrefs: 005680EE
KVMKVMKVM, xrefs: 00568103
Parallels Hv, xrefs: 00568118
VBoxVBoxVBox, xrefs: 005680D9

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID: lrpepyh vr$KVMKVMKVM$Parallels Hv$VBoxVBoxVBox$VMwareVMware$XenVMMXenVMM$bhyve bhyve
API String ID: 0-521473155
Opcode ID: cdcc0fbbb6c3cb63179ed312e0913b8b9749706cc58a87bb337cc6d7018c46ab
Instruction ID: e7e2415349880b934ee714cc7edb6f68f7cba833278cb6b1ac911dea77733b34
Opcode Fuzzy Hash: cdcc0fbbb6c3cb63179ed312e0913b8b9749706cc58a87bb337cc6d7018c46ab
Instruction Fuzzy Hash: 0A4165B1D012099BCF04CFA5DD46BEEBBF8BF58350F148569E805A7241EB75A908CB71

Function 005852D0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 111COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,A7D6A816,005CAB0F), ref: 00585332

Strings

calling GetDiskFreeSpaceEx, xrefs: 005853B8
: Error , xrefs: 005853A4
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp, xrefs: 00585380

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: DiskFreeSpace
String ID: calling GetDiskFreeSpaceEx$: Error $c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp
API String ID: 1705453755-2381823428
Opcode ID: 4a0f683e80da1c8d44a6136120ffcf9db2cb4d4b9c726551b44b50d1c9ca01e5
Instruction ID: f9c3a8a9dda1659265d985ace4ad077b040a0bce8691766b8f7bdab2cea2c3fc
Opcode Fuzzy Hash: 4a0f683e80da1c8d44a6136120ffcf9db2cb4d4b9c726551b44b50d1c9ca01e5
Instruction Fuzzy Hash: 8831C871E002059BCF04AFB4DC4ABAE7FA6FBC9314F505A29E406A7285EE3499408760

Function 00608D58 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(51CEB70F,2000000B,00000000,00000002,00000000,?,?,?,0060907E,?,00000000), ref: 00608DF1
GetLocaleInfoW.KERNEL32(51CEB70F,20001004,00000000,00000002,00000000,?,?,?,0060907E,?,00000000), ref: 00608E1A
GetACP.KERNEL32(?,?,0060907E,?,00000000), ref: 00608E2F

Strings

ACP, xrefs: 00608D76
OCP, xrefs: 00608DAC

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: e7fb90b0ffc90a606680236d1d36a5cfaff31d59c4270db2f5f0ba3dc1d69d70
Instruction ID: 9e508ae61249f9f562ca2ca9b1e967a6de04f819a0dfd711797e9f7ba91a753d
Opcode Fuzzy Hash: e7fb90b0ffc90a606680236d1d36a5cfaff31d59c4270db2f5f0ba3dc1d69d70
Instruction Fuzzy Hash: A521AE22A80105AEDB3CCF54C904AE776A7AF60B60B6A8565E989C73D1EF32DE41C750

Function 00608F33 Relevance: 7.7, APIs: 5, Instructions: 184COMMON

Download Yara Rule

APIs

Part of subcall function 005FD002: GetLastError.KERNEL32(?,006483A8,?,005EB249,006483A8,00560000,00000000,?,005EA77A,006483EA,00560000,006483A8,006483A8), ref: 005FD007
Part of subcall function 005FD002: SetLastError.KERNEL32(00000000,00000006,000000FF,?,005EA77A,006483EA,00560000,006483A8,006483A8), ref: 005FD0A5

Part of subcall function 005FD002: _free.LIBCMT ref: 005FD064
Part of subcall function 005FD002: _free.LIBCMT ref: 005FD09A

GetUserDefaultLCID.KERNEL32(00000055,?,?), ref: 0060903F
IsValidCodePage.KERNEL32(00000000), ref: 0060908A
IsValidLocale.KERNEL32(?,00000001), ref: 00609099
GetLocaleInfoW.KERNEL32(?,00001001,005FBED8,00000040,?,005FBFF8,00000055,00000000,?,?,00000055,00000000), ref: 006090E1
GetLocaleInfoW.KERNEL32(?,00001002,005FBF58,00000040), ref: 00609100

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: 82384d2bc2372cbbe949c8df2ee667078094f3e5338cf93c025bb244e8670c19
Instruction ID: d0271a84bce5841ad5790edc026685c22dc1af7aa97df223aa10e78c525aab7f
Opcode Fuzzy Hash: 82384d2bc2372cbbe949c8df2ee667078094f3e5338cf93c025bb244e8670c19
Instruction Fuzzy Hash: E7518D71A4020AAEEB18DFA4CC45AFB77BBBF45700F044429E915EB2D1EB709A44CB61

Function 005CF11C Relevance: 6.0, APIs: 4, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,005CF23B,0061CC8C,00000017), ref: 005CF121
UnhandledExceptionFilter.KERNEL32(0061CC8C,?,005CF23B,0061CC8C,00000017), ref: 005CF12A
GetCurrentProcess.KERNEL32(C0000409,?,005CF23B,0061CC8C,00000017), ref: 005CF135
TerminateProcess.KERNEL32(00000000,?,005CF23B,0061CC8C,00000017), ref: 005CF13C

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 8ca3c02fcb8dcce05c5b6feed09feae38bac9f67bed5c3458ff06fa30a3334e4
Instruction ID: 2389ddcf3a9fad98058e08ce3034ca150e34155c8e21bab67676dcf78ca79a49
Opcode Fuzzy Hash: 8ca3c02fcb8dcce05c5b6feed09feae38bac9f67bed5c3458ff06fa30a3334e4
Instruction Fuzzy Hash: 95D0CA32050208BBDB002BE0EE2DA983B2AAB08B02F0CA002F30A82020CB364610CB71

Function 005CE685 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 005654F0: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,005CE6B4,?,?,?,00562362), ref: 005654F5
Part of subcall function 005654F0: GetLastError.KERNEL32(?,?,?,00562362), ref: 005654FF

IsDebuggerPresent.KERNEL32(?,?,?,00562362), ref: 005CE6B8
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00562362), ref: 005CE6C7

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 005CE6C2

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: 6d70ee998839466b65a6958ddae3553b005fc67b6fee988d717cd4d4733f134c
Instruction ID: 576b6f32458f0493dcab1303e713aee87ac10ce58dcbc33778d63979ad9a7938
Opcode Fuzzy Hash: 6d70ee998839466b65a6958ddae3553b005fc67b6fee988d717cd4d4733f134c
Instruction Fuzzy Hash: 2AE06D702107128FD3209F68E41AB867EE1BB54714F48992DE486D3750EBB9E5C4CB62

Function 006089DB Relevance: 4.7, APIs: 3, Instructions: 206COMMON

Download Yara Rule

APIs

Part of subcall function 005FD002: GetLastError.KERNEL32(?,006483A8,?,005EB249,006483A8,00560000,00000000,?,005EA77A,006483EA,00560000,006483A8,006483A8), ref: 005FD007
Part of subcall function 005FD002: SetLastError.KERNEL32(00000000,00000006,000000FF,?,005EA77A,006483EA,00560000,006483A8,006483A8), ref: 005FD0A5

Part of subcall function 005FD002: _free.LIBCMT ref: 005FD064
Part of subcall function 005FD002: _free.LIBCMT ref: 005FD09A

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00608A2F
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00608A79
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00608B3F

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: 89076d175a6782150110f91c9793c6ff86dd1dbca1ad46294bf066bcdb2a87d9
Instruction ID: fb310b74fde938cd1745d827ff63958e098267d0d22ea2ebccf060879178fc49
Opcode Fuzzy Hash: 89076d175a6782150110f91c9793c6ff86dd1dbca1ad46294bf066bcdb2a87d9
Instruction Fuzzy Hash: 1B616DB19802079FEB2CDF28CC86BAA77BAEF44300F144169E955C76C1EB74D991DB60

Function 0057C0D0 Relevance: 4.5, APIs: 3, Instructions: 47COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(00000000,00000000,00000001,00000000,00000001,?,0057C09C,?,?,00000001,00540053,00000001,?,0057C142,?,0063066C), ref: 0057C0DC
LockResource.KERNEL32(00000000,?,0057C09C,?,?,00000001,00540053,00000001,?,0057C142,?,0063066C,00540053,?,005A9AA7,00540053), ref: 0057C0E7
SizeofResource.KERNEL32(00000000,00000000,?,0057C09C,?,?,00000001,00540053,00000001,?,0057C142,?,0063066C,00540053,?,005A9AA7), ref: 0057C0F5

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: 4433486925b0d7ee3349914f8beb1cd288ad23b1905f69f6ef9ba0127551f1fd
Instruction ID: f4ad0e4b2d25cf3ced914d5dab4a97ea4c52a7283803e6e6da2bbd8630b94fb8
Opcode Fuzzy Hash: 4433486925b0d7ee3349914f8beb1cd288ad23b1905f69f6ef9ba0127551f1fd
Instruction Fuzzy Hash: 59F02836B002215B8B301A6DBC44CB7BFACFB88756B45893FE90EC3112E5649C40E1E0

Function 005F4035 Relevance: 3.3, Strings: 1, Instructions: 2060COMMON

Download Yara Rule

Strings

S\, xrefs: 005F4052

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID: S\
API String ID: 0-393906132
Opcode ID: 91a488cfd6d34e36baabbafc378c6af997a4a3c16901db534fc6d2da21506ed1
Instruction ID: cdedfc51ee524690427510917bb306bbd56b195201d8c1ae3a1331c9fca887f9
Opcode Fuzzy Hash: 91a488cfd6d34e36baabbafc378c6af997a4a3c16901db534fc6d2da21506ed1
Instruction Fuzzy Hash: AC034C71E0162D8BDB24DE68DC807FABBB5BB88304F1445EADA4DE7241E7749E818F40

Function 00561410 Relevance: 3.3, APIs: 2, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess__onexit
String ID:
API String ID: 3832785197-0
Opcode ID: 402736e4d3f7b5c8120153ee5ad232e2de7c86d14b727b79da939380b0aa6d61
Instruction ID: ad9787a6026d8f907e59e61b83874c97e3f7c84190e6f5c8a2dbb5013ed574a4
Opcode Fuzzy Hash: 402736e4d3f7b5c8120153ee5ad232e2de7c86d14b727b79da939380b0aa6d61
Instruction Fuzzy Hash: 788114B2A04649AFCB04DFA8DC0AF5ABBE5FB04B10F14457DF816D7B81DB3599048B41

Function 005FE85F Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,005FE85A,?,?,00000008,?,?,0060C39B,00000000), ref: 005FEA8C

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 2f05286ef7fc92ce7c17b88e1a777de46b7d597b6ad8bd2c418c8053b7911468
Instruction ID: 2d3902ae6b91301190b50260be861e2f480b90b083ba3d04423cee05e60a56ed
Opcode Fuzzy Hash: 2f05286ef7fc92ce7c17b88e1a777de46b7d597b6ad8bd2c418c8053b7911468
Instruction Fuzzy Hash: 6AB13831610609CFD715CF28C48AA657FA1FF45364F298659EADACF2B1C339E982CB40

Function 00608C30 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 005FD002: GetLastError.KERNEL32(?,006483A8,?,005EB249,006483A8,00560000,00000000,?,005EA77A,006483EA,00560000,006483A8,006483A8), ref: 005FD007
Part of subcall function 005FD002: SetLastError.KERNEL32(00000000,00000006,000000FF,?,005EA77A,006483EA,00560000,006483A8,006483A8), ref: 005FD0A5

Part of subcall function 005FD002: _free.LIBCMT ref: 005FD064
Part of subcall function 005FD002: _free.LIBCMT ref: 005FD09A

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00608C84

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: 8efb8398523bb25e0a6c91cda2e64d5d4f4ed71d74b15df8bebe121b484c9e8b
Instruction ID: 141e5daec05beb4ee77ff48dca5ee988c706c3bc640aedd7ef0b8b141d75be4e
Opcode Fuzzy Hash: 8efb8398523bb25e0a6c91cda2e64d5d4f4ed71d74b15df8bebe121b484c9e8b
Instruction Fuzzy Hash: 4C21B032691206AFEB2CEB24DC46ABB77BAFB50301F10406AED41C7281EF34AD008764

Function 006088B5 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 005FD002: GetLastError.KERNEL32(?,006483A8,?,005EB249,006483A8,00560000,00000000,?,005EA77A,006483EA,00560000,006483A8,006483A8), ref: 005FD007
Part of subcall function 005FD002: SetLastError.KERNEL32(00000000,00000006,000000FF,?,005EA77A,006483EA,00560000,006483A8,006483A8), ref: 005FD0A5

EnumSystemLocalesW.KERNEL32(006089DB,00000001,00000000,?,005FBED8,?,00609013,00000000,00000055,?,?), ref: 00608927

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8122e4cbeb0102acbc31fbd54f61091682943846475f7cc32c61712fa95d87c6
Instruction ID: 2c5f1bb8a4cef78edc7bd1897e5ff52f2ca96f5c6830bb8787704232eda8ad59
Opcode Fuzzy Hash: 8122e4cbeb0102acbc31fbd54f61091682943846475f7cc32c61712fa95d87c6
Instruction Fuzzy Hash: 281106362007055FDB1CEF39C8955BBBB93FB80328B15842DE98787780EB71A942C740

Function 00608E60 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 005FD002: GetLastError.KERNEL32(?,006483A8,?,005EB249,006483A8,00560000,00000000,?,005EA77A,006483EA,00560000,006483A8,006483A8), ref: 005FD007
Part of subcall function 005FD002: SetLastError.KERNEL32(00000000,00000006,000000FF,?,005EA77A,006483EA,00560000,006483A8,006483A8), ref: 005FD0A5

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00608BF7,00000000,00000000,?), ref: 00608E8C

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 670f2a17ec8596869b893bf4ba64b9e117e272ab73a27e7fcfbc90bad8d6684d
Instruction ID: 4700ed99a063180107a520f9d84e16f222692faa091ac71ad560ae40246f6b8e
Opcode Fuzzy Hash: 670f2a17ec8596869b893bf4ba64b9e117e272ab73a27e7fcfbc90bad8d6684d
Instruction Fuzzy Hash: 17F0D632D80126BFDB2CDA24CC09AFB7B69EB40714F144829EC85A32C0EE74BD02C6D0

Function 00608950 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 005FD002: GetLastError.KERNEL32(?,006483A8,?,005EB249,006483A8,00560000,00000000,?,005EA77A,006483EA,00560000,006483A8,006483A8), ref: 005FD007
Part of subcall function 005FD002: SetLastError.KERNEL32(00000000,00000006,000000FF,?,005EA77A,006483EA,00560000,006483A8,006483A8), ref: 005FD0A5

EnumSystemLocalesW.KERNEL32(00608C30,00000001,00000009,?,005FBED8,?,00608FD7,005FBED8,00000055,?,?,?,?,005FBED8,?,?), ref: 0060899A

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: eaeaa9d15b10cfedbc765fe919667dbcdca62fcedb46ea8f2577e1ab88ca12ec
Instruction ID: a9aef4069b62c4e510a4a25019b8ef0a77a6903ccf81e2dedeeb8016c901b44a
Opcode Fuzzy Hash: eaeaa9d15b10cfedbc765fe919667dbcdca62fcedb46ea8f2577e1ab88ca12ec
Instruction Fuzzy Hash: D2F0FC366403055FDB18AF39DC856B77B96FFC0358F05842DF985476C0DA719C42C650

Function 0060886A Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 005FD002: GetLastError.KERNEL32(?,006483A8,?,005EB249,006483A8,00560000,00000000,?,005EA77A,006483EA,00560000,006483A8,006483A8), ref: 005FD007
Part of subcall function 005FD002: SetLastError.KERNEL32(00000000,00000006,000000FF,?,005EA77A,006483EA,00560000,006483A8,006483A8), ref: 005FD0A5

EnumSystemLocalesW.KERNEL32(006087C1,00000001,00000009,?,?,00609035,005FBED8,00000055,?,?,?,?,005FBED8,?,?,?), ref: 006088A1

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8be5c0a3d6d8967a8732fee9643e32b63e8b256b2372e432a63b2b404961a041
Instruction ID: c18dc25543efbdacf49cfaf0dfbf7d301bca72007a0d3ad2c5e33520aee005cb
Opcode Fuzzy Hash: 8be5c0a3d6d8967a8732fee9643e32b63e8b256b2372e432a63b2b404961a041
Instruction Fuzzy Hash: 39F05C393402065BCB0CDF35C81A6AB7F55FFC1710B4A8059EE458B381CA719842C760

Function 00600E1C Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 005F98B3: EnterCriticalSection.KERNEL32(-0064C198,?,005FB0CC,00563B95,00642F08,0000000C,005FB3A9,?), ref: 005F98C2

EnumSystemLocalesW.KERNEL32(00600E0F,00000001,00643108,0000000C,00601272,00000000), ref: 00600E54

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 596c086c7b0ffbbe2c7038be53d9797e1b8452bf99f8a1b89d6148436ebddfe2
Instruction ID: 77fe26c8623710374754caddebfa6139215e744310a7dad276adadb0dc02cfd6
Opcode Fuzzy Hash: 596c086c7b0ffbbe2c7038be53d9797e1b8452bf99f8a1b89d6148436ebddfe2
Instruction Fuzzy Hash: 7AF03A75A45209EFDB00EFA8D84AB5D7BB2FB46720F10916AF8109B3A1CB754A408F91

Function 006013CF Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,?,?,005FC007,?,20001004,?,00000002,00000000,?,?), ref: 00601403

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 6a3327b972a625f1fe69ef89c4aee3f98d2f9f46ebb398c8f403e98677005ab3
Instruction ID: 608509182743611e3f2f5f63793f87dbe0e7bee690ef18946c4461175c826687
Opcode Fuzzy Hash: 6a3327b972a625f1fe69ef89c4aee3f98d2f9f46ebb398c8f403e98677005ab3
Instruction Fuzzy Hash: C5E04F35580218BBCF1B2FA1DC04EDF3E6BEF45751F088015FC156A2A1DB318E21AAE4

Function 005CFA4F Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0006FA5B,005CF4E4), ref: 005CFA54

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ee9922418ca71f1d76b8720b01463174b1b9bb05f8f3069ea48336698e3e0e7a
Instruction ID: c78208b7427741f76a564561d83ac166afa253cea2584706e9fc6d91cbd1d96c
Opcode Fuzzy Hash: ee9922418ca71f1d76b8720b01463174b1b9bb05f8f3069ea48336698e3e0e7a
Instruction Fuzzy Hash:

Function 005EC0AE Relevance: 1.5, Strings: 1, Instructions: 240COMMON

Download Yara Rule

Strings

0, xrefs: 005EC246

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 2ba2bc71c131096ef9e2aef4a1719c717c2a7290f9ab7b0a1a17047ec211854e
Instruction ID: b10b3c9fd01f8222d42d1e2547bb0b019bbfdaa6d5d61784cfa79992c194a26c
Opcode Fuzzy Hash: 2ba2bc71c131096ef9e2aef4a1719c717c2a7290f9ab7b0a1a17047ec211854e
Instruction Fuzzy Hash: 00617631A003C5A6DB3C9AAB8896BBF7F95BB46740F54091EE5C2EB282C761DD03C341

Function 005A1310 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

Uninstall Progress, xrefs: 005A14A8

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID: Uninstall Progress
API String ID: 0-2625404597
Opcode ID: 3bdebd929918977b905e9ec64c0360d2902006a8e4343607c36622e1fb912ff0
Instruction ID: f9627c72adba0892afa6074af25a1272cce4cb8027911fd52c21551a373be73d
Opcode Fuzzy Hash: 3bdebd929918977b905e9ec64c0360d2902006a8e4343607c36622e1fb912ff0
Instruction Fuzzy Hash: 5261E6316107058BDB20EF68D846BBFBBE5FBD9314F005A1FF45686280DBB59990CB92

Function 0060E9B0 Relevance: .7, Instructions: 651COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63dec9e4a05166af71511a7e5b104dc0a92d04e2eaf7a9f6ba911dd0bd063da
Instruction ID: 70aa1c71fe2da3116798caa3e774742d8c0ce6dce144f5e62ab323ac37713375
Opcode Fuzzy Hash: f63dec9e4a05166af71511a7e5b104dc0a92d04e2eaf7a9f6ba911dd0bd063da
Instruction Fuzzy Hash: 46320131DA8F014DD7379634D822336A24AAFB73C4F55E737E81AB5EA6EF2994834140

Function 00604629 Relevance: .6, Instructions: 637COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d1fe3574a0abeff6fb1753d6fd78bcb5f44d3b45614278ff7e40140ec8fb14a
Instruction ID: f26822ed3b63d768673451bf00c911f1419b1c9b9f989c6c8a2edfe95c65f375
Opcode Fuzzy Hash: 3d1fe3574a0abeff6fb1753d6fd78bcb5f44d3b45614278ff7e40140ec8fb14a
Instruction Fuzzy Hash: 0B320861EA9F414DE7375634C822336624AAFB73D4F15D727E81AB5AE6EF39C4834100

Function 0056E0D0 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac478da41a8a6bb3f5f43fc12b2429958841b839d8fb0f68ad2a713828ca1b84
Instruction ID: 73f5f21fbfea883e5cdfa3e0d7bc01cdb6beba9f3d9f3a7808ec49d9f5d36f58
Opcode Fuzzy Hash: ac478da41a8a6bb3f5f43fc12b2429958841b839d8fb0f68ad2a713828ca1b84
Instruction Fuzzy Hash: 4AB1D371A10109ABDF19DFA8DC56FAEBBBAFF49300F04462DF811A7291D735A950CB90

Function 005BC990 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51d80f485b32690abf18e77a3843733b59a700da629935435074d18cf4fc5b44
Instruction ID: 9afb5c6d51b3ef55023694596785da42fcce78f134baf7b722893c13ec87292c
Opcode Fuzzy Hash: 51d80f485b32690abf18e77a3843733b59a700da629935435074d18cf4fc5b44
Instruction Fuzzy Hash: 94B1B071A10509ABDF19DFA8DC56EEEBFB9FF48300F004229F815A7291D735A950CBA4

Function 0060806B Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLastProcess_free$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 4283097504-0
Opcode ID: ff15d266fd60a2923c070adbfdc736dcc84a0cb20ff232b11a8be98bb0f3e0e2
Instruction ID: 6f0f42d06b8e64d827921cf0457c28b761e0a2df0a1ce1a7f22baebae4408768
Opcode Fuzzy Hash: ff15d266fd60a2923c070adbfdc736dcc84a0cb20ff232b11a8be98bb0f3e0e2
Instruction Fuzzy Hash: DDB1F5355407068FCB3CDA65CC86AF7B3AAFF94704F14446DEAC2876C0EE75A9868750

Function 005E7A79 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ff51ee876af57fc84180d1aff5733c09b6a7f0f47a94e1a7ace56cf6375c884
Instruction ID: 17ddb20be3584be9b0c34e38e91d25264a81291f5da50dc3de2b75fcc4450358
Opcode Fuzzy Hash: 9ff51ee876af57fc84180d1aff5733c09b6a7f0f47a94e1a7ace56cf6375c884
Instruction Fuzzy Hash: E991627220D0EB4ADB2D463B853443EFFE56A563A131A0BADD4F2CB1C5FE14DA54D620

Function 005E77CF Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4d6cd2b5462420d9af3f9325c99984ee85f20a0cefb5fc35c69dce7e59ac56d
Instruction ID: 444291e0ccd8cf9dc35fc3e54dbb309be23c49397c3239c6bb5e0a9b256cc9aa
Opcode Fuzzy Hash: d4d6cd2b5462420d9af3f9325c99984ee85f20a0cefb5fc35c69dce7e59ac56d
Instruction Fuzzy Hash: 5881527320D0E749DB2D463B857803EFFE16E963A131A0BADD4F2CA1C5EE14CA54E620

Function 005C3880 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5320fe48685c13860579ded3dc15b9bebd73548e379f40aaee4af21beb1c22f6
Instruction ID: e942e3efc547dbc90fdb2bab26337b1f27fd6c7bfa0c74a31e13e9f50fa2c76e
Opcode Fuzzy Hash: 5320fe48685c13860579ded3dc15b9bebd73548e379f40aaee4af21beb1c22f6
Instruction Fuzzy Hash: A0814E72E00219EFCF14DFA9D885ADDFBB5FB49710F54812DE815A7281D734AA44CBA0

Function 00603375 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8494ad03a81160bcfd94cdb8c95c3a2e68d73652f65c68ac18d5763d2ea4f885
Instruction ID: 5781a20fc76174bf94548f54ec7bec551bd4e8044b518b71199f4636e8477c49
Opcode Fuzzy Hash: 8494ad03a81160bcfd94cdb8c95c3a2e68d73652f65c68ac18d5763d2ea4f885
Instruction Fuzzy Hash: 1D21A473F2043847770CC47E8C522B9B6E1C68C501745427AE8A6EA3C1D968D917E2E4

Function 00603251 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acc0ccbf8cc65987c487a8910976dfe652509daf853a0dfbf6dff5cb9b05377e
Instruction ID: 4e0914d22541415df813874ec846cb7df70409f1f2cdb5dbc8aea60a3a8fbef1
Opcode Fuzzy Hash: acc0ccbf8cc65987c487a8910976dfe652509daf853a0dfbf6dff5cb9b05377e
Instruction Fuzzy Hash: D1117B23F30C3957675C816D8C1727AA5D7DBD825070F537AD826E7384E994DE13D290

Function 005E73B0 Relevance: .1, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 1fbb4c8da440835439f768910ab012c2d7f0863917204f35c7b0e84febfdb6af
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: CB113B772081D943DE4DCE2FD8B45B69F95FACD32072C4679D0C18B688E122D545F901

Function 00561330 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess__onexit
String ID:
API String ID: 3832785197-0
Opcode ID: 31195afde80eb4266722e03ef8b1218d81432083afc4e72f8c893dd9438a5762
Instruction ID: 37ab16cbfcc64bb98609baf7521956bc52726464e900a11db32aabf2dbe4395a
Opcode Fuzzy Hash: 31195afde80eb4266722e03ef8b1218d81432083afc4e72f8c893dd9438a5762
Instruction Fuzzy Hash: 3BF0F0B2A44648AFC704EF98DC0AF5ABBA6FB00B10F10456EF81697B81DB3196008B81

Function 005FF21C Relevance: .0, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e47ee02a448cc6b2cf06d9632b5fa7c349c4174935d2fa67892bde1237eb124f
Instruction ID: e1843ef67a0ed3f0bb8caf76cf48ef955ef4853951fcaec738fc3eb5550208b1
Opcode Fuzzy Hash: e47ee02a448cc6b2cf06d9632b5fa7c349c4174935d2fa67892bde1237eb124f
Instruction Fuzzy Hash: 85F03035A52328DBCB26CA4CD805B69B7EDFB4AB21F1540AAF605DB690C7B49D008BC0

Function 005FF262 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11e7fe354abece577ff08d208118b040d2f3b0d9024392efead602ad3f4c5946
Instruction ID: ed8cf2d12aed92452bd352aa40ca87b44a81699d8373b5f3117b914e97b2d472
Opcode Fuzzy Hash: 11e7fe354abece577ff08d208118b040d2f3b0d9024392efead602ad3f4c5946
Instruction Fuzzy Hash: E1E0463692122CEBC728DBC899049AAF7ECFB4AB10B1101ABFA04D3651C2749E00C7D0

Function 005A7620 Relevance: 57.2, APIs: 3, Strings: 35, Instructions: 213
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000003E8,?,?,?,?,?,?,?,?,?,?,?), ref: 005A782A
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 005A78DF
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 005A78E7

Strings

MBRW-C, xrefs: 005A7684, 005A900D
MDAM-B, xrefs: 005A77EC, 005A8F4A
Got Iris data, starting UI, xrefs: 005A7835
Error calling MoveFileEx: , xrefs: 005A952E
`}d, xrefs: 005A90DB
Error , xrefs: 005A84EF
mbarw.exe, xrefs: 005A76D6
creating MBAMService instance, xrefs: 005A8264
: Waiting for IRIS data, xrefs: 005A780E
Prompting user for password to uninstall, xrefs: 005A8302
MBRW-B, xrefs: 005A76A9, 005A7D4A, 005A8F6D, 005A9032
Connected to MBAMService instance, xrefs: 005A82BB
h~d, xrefs: 005A9162
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp, xrefs: 005A7818, 005A783F, 005A81B1, 005A8236, 005A8257, 005A8294, 005A82AE, 005A82F9, 005A8325, 005A848C, 005A85E3, 005A8833, 005A94E0, 005A95A8
Uninstall password is correct, proceeding with uninstall, xrefs: 005A8332
MBAMInstallerService.exe, xrefs: 005A83E2
created MBAMService instance ok, connecting, xrefs: 005A8286
~d, xrefs: 005A9050
release, xrefs: 005A8EA6, 005A8EB2
\Malwarebytes\MB3Service, xrefs: 005A904B
Download of ISvc failed. Using local ISvc, xrefs: 005A94D6
Uninstalling Malwarebytes from: , xrefs: 005A873F
Uninstall password is incorrect, cannot proceed with uninstall, xrefs: 005A8D52
business, xrefs: 005A8F80
RunAsDesktopUser failed, xrefs: 005A78C4
--skiponboarding, xrefs: 005A779E
Malwarebytes\MBAMService\logs\MBAMSERVICE.LOG, xrefs: 005A867B
MBAM-C, xrefs: 005A7678, 005A7690, 005A76A4, 005A76B5, 005A77B8, 005A77CC, 005A77E7, 005A77F8, 005A7D45, 005A7D56, 005A8211, 005A8F07, 005A9008, 005A9019, 005A902D, 005A903E
~d, xrefs: 005A865F
Found the Service. Product code is: , xrefs: 005A8216
MBAM-C, xrefs: 005A77C7
Uninstall failed to find installation directory, xrefs: 005A81A7
~d, xrefs: 005A8FEF
ISvc path is: , xrefs: 005A83F8
deleting ISvc, xrefs: 005A8506

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: CloseHandle$Sleep
String ID: --skiponboarding$ deleting ISvc$: Waiting for IRIS data$Connected to MBAMService instance$Download of ISvc failed. Using local ISvc$Error $Error calling MoveFileEx: $Found the Service. Product code is: $Got Iris data, starting UI$ISvc path is: $MBAM-C$MBAM-C$MBAMInstallerService.exe$MBRW-B$MBRW-C$MDAM-B$Malwarebytes\MBAMService\logs\MBAMSERVICE.LOG$Prompting user for password to uninstall$RunAsDesktopUser failed$Uninstall failed to find installation directory$Uninstall password is correct, proceeding with uninstall$Uninstall password is incorrect, cannot proceed with uninstall$Uninstalling Malwarebytes from: $\Malwarebytes\MB3Service$`}d$business$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp$created MBAMService instance ok, connecting$creating MBAMService instance$h~d$mbarw.exe$release$~d$~d$~d
API String ID: 1770459025-3563352020
Opcode ID: 66591a0bfc31767d85b182633b4412fee0ee9203f977ef4c6aeb95cd8bc0f910
Instruction ID: 562f734c64f11ba52204b6303b8b85f59b2dd6bf957f8d46139a2f476c8d42ed
Opcode Fuzzy Hash: 66591a0bfc31767d85b182633b4412fee0ee9203f977ef4c6aeb95cd8bc0f910
Instruction Fuzzy Hash: 3681D575E142199BDB10EB24DC46BAE7BB6FF86300F0485B5E548A3181EB349A44CFE1

Function 005AD420 Relevance: 47.6, APIs: 19, Strings: 8, Instructions: 361
libraryloaderthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(userenv.dll,A7D6A816,?,00647C88), ref: 005AD4F5
GetProcAddress.KERNEL32(00000000,CreateEnvironmentBlock), ref: 005AD508
DeleteProcThreadAttributeList.KERNEL32(?,00000004,?,?), ref: 005AD5C0
InitializeProcThreadAttributeList.KERNEL32(00000000,?,00000000,?,00000004,?,?), ref: 005AD606
GetProcAddress.KERNEL32(00000000,DestroyEnvironmentBlock), ref: 005AD8E2
CloseHandle.KERNEL32(FFFFFFFF), ref: 005AD908
CloseHandle.KERNEL32(FFFFFFFF), ref: 005AD91E

Strings

userenv.dll, xrefs: 005AD4E2
Error initializing ShellProcess instance, xrefs: 005AD4BC
Error creating process. , xrefs: 005AD776
Error opening dest process token, xrefs: 005AD7DD
Error cloning security info, xrefs: 005AD876
DestroyEnvironmentBlock, xrefs: 005AD8DC
CreateEnvironmentBlock, xrefs: 005AD502
Unable to set parent process, xrefs: 005AD6E8

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Proc$AddressAttributeCloseHandleListThread$DeleteInitializeLibraryLoad
String ID: CreateEnvironmentBlock$DestroyEnvironmentBlock$Error cloning security info$Error creating process. $Error initializing ShellProcess instance$Error opening dest process token$Unable to set parent process$userenv.dll
API String ID: 4287889805-1788241575
Opcode ID: 55669ad2a32fe78551cfc5083f6f14e131a6b0d8e525d56b4c2b653f831fa230
Instruction ID: 4e7dabcc5d2150f55a0b8efc97c4c675994904d02b060200172a988073281e21
Opcode Fuzzy Hash: 55669ad2a32fe78551cfc5083f6f14e131a6b0d8e525d56b4c2b653f831fa230
Instruction Fuzzy Hash: E6E19170E002199BDF20EF64CC45BEEBBB5BF46314F144299E94AB7281DB749E84CB61

Function 00586F9E Relevance: 30.2, APIs: 2, Strings: 15, Instructions: 465COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 005870C4
GetLastError.KERNEL32 ref: 005870D2

Part of subcall function 005BF3E0: _strftime.LIBCMT ref: 005BF444

Strings

calling GetWindowsDirectory, xrefs: 0058713C
SOFTWARE\Microsoft\Updates, xrefs: 00587056
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 00587616
' has ', xrefs: 00587062
: Found IFEO key, trying to delete: , xrefs: 0058774F
Debugger, xrefs: 005876DF
: Error , xrefs: 00587128
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp, xrefs: 00587026, 00587104, 0058772B, 005877FD
MBAMInstallerService.exe, xrefs: 005875B5
Malwarebytes.exe, xrefs: 0058754F
: HKLM key ', xrefs: 0058704A
MBAMService.exe, xrefs: 00587586
UpdateExeVolatile, xrefs: 00586FCF, 0058706E
' value, xrefs: 0058707A
: Successfully deleted IFEO key, xrefs: 00587821

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: DirectoryErrorLastWindows_strftime
String ID: calling GetWindowsDirectory$' has '$' value$: Error $: Found IFEO key, trying to delete: $: HKLM key '$: Successfully deleted IFEO key$Debugger$MBAMInstallerService.exe$MBAMService.exe$Malwarebytes.exe$SOFTWARE\Microsoft\Updates$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\$UpdateExeVolatile$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp
API String ID: 2088733851-3617374932
Opcode ID: e7b70ffc29f8618ef75ce0c997056ccdb24916514fedf1a2b4c311a7539e1337
Instruction ID: 2c8935bff8661d4e46352f03a46f5e94ca3591df647765ec77725e90893df1d3
Opcode Fuzzy Hash: e7b70ffc29f8618ef75ce0c997056ccdb24916514fedf1a2b4c311a7539e1337
Instruction Fuzzy Hash: AB02D471E002599BDF14EFB4DC49B9EBFB6FF89304F104568E405AB282EB349A44CB95

Function 005AF190 Relevance: 28.3, APIs: 7, Strings: 9, Instructions: 273COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(A7D6A816,00647C88,00000000,-00000010,00647C87,00614308,000000FF,?,0058AA74,unknown,00000007), ref: 005AF1D3

Part of subcall function 005AE990: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00000001), ref: 005AE9AD
Part of subcall function 005AE990: Process32FirstW.KERNEL32(00000000,0000022C), ref: 005AE9E5
Part of subcall function 005AE990: Process32NextW.KERNEL32(00000000,0000022C), ref: 005AEA05
Part of subcall function 005AE990: CloseHandle.KERNEL32(00000000), ref: 005AEA0E

Part of subcall function 005AEA80: OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 005AEAF8
Part of subcall function 005AEA80: K32GetModuleFileNameExW.KERNEL32(00000000,00000000,?,00000104), ref: 005AEB53
Part of subcall function 005AEA80: CloseHandle.KERNEL32(00000000), ref: 005AEB90

_wcsstr.LIBVCRUNTIME ref: 005AF3B3
_wcsstr.LIBVCRUNTIME ref: 005AF3DC
_wcsstr.LIBVCRUNTIME ref: 005AF420
_wcsstr.LIBVCRUNTIME ref: 005AF445
_wcsstr.LIBVCRUNTIME ref: 005AF46A
_wcsstr.LIBVCRUNTIME ref: 005AF48F

Strings

c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\setuputils.cpp, xrefs: 005AEBE0, 005AED9C, 005AF2CE, 005AF390, 005AF4D6
PIRIFORM , xrefs: 005AF41A
Revo , xrefs: 005AF464
Bitdefender, xrefs: 005AF3AD
Trend Micro, xrefs: 005AEC99, 005AF3D6
Parent pathname is '%s', xrefs: 005AF2BB
CrystalBit , xrefs: 005AF489
IObit , xrefs: 005AF43F
Signer name is '%s', xrefs: 005AF37A

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: _wcsstr$CloseHandleProcessProcess32$CreateCurrentFileFirstModuleNameNextOpenSnapshotToolhelp32
String ID: Revo $Bitdefender$CrystalBit $IObit $PIRIFORM $Parent pathname is '%s'$Signer name is '%s'$Trend Micro$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\setuputils.cpp
API String ID: 3036702232-44729843
Opcode ID: 4e09193e937fe61b5c54b2e57e0fdc9469fdb4918a1a180b514c6fa9fabf752b
Instruction ID: 86821a568897f9bc38c69e8c81cb4976cdf3b2239e57c77acd933f6350edd4ec
Opcode Fuzzy Hash: 4e09193e937fe61b5c54b2e57e0fdc9469fdb4918a1a180b514c6fa9fabf752b
Instruction Fuzzy Hash: 58A1E034A012068FDF04DFA8C849B6EBBF2FF46324F148568E812EB791D7789944CB91

Function 005AD950 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 194COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(A7D6A816,?,00647C88), ref: 005AD9B6
GetLastError.KERNEL32 ref: 005AD9CD
GetLastError.KERNEL32 ref: 005ADA2D
CloseHandle.KERNEL32(?), ref: 005ADB66
CloseHandle.KERNEL32(000000FF), ref: 005ADB7C
CloseHandle.KERNEL32(?), ref: 005ADB92
CloseHandle.KERNEL32(0061417B), ref: 005ADBA5

Strings

Error initializing ShellProcess instance, xrefs: 005ADA6E
SeIncreaseQuotaPrivilege, xrefs: 005AD9FE
CreateProcessWithTokenW failed: , xrefs: 005ADB1E
OpenProcessToken failed: , xrefs: 005AD9D3
Can't get primary token: , xrefs: 005ADAA5
AdjustTokenPrivileges failed: , xrefs: 005ADA35

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: CloseHandle$ErrorLast$CurrentProcess
String ID: AdjustTokenPrivileges failed: $Can't get primary token: $CreateProcessWithTokenW failed: $Error initializing ShellProcess instance$OpenProcessToken failed: $SeIncreaseQuotaPrivilege
API String ID: 3632137366-433953778
Opcode ID: 9ca298a1cd2a92221830ab0e88775d903e4dccff9c4a534e82252d867ee3fdde
Instruction ID: 056f764fef423e5fd88bb3eab45b62db3e46569cdc843149ec300b82d97a2ca7
Opcode Fuzzy Hash: 9ca298a1cd2a92221830ab0e88775d903e4dccff9c4a534e82252d867ee3fdde
Instruction Fuzzy Hash: 49617F70E402199BDF10AFB4DC0ABAEBBB9BF46320F118165E516B72D1DB7499058FB0

Function 005CEBE3 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 005CEBE3

Part of subcall function 005CEC0A: InitializeCriticalSectionAndSpinCount.KERNEL32(0064BC04,00000FA0,A7D6A816,?,?,?,?,0060F620,000000FF), ref: 005CEC39
Part of subcall function 005CEC0A: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,0060F620,000000FF), ref: 005CEC44
Part of subcall function 005CEC0A: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,0060F620,000000FF), ref: 005CEC55
Part of subcall function 005CEC0A: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 005CEC6B
Part of subcall function 005CEC0A: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 005CEC79
Part of subcall function 005CEC0A: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 005CEC87
Part of subcall function 005CEC0A: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 005CECB2
Part of subcall function 005CEC0A: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 005CECBD

___scrt_fastfail.LIBCMT ref: 005CEC04

Part of subcall function 005CF0BB: __onexit.LIBCMT ref: 005CF0C1

Strings

WakeAllConditionVariable, xrefs: 005CEC7F
InitializeConditionVariable, xrefs: 005CEC65
kernel32.dll, xrefs: 005CEC50
SleepConditionVariableCS, xrefs: 005CEC71
api-ms-win-core-synch-l1-2-0.dll, xrefs: 005CEC3F

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: a249c9e947636d50aae343890f12ead103bb31ad65dc38bb1bb8ea3403674dcd
Instruction ID: 0905bd244065bfe088af325538a12196f2e2cb179e4a7c14ad6c9866cc2c7934
Opcode Fuzzy Hash: a249c9e947636d50aae343890f12ead103bb31ad65dc38bb1bb8ea3403674dcd
Instruction Fuzzy Hash: B2210A32A41212BFC71157F49C8FFA63BAAFB45B20F05552EF801D7281CF608C408661

Function 005AEA80 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 306COMMON

Download Yara Rule

APIs

Part of subcall function 00563AB0: GetProcessHeap.KERNEL32 ref: 00563AF1
Part of subcall function 00563AB0: __Init_thread_footer.LIBCMT ref: 00563B1C
Part of subcall function 00563AB0: __Init_thread_footer.LIBCMT ref: 00563B9A

OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 005AEAF8
K32GetModuleFileNameExW.KERNEL32(00000000,00000000,?,00000104), ref: 005AEB53
CloseHandle.KERNEL32(00000000), ref: 005AEB90
GetLastError.KERNEL32 ref: 005AEBC3
GetCurrentDirectoryW.KERNEL32(00000104,00000010), ref: 005AEC5C
_wcsstr.LIBVCRUNTIME ref: 005AEC9F
GetLastError.KERNEL32 ref: 005AED7C

Strings

Couldn't call OpenProcess() on parent process, error = 0x%08X, xrefs: 005AEBCD
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\setuputils.cpp, xrefs: 005AEBE0, 005AED9C, 005AF4D6
Unable to get pathname for parent process, xrefs: 005AF4CC
\Setup.exe, xrefs: 005AED59
Trend Micro, xrefs: 005AEC99
Guessing the pathname of parent process is '%s', xrefs: 005AED6A
GetCurrentDirectory() failed, error = 0x%08X, xrefs: 005AED86

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorInit_thread_footerLastProcess$CloseCurrentDirectoryFileHandleHeapModuleNameOpen_wcsstr
String ID: Couldn't call OpenProcess() on parent process, error = 0x%08X$GetCurrentDirectory() failed, error = 0x%08X$Guessing the pathname of parent process is '%s'$Trend Micro$Unable to get pathname for parent process$\Setup.exe$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\setuputils.cpp
API String ID: 2885450883-3265580049
Opcode ID: 78f46c5b8fe3960b9eb98b293f382f146721d1dde472912a8fff63697e61cde9
Instruction ID: 7e322c8a482a2a69c1ae56a429fa326df80194ce8eac9374c9ee6dfa583c081c
Opcode Fuzzy Hash: 78f46c5b8fe3960b9eb98b293f382f146721d1dde472912a8fff63697e61cde9
Instruction Fuzzy Hash: 6DB1CF70A00206DFDB04DF68C99ABAEBBB5FF45310F14816DE906EB291DB759D04CBA0

Function 005A67F0 Relevance: 24.3, APIs: 2, Strings: 14, Instructions: 347COMMON

Download Yara Rule

Strings

MBRW-C, xrefs: 005A6990
8~d, xrefs: 005A6C80
Installer service has completed, xrefs: 005A728E
InstallerService has stopped, xrefs: 005A6FB0
`}d, xrefs: 005A6A8A
Waiting for InstallerService to stop..., xrefs: 005A6F88
P~d, xrefs: 005A6BE2
MBAM-C, xrefs: 005A6861, 005A698B, 005A699C
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp, xrefs: 005A6F54, 005A6F92, 005A6FBA, 005A7298
~d, xrefs: 005A6C07
release, xrefs: 005A6AAF, 005A6ABB
Waiting for InstallerService to start..., xrefs: 005A6F4A
\Malwarebytes\MB3Service, xrefs: 005A69CE
consumer, xrefs: 005A6915

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID: ~d$8~d$Installer service has completed$InstallerService has stopped$MBAM-C$MBRW-C$P~d$Waiting for InstallerService to start...$Waiting for InstallerService to stop...$\Malwarebytes\MB3Service$`}d$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp$consumer$release
API String ID: 0-3758201032
Opcode ID: 10cc2a0d78984379bef91910b3d8208b44f44ad85f6a83528c4dd5816eabfd03
Instruction ID: 5b3298b40677dd59d9cd6cffc26c8c640f0aba59b403843aca1006836b225a72
Opcode Fuzzy Hash: 10cc2a0d78984379bef91910b3d8208b44f44ad85f6a83528c4dd5816eabfd03
Instruction Fuzzy Hash: 42E1BC34A09299CEDF10DFA4DC58BEDBFB2BF5A304F1455A8D455A7252C7309A84CFA0

Function 005B1700 Relevance: 23.2, APIs: 1, Strings: 12, Instructions: 496COMMON

Download Yara Rule

APIs

Part of subcall function 005B7C10: __CxxThrowException@8.LIBVCRUNTIME ref: 005B7D64

GetModuleFileNameA.KERNEL32(00000000,?,00000104,source,competitor,0000000A,00000011,00000000), ref: 005B1BBD

Strings

Start Uninstaller, xrefs: 005B17E1
FileVersion, xrefs: 005B1DB2
other, xrefs: 005B19ED
callerSignatureName, xrefs: 005B18FA
app_version, xrefs: 005B1E62
source, xrefs: 005B1A00, 005B1A67, 005B1B3F
event_type, xrefs: 005B17F4
power uninstaller, xrefs: 005B1A55
competitor, xrefs: 005B1B2C
callerApplication, xrefs: 005B1876
PathName, xrefs: 005B1CB5
event_properties, xrefs: 005B184E, 005B18D2, 005B1966, 005B1C03, 005B1D94

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Exception@8FileModuleNameThrow
String ID: FileVersion$PathName$Start Uninstaller$app_version$callerApplication$callerSignatureName$competitor$event_properties$event_type$other$power uninstaller$source
API String ID: 3586071557-2772144801
Opcode ID: 3dd18331fd3ff26c1ffde47d15e8b16d79221fe1cdda195b9df57a5611ceb8f4
Instruction ID: 2e640fdb5f506626e5c60b3ecd10f64c974b0d3f689bcff858e55ef6bfcae344
Opcode Fuzzy Hash: 3dd18331fd3ff26c1ffde47d15e8b16d79221fe1cdda195b9df57a5611ceb8f4
Instruction Fuzzy Hash: DF3259308047A98EDB66CB28CC557DEBFB1AF9A300F1486D9D48967381DB716E84CF91

Function 00607037 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 375COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0060707F
_free.LIBCMT ref: 006070A3
_free.LIBCMT ref: 006070B0
_free.LIBCMT ref: 006070D5
_free.LIBCMT ref: 006070E2
_free.LIBCMT ref: 006070EB
_free.LIBCMT ref: 006073C6
_free.LIBCMT ref: 006073CE

Strings

qd, xrefs: 00607065, 0060734B

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: _free
String ID: qd
API String ID: 269201875-2563406186
Opcode ID: cdfebb74ceac04ef24bc6fc3daf632b558ccc152e0c92d8f80e31abfaf59a772
Instruction ID: 0e5454dbfc2f60850ff0ca9ebf9455a731c28b6af10335655168f3c629c15395
Opcode Fuzzy Hash: cdfebb74ceac04ef24bc6fc3daf632b558ccc152e0c92d8f80e31abfaf59a772
Instruction Fuzzy Hash: D6C17676E40209ABEB64DA98CC42FEF77B9AF44700F140154FA44FB2C2D674AE419BA4

Function 005A7950 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 233COMMON

Download Yara Rule

APIs

Part of subcall function 005A03A0: ___std_fs_get_temp_path@4.LIBCPMT ref: 005A0457

UuidCreate.RPCRT4(?), ref: 005A7A21
UuidToStringW.RPCRT4(?,00000000), ref: 005A7A37
RpcStringFreeW.RPCRT4(00000000), ref: 005A7A82
CreateDirectoryW.KERNEL32(?,0000000C), ref: 005A7B30
GetLastError.KERNEL32(?,0000000C), ref: 005A7B3A
LocalFree.KERNEL32(00000000), ref: 005A7BAD

Strings

Error %d calling ConvertStringSecurityDescriptorToSecurityDescriptor, xrefs: 005A7B65
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp, xrefs: 005A7B78
\MBAMTemp_, xrefs: 005A7A8B
Error %d calling CreateDirectory, xrefs: 005A7B44
D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY), xrefs: 005A7AFA

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: CreateFreeStringUuid$DirectoryErrorLastLocal___std_fs_get_temp_path@4
String ID: D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)$Error %d calling ConvertStringSecurityDescriptorToSecurityDescriptor$Error %d calling CreateDirectory$\MBAMTemp_$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp
API String ID: 1193072381-2401379638
Opcode ID: 6f78330aae6810763d8d6eade270342f989566e53a84f703c1588f35ad186c03
Instruction ID: 642413772a5ba2d68e35353358d6d7fe2c01b3dbbf9741dadc7a03f39da51579
Opcode Fuzzy Hash: 6f78330aae6810763d8d6eade270342f989566e53a84f703c1588f35ad186c03
Instruction Fuzzy Hash: 3B81B371E0410DDBDF04DFA8DD59BDEBBB9BF89314F148129E405A7291EB74AA04CBA0

Function 0056AD70 Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 412fileCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000102), ref: 0056ADC9
CreateFileW.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 0056AE4F
DeviceIoControl.KERNEL32(00000000,002D1080,00000000,00000000,?,0000000C,00000000,00000000), ref: 0056AE71
GetLastError.KERNEL32 ref: 0056AEF5
GetLastError.KERNEL32 ref: 0056AFC2

Part of subcall function 00567AF0: _com_util::ConvertStringToBSTR.COMSUPP ref: 00567B50

GetLastError.KERNEL32 ref: 0056B10D
GetLastError.KERNEL32 ref: 0056B2B3

Strings

serialNumber, xrefs: 0056B19B
\\?\%s, xrefs: 0056AE04
WQL, xrefs: 0056B010
SELECT SerialNumber FROM Win32_DiskDrive WHERE Index=%u, xrefs: 0056AE8B

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast$ControlConvertCreateDeviceDirectoryFileStringSystem_com_util::
String ID: SELECT SerialNumber FROM Win32_DiskDrive WHERE Index=%u$WQL$\\?\%s$serialNumber
API String ID: 3798684952-34720505
Opcode ID: f15bea2cd251fd4ad5b46bd0b006341397fe75fc85b02e8b0f5809587231f195
Instruction ID: 7cba4c8fef3d70c09e4d7e0458315b22a0bf123b6e214e0b827c3cc43c9c1aa2
Opcode Fuzzy Hash: f15bea2cd251fd4ad5b46bd0b006341397fe75fc85b02e8b0f5809587231f195
Instruction Fuzzy Hash: 5EF18174A017189BEB20DB64DC59BABBBB8BF44715F144198E509EB2C0DBB4AE84CF50

Function 005A2AC0 Relevance: 19.6, APIs: 2, Strings: 9, Instructions: 354COMMON

Download Yara Rule

APIs

Part of subcall function 00563AB0: GetProcessHeap.KERNEL32 ref: 00563AF1
Part of subcall function 00563AB0: __Init_thread_footer.LIBCMT ref: 00563B1C
Part of subcall function 00563AB0: __Init_thread_footer.LIBCMT ref: 00563B9A

Part of subcall function 0057C130: FindResourceW.KERNEL32(00000000,?,00000006,?,0063066C,00540053,?,005A9AA7,00540053), ref: 0057C159

MulDiv.KERNEL32(00000000,00000064,00000000), ref: 005A2E28
MulDiv.KERNEL32(00000001,00000064,00000000), ref: 005A2E52

Strings

System\CurrentControlSet\Services\, xrefs: 005A2B54, 005A2B6A, 005A2B74
Unable to query installer service registry settings, xrefs: 005A2D72
MaxStep, xrefs: 005A2C36
StepName, xrefs: 005A2CA4
\Parameters, xrefs: 005A2B93
MBAMInstallerService, xrefs: 005A2B80
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp, xrefs: 005A2D7C, 005A2DDC
Failed to open installer service registry settings (0x%08X), xrefs: 005A2DC6
CurrentStep, xrefs: 005A2C01

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Init_thread_footer$FindHeapProcessResource
String ID: CurrentStep$Failed to open installer service registry settings (0x%08X)$MBAMInstallerService$MaxStep$StepName$System\CurrentControlSet\Services\$Unable to query installer service registry settings$\Parameters$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp
API String ID: 71542580-1114970643
Opcode ID: d3a34f0f448c3df3cc76033a51a4610dda4e75861634e059a6eca233cc5ea1d8
Instruction ID: e48eb8a184d6b27ac6ebb508f0172829f434288e97e94fa414254f97e02e04c5
Opcode Fuzzy Hash: d3a34f0f448c3df3cc76033a51a4610dda4e75861634e059a6eca233cc5ea1d8
Instruction Fuzzy Hash: 2CD1E370A01616DFDB10DFA8C85ABAEBBB5FF46314F144129E902AB391DB309D45CB91

Function 00607459 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 201COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006074C7
_free.LIBCMT ref: 006074D3
_free.LIBCMT ref: 006075FC
_free.LIBCMT ref: 00607607

Strings

qd, xrefs: 00607655
qd, xrefs: 00607484, 0060763E

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: _free
String ID: qd$qd
API String ID: 269201875-3293192540
Opcode ID: 566cc87daa53dd2c83a8545639c252e771809bd3afa55544564f893e5d6a0776
Instruction ID: 58cb9360d22d889c19dd4196dae3894219a488e2a1b64b02b3769b8a4907c1e4
Opcode Fuzzy Hash: 566cc87daa53dd2c83a8545639c252e771809bd3afa55544564f893e5d6a0776
Instruction Fuzzy Hash: 2561C375D446099FDB25DF68C841BABBBFAFF84310F144469E945EB281EB70AD018BA0

Function 00577640 Relevance: 18.3, APIs: 3, Strings: 9, Instructions: 302COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 005778D9
GetLastError.KERNEL32 ref: 0057768E

Part of subcall function 005BF3E0: _strftime.LIBCMT ref: 005BF444

GetLastError.KERNEL32 ref: 0057776D

Strings

status: , xrefs: 0057795D
, status: , xrefs: 0057789C
appears to be stopped, xrefs: 005779F1
Error opening SCM: , xrefs: 005776ED
Error getting , xrefs: 00577945
MBAMInstallerService, xrefs: 00577750, 005777E3, 00577890, 00577951, 005779E5
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\installerservicefactory.cpp, xrefs: 005776BD, 005777B3, 00577854, 00577915, 005779B5
: Service not found: , xrefs: 005777D7
Error opening , xrefs: 00577884

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast$_strftime
String ID: appears to be stopped$ status: $, status: $: Service not found: $Error getting $Error opening $Error opening SCM: $MBAMInstallerService$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\installerservicefactory.cpp
API String ID: 2787424584-3475449026
Opcode ID: 52d54912ad480d055c12125e4cdeaaa4729cd54f9f1f2d06b6b1fbdc7a333f06
Instruction ID: ae70a29cb66754a0eb67ce5fdb16b702d279aa37ac89b67597cd7d037411b847
Opcode Fuzzy Hash: 52d54912ad480d055c12125e4cdeaaa4729cd54f9f1f2d06b6b1fbdc7a333f06
Instruction Fuzzy Hash: 56A1B270F102459BDF08ABB4B85EA6E7EA7FBC5300F509878E4069B386EE34DD019765

Function 00578340 Relevance: 18.3, APIs: 3, Strings: 9, Instructions: 277COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 005783B5

Strings

, status: , xrefs: 00578515
Uninstall of CTSDK is not supported, xrefs: 00578374
Error opening SCM: , xrefs: 00578414
MBAMInstallerService, xrefs: 00578477, 00578509
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\installerservicefactory.cpp, xrefs: 005783E4, 005784CD, 005785BC, 00578630
DeleteSerivce Failed: , xrefs: 005785EC
Installer Service removed, xrefs: 00578660
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\installerservicefactory.cpp, xrefs: 0057837E
Error opening , xrefs: 005784FD

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast
String ID: , status: $DeleteSerivce Failed: $Error opening $Error opening SCM: $Installer Service removed$MBAMInstallerService$Uninstall of CTSDK is not supported$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\installerservicefactory.cpp$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\installerservicefactory.cpp
API String ID: 1452528299-163356504
Opcode ID: 7e3cf28c81db5e93507abd6abd1b1be8da402522f76cbcaaf2c56b2539811be9
Instruction ID: ae06ad145686c8e951c0143c523ff54b8cc1b56bd46a03e4ae98c5d42d725106
Opcode Fuzzy Hash: 7e3cf28c81db5e93507abd6abd1b1be8da402522f76cbcaaf2c56b2539811be9
Instruction Fuzzy Hash: 6F919370F002519BDF08ABB4F89EA6E7EA7FBC5304F509878E4069B396DE34D9009765

Function 00594750 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 215processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000400,00000000,00000000,00000044,?,?,?,?,A7D6A816,76E20F00,00000001), ref: 00594927
CloseHandle.KERNEL32(?,?,?,?,A7D6A816,76E20F00,00000001), ref: 00594944
CloseHandle.KERNEL32(?,?,?,?,A7D6A816,76E20F00,00000001), ref: 0059494C
GetLastError.KERNEL32(?,?,?,A7D6A816,76E20F00,00000001), ref: 00594953

Part of subcall function 005BF3E0: _strftime.LIBCMT ref: 005BF444

MulDiv.KERNEL32(?,00000064), ref: 00594A57

Strings

: Error , xrefs: 0059488A, 005949AC
lb, xrefs: 00594800
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp, xrefs: 00594866, 00594988
calling wcscpy_s, xrefs: 0059489E
calling CreateProcess, xrefs: 005949C0

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: CloseHandle$CreateErrorLastProcess_strftime
String ID: calling CreateProcess$ calling wcscpy_s$: Error $c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp$lb
API String ID: 2081619633-2551205894
Opcode ID: 4e0112c9d7ba7e32128ccd5fbafcf63a643c325e651e0199dbd2555d48040084
Instruction ID: c377e9b23bcdcf030bfd2e25a072ea68373454757447da840c7eaa24d535d42b
Opcode Fuzzy Hash: 4e0112c9d7ba7e32128ccd5fbafcf63a643c325e651e0199dbd2555d48040084
Instruction Fuzzy Hash: 84710771E002559BDF14EB64DC4EB9E7BB6FBC5300F1046A9E409A7281EE749E80CFA5

Function 005BE070 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

__Getcvt.LIBCPMT ref: 005BE0AE
__Getcvt.LIBCPMT ref: 005BE0D3

Strings

true, xrefs: 005BE169
false, xrefs: 005BE130

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Getcvt
String ID: false$true
API String ID: 1921796781-2658103896
Opcode ID: 37f97e9810fa2ac4b7f83c6875c9db613517bb66ba520221001b78a0fe199702
Instruction ID: 514190c8f62bccf3ef9900ff95aa3101835122e12d39f12364b8eb44a87ff1e3
Opcode Fuzzy Hash: 37f97e9810fa2ac4b7f83c6875c9db613517bb66ba520221001b78a0fe199702
Instruction Fuzzy Hash: FF514571E042459FDB14DF68C842BAABFB5FBC1310F18816EEC455B381D776A904CBA1

Function 005673F0 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 155libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000060,?,00000000), ref: 0056747D
LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00000000), ref: 0056748F
FindResourceW.KERNEL32(00000000,00000000,?,?,00000000), ref: 005674B6
LoadResource.KERNEL32(00000000,00000000,?,00000000), ref: 005674CE

Part of subcall function 00565850: GetLastError.KERNEL32(00567790), ref: 00565850

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000000), ref: 005675BF

Strings

Module_Raw, xrefs: 005678DC
REGISTRY, xrefs: 0056790D
Module, xrefs: 005678BE

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: LibraryLoad$Resource$ErrorFindFreeLast
String ID: Module$Module_Raw$REGISTRY
API String ID: 328770362-549000027
Opcode ID: 971e5a27aa0cc11d4d3a48ee728b96f349d6a65a43f76b4883755095717bf36f
Instruction ID: ce065cd053acb9a19119d5bf5a2c7fc6e95b3f6b5dd96bc54d12696dce2a5112
Opcode Fuzzy Hash: 971e5a27aa0cc11d4d3a48ee728b96f349d6a65a43f76b4883755095717bf36f
Instruction Fuzzy Hash: 4E51E3B1A0421EDBCB20DF64CC55BAEBFB5FB9C714F604099F506A3241DB309E408B69

Function 005A6F84 Relevance: 16.8, APIs: 2, Strings: 9, Instructions: 349sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,?,00647C88,?,?,00000000,?,00647E38,?,?,?,00000000), ref: 005A6F75
Sleep.KERNEL32(000003E8,?,?,?,00647C88,?,?,00000000,?,00647E38,?,?,?,00000000), ref: 005A6FA5

Part of subcall function 00577640: GetLastError.KERNEL32 ref: 0057768E

Strings

InstallerService has stopped, xrefs: 005A6FB0
https://www.malwarebytes.com/jobs, xrefs: 005A71EE
Waiting for InstallerService to stop..., xrefs: 005A6F88
### InstallerService error status = %u, xrefs: 005A7090
setting rebootRequired to true, xrefs: 005A7107
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp, xrefs: 005A6F92, 005A6FBA, 005A70A3, 005A70CA, 005A7111, 005A71B8, 005A7298
### InstallerService error detail = [%hs], xrefs: 005A70B6
Installer Service error status %d (%hs), xrefs: 005A717D
Installer service has completed, xrefs: 005A728E

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Sleep$ErrorLast
String ID: ### InstallerService error detail = [%hs]$### InstallerService error status = %u$Installer Service error status %d (%hs)$Installer service has completed$InstallerService has stopped$Waiting for InstallerService to stop...$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp$https://www.malwarebytes.com/jobs$setting rebootRequired to true
API String ID: 1161615009-3236083223
Opcode ID: c4ebaff894f990f27bff44f58d44ecb87691500d71a1a15b68461867d8b08c93
Instruction ID: 981a124b3ce70d5eab997e72ce9289652d87c88b08762f85fb626a3ae9fba2cc
Opcode Fuzzy Hash: c4ebaff894f990f27bff44f58d44ecb87691500d71a1a15b68461867d8b08c93
Instruction Fuzzy Hash: AFC13431A051498BEF04DB68EC49B6E7F73BFCA314F148168E405AB392DB359A80CB91

Function 0057CCD0 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 285COMMON

Download Yara Rule

Strings

\\.\pipe\MBLG, xrefs: 0057CF21
CoGetClassObject failed: , xrefs: 0057CDE9
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbamservice.cpp, xrefs: 0057CDB9, 0057D1A8
NeedAKey, xrefs: 0057CF1C
: CreateLicenseLic failed: , xrefs: 0057D1CC

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID: : CreateLicenseLic failed: $CoGetClassObject failed: $NeedAKey$\\.\pipe\MBLG$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbamservice.cpp
API String ID: 0-361404667
Opcode ID: 6937c78b693b49d4ae568ee34b0524d74960f096c87b7510a51e56da6139d48a
Instruction ID: 6a096a49b1eeeb290830bbe3e977192b88569bff11d5062fc7f135d03da9b3eb
Opcode Fuzzy Hash: 6937c78b693b49d4ae568ee34b0524d74960f096c87b7510a51e56da6139d48a
Instruction Fuzzy Hash: 5FB18F70E002588BDB24DB64EC5979EBBF6BF84304F14C5A8E449A7281DF749E84CFA1

Function 00565000 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,A7D6A816), ref: 005650A0
GetLastError.KERNEL32 ref: 005650AA
EnterCriticalSection.KERNEL32(?), ref: 00565108
LeaveCriticalSection.KERNEL32(?,?,?), ref: 00565127
GetModuleFileNameW.KERNEL32(00560000,?,00000104), ref: 00565171
GetModuleHandleW.KERNEL32(00000000), ref: 005651EB

Part of subcall function 005CF23D: ___report_securityfailure.LIBCMT ref: 005CF242

Strings

Module_Raw, xrefs: 005652CC
REGISTRY, xrefs: 005652FE
Module, xrefs: 005652AE

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: CriticalSection$Module$EnterErrorFileHandleInitializeLastLeaveName___report_securityfailure
String ID: Module$Module_Raw$REGISTRY
API String ID: 3495667763-549000027
Opcode ID: 0ac2995a6f85adcb6f29d4dcd65eec4bb02210f90cbfd2cab115b3d92a0282e8
Instruction ID: 712710471eeebd77ac55f994977d24b59a0be6624adb321dc76bd5951e32dfcf
Opcode Fuzzy Hash: 0ac2995a6f85adcb6f29d4dcd65eec4bb02210f90cbfd2cab115b3d92a0282e8
Instruction Fuzzy Hash: 0C919235A40A299BCB20DB64CC54BEA7B75BF8A700F4445D9E80EA3650FB319E84CF91

Function 005E421D Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 005E4236

Part of subcall function 005E4505: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,005E3F69), ref: 005E4515

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 005E424B
std::invalid_argument::invalid_argument.LIBCONCRT ref: 005E425A
__CxxThrowException@8.LIBVCRUNTIME ref: 005E4268
Concurrency::details::FreeVirtualProcessorRoot::Affinitize.LIBCONCRT ref: 005E42DE
std::invalid_argument::invalid_argument.LIBCONCRT ref: 005E431E
__CxxThrowException@8.LIBVCRUNTIME ref: 005E432C

Strings

pContext, xrefs: 005E4316
switchState, xrefs: 005E4252

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Concurrency::details::$Exception@8FreeProcessorRoot::ThrowVirtualstd::invalid_argument::invalid_argument$AffinitizeExecutionIdleObjectProxy::ResetSingleSuspendThreadWait
String ID: pContext$switchState
API String ID: 3151764488-2660820399
Opcode ID: b519fa97559b08e2ac46ba733524c9a8eb7744110844c4b2b78b1ddbbf5989b6
Instruction ID: 29ac70a0d9b74e0529ecebf346bbd314c28e52907539a0db3494870c20f85e68
Opcode Fuzzy Hash: b519fa97559b08e2ac46ba733524c9a8eb7744110844c4b2b78b1ddbbf5989b6
Instruction Fuzzy Hash: 5E31E735A00255ABCF0DEFA5C485A6D7BBABF94310F25486AE95197381DB70DD01CA90

Function 005A18A0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,PNG,000008C4,c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp,005A9E61,?,?,?,?,?,?,?,?,00000000,00613468), ref: 005A18C6
SizeofResource.KERNEL32(?,00000000,?,?,PNG,000008C4,c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp,005A9E61), ref: 005A18D9
LoadResource.KERNEL32(?,?,?,00000000,?,?,PNG,000008C4,c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp,005A9E61), ref: 005A18EF
LockResource.KERNEL32(00000000,?,00000000,?,?,PNG,000008C4,c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp,005A9E61), ref: 005A18FA
GlobalAlloc.KERNEL32(00000042,00000000,?,00000000,?,?,PNG,000008C4,c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp,005A9E61), ref: 005A1906
GlobalLock.KERNEL32(00000000), ref: 005A1913
GlobalFree.KERNEL32(00000000), ref: 005A1991

Strings

c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp, xrefs: 005A18B1
PNG, xrefs: 005A18B3

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Resource$Global$Lock$AllocFindFreeLoadSizeof
String ID: PNG$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp
API String ID: 2456118484-2180702756
Opcode ID: 7c7b7eb4039309a6b9fe0a62b88b2fda4bc870dd2058b570e9a9c87f780e8d21
Instruction ID: 7009cbf0b7e80ccc94bda05402d3a2aaf9b1c4ecb072287a9478e3de2f48f95d
Opcode Fuzzy Hash: 7c7b7eb4039309a6b9fe0a62b88b2fda4bc870dd2058b570e9a9c87f780e8d21
Instruction Fuzzy Hash: B8316975E00619AFDB109FB5DC58ABFBFB9FF89741F04955AA805E3250DB708940CB60

Function 005D8FED Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 005D900F
GetCurrentProcess.KERNEL32(000000FF,00000000), ref: 005D9019
DuplicateHandle.KERNEL32(00000000), ref: 005D9020
SafeRWList.LIBCONCRT ref: 005D903F

Part of subcall function 005D700E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 005D701F
Part of subcall function 005D700E: List.LIBCMT ref: 005D7029

std::invalid_argument::invalid_argument.LIBCONCRT ref: 005D9051
GetLastError.KERNEL32 ref: 005D9060
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 005D9076
__CxxThrowException@8.LIBVCRUNTIME ref: 005D9084

Strings

eventObject, xrefs: 005D9049

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: CurrentListProcess$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateErrorException@8HandleLastLock::_ReaderSafeThrowWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1999291547-1680012138
Opcode ID: 14afa9188de07447673eb186a8da91bd2b234ad47cb589700ad5e9a8d0e661bc
Instruction ID: 2a9a75ec5f99f2461d81c3e5ec473e24124cc01f4c0259121860c7b7f8b4dfd6
Opcode Fuzzy Hash: 14afa9188de07447673eb186a8da91bd2b234ad47cb589700ad5e9a8d0e661bc
Instruction Fuzzy Hash: CE11C271600205EBDB24EBA8DC1DFEE7BBDBB44751F10852BB106E2290DB749945C661

Function 0058A6E0 Relevance: 15.5, APIs: 1, Strings: 9, Instructions: 482COMMON

Download Yara Rule

Strings

unknown, xrefs: 0058A989
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp, xrefs: 0058A722, 0058AB72, 0058ABF7
https://links.malwarebytes.com/support/mb/windows/security-other-av, xrefs: 0058AB84
changing service install status code from %u to %d, xrefs: 0058ABE3
Rebuttal, xrefs: 0058AB54
open, xrefs: 0058AB89
lang_code, xrefs: 0058A8FF
User elected to keep us, yay!, xrefs: 0058AB68
Enter DoUninstall, xrefs: 0058A70E

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID: Enter DoUninstall$Rebuttal$User elected to keep us, yay!$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp$changing service install status code from %u to %d$https://links.malwarebytes.com/support/mb/windows/security-other-av$lang_code$open$unknown
API String ID: 0-1498316301
Opcode ID: 75a35f3140446080b3adfba68cc4eda6455b28251c419b6eb47cd3c241725419
Instruction ID: 114d0169b92f5e4d98868afebdb24f4859179178e97c0c116d7aff4c58d86955
Opcode Fuzzy Hash: 75a35f3140446080b3adfba68cc4eda6455b28251c419b6eb47cd3c241725419
Instruction Fuzzy Hash: F912D734A05259DFEB10EF68CC89B9DBBB1FF45314F148199E809AB291DB709E44CF92

Function 005741F0 Relevance: 15.3, APIs: 2, Strings: 8, Instructions: 336COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00574423
GetLastError.KERNEL32 ref: 005742EB

Part of subcall function 005BF3E0: _strftime.LIBCMT ref: 005BF444

Strings

, status: , xrefs: 005744A3
Error opening SCM: , xrefs: 0057434A
Created service , xrefs: 0057455A
Error creating , xrefs: 0057448B
MBAMInstallerService, xrefs: 00574406, 00574497, 00574566
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\installerservicefactory.cpp, xrefs: 00574252, 0057431A, 0057445B, 0057452A
: Error - empty service path, xrefs: 00574276
Malwarebytes Installer Service, xrefs: 00574401

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast$_strftime
String ID: , status: $: Error - empty service path$Created service $Error creating $Error opening SCM: $MBAMInstallerService$Malwarebytes Installer Service$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\installerservicefactory.cpp
API String ID: 2787424584-4122937538
Opcode ID: 76e3950178357ce1c58013f27f998c727d8fc393d49ef34e81a79c45bd67baab
Instruction ID: b0da309c34098978c54292c90f9ff4530cbb191b2c706b603d8d1922a1249d3e
Opcode Fuzzy Hash: 76e3950178357ce1c58013f27f998c727d8fc393d49ef34e81a79c45bd67baab
Instruction Fuzzy Hash: 70B1B770B102459BDF08EB74EC9DBAE7EA7FBC5304F508928E0059B296DB34DD418B65

Function 00577280 Relevance: 15.3, APIs: 3, Strings: 7, Instructions: 290COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,00000000,006108F0,000000FF), ref: 00577561
GetLastError.KERNEL32(?,?,?,?,00000000,006108F0,000000FF,?,00573865,00000000,?), ref: 005772CE

Part of subcall function 005BF3E0: _strftime.LIBCMT ref: 005BF444

GetLastError.KERNEL32(?,?,?,?,00000000,006108F0,000000FF,?,00573865,00000000,?), ref: 005773AD

Strings

, status: , xrefs: 0057742E, 005775D9
: Error starting , xrefs: 005775C1
Error opening SCM: , xrefs: 0057732D
MBAMInstallerService, xrefs: 00577390, 00577422, 0057748D, 005774FD, 005775CD
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\installerservicefactory.cpp, xrefs: 005772FD, 005773E6, 005774CD, 0057759D
Error opening , xrefs: 00577416
: Success starting , xrefs: 005774F1

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast$_strftime
String ID: , status: $: Error starting $: Success starting $Error opening $Error opening SCM: $MBAMInstallerService$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\installerservicefactory.cpp
API String ID: 2787424584-2075151379
Opcode ID: df99001728a75e99bcd93edc751dbb4c9af29763ccc853a0239123e23b632b8e
Instruction ID: c6af7e3790e903b8c807cbb144ff1af84a5b10ab8d5a1aef905314cfc7092d36
Opcode Fuzzy Hash: df99001728a75e99bcd93edc751dbb4c9af29763ccc853a0239123e23b632b8e
Instruction Fuzzy Hash: 4A91A670F042459BCF08ABB4F85EA6E7EA7FBC5300F508878E4169B396DE34D9009765

Function 005FCEE8 Relevance: 15.1, APIs: 10, Instructions: 70COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005FCEFE

Part of subcall function 005FD2A2: HeapFree.KERNEL32(00000000,00000000,?,00607694,?,00000000,?,?,?,00607939,?,00000007,?,?,00607D3E,?), ref: 005FD2B8
Part of subcall function 005FD2A2: GetLastError.KERNEL32(?,?,00607694,?,00000000,?,?,?,00607939,?,00000007,?,?,00607D3E,?,?), ref: 005FD2CA

_free.LIBCMT ref: 005FCF0A
_free.LIBCMT ref: 005FCF15
_free.LIBCMT ref: 005FCF20
_free.LIBCMT ref: 005FCF2B
_free.LIBCMT ref: 005FCF36
_free.LIBCMT ref: 005FCF41
_free.LIBCMT ref: 005FCF4C
_free.LIBCMT ref: 005FCF57
_free.LIBCMT ref: 005FCF65

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e4b57abda68abad87003a07f788578a791049d5bcd8501149de6990959af6f14
Instruction ID: 07b3cab685ad0d6c2909a6637298d40be08bc4533dbd7d40bd36a3bd705e0126
Opcode Fuzzy Hash: e4b57abda68abad87003a07f788578a791049d5bcd8501149de6990959af6f14
Instruction Fuzzy Hash: BC21C77A91010EAFCB01EF95C945DED7FB9FF88300F0051A6BA099B121DB39EA449B90

Function 0058547E Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 292COMMON

Download Yara Rule

APIs

___std_fs_remove@4.LIBCPMT ref: 005854C4

Part of subcall function 005CC5B6: RemoveDirectoryW.KERNEL32(?,0064B704,kernel32.dll,SetFileInformationByHandle,005CBED4,A7D6A816), ref: 005CC600

___std_fs_remove@4.LIBCPMT ref: 00585792

Part of subcall function 005CC5B6: GetLastError.KERNEL32 ref: 005CC618
Part of subcall function 005CC5B6: DeleteFileW.KERNEL32(?), ref: 005CC628
Part of subcall function 005CC5B6: GetLastError.KERNEL32 ref: 005CC632
Part of subcall function 005CC5B6: GetLastError.KERNEL32 ref: 005CC63C

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00585860

Strings

test, xrefs: 0058565B
: Error cannot write to directory: , xrefs: 005855E7
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp, xrefs: 005855C3, 00585718
: Error cannot write to directory[2]: , xrefs: 0058573C
\mbamtestfile.dat, xrefs: 0058547E

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast$___std_fs_remove@4$DeleteDirectoryFileIos_base_dtorRemovestd::ios_base::_
String ID: : Error cannot write to directory: $: Error cannot write to directory[2]: $\mbamtestfile.dat$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp$test
API String ID: 3641527832-963956224
Opcode ID: 01b95f8329c93953054933eef7cfb4dc2e2ae909917c5f99351311a68b924eb0
Instruction ID: 1b318f70c603c39fbfba2258bdae7aeba1f383c2ee636d23a9e17126b8db3aa6
Opcode Fuzzy Hash: 01b95f8329c93953054933eef7cfb4dc2e2ae909917c5f99351311a68b924eb0
Instruction Fuzzy Hash: 62B19470A101468BDF14EB64DD4AB9D7FB2FBC0304F5484A9E40AB7296EB35AA84CF51

Function 0058ECE0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 229COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,A7D6A816,00000000,?), ref: 0058ED10
GetLastError.KERNEL32(00000A8A), ref: 0058ED8D
GetLastError.KERNEL32 ref: 0058EE1B
GetLastError.KERNEL32(00000A9C), ref: 0058EE8D

Part of subcall function 005BF3E0: _strftime.LIBCMT ref: 005BF444

GetLastError.KERNEL32(00000AA2), ref: 0058EF62

Strings

SeShutdownPrivilege, xrefs: 0058EDE5
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp, xrefs: 0058ED4F, 0058EE4F, 0058EF24
Error shutting down , xrefs: 0058ED7F, 0058EE7F, 0058EF54

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast$CurrentProcess_strftime
String ID: Error shutting down $SeShutdownPrivilege$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp
API String ID: 2478002929-3507372588
Opcode ID: 5069f0a13f19c3a90a3a495957d9c0eca164951098f78b8e7a280ecf8885f42a
Instruction ID: a5b163d269936c3e882a13015821aa3eed0e9d11392590250d31a4a6ea5c9f73
Opcode Fuzzy Hash: 5069f0a13f19c3a90a3a495957d9c0eca164951098f78b8e7a280ecf8885f42a
Instruction Fuzzy Hash: C1715F70B102059BDF08BBB4EC5FB6E7EA7BBC5304F508528F506AB2D6DE3499018B65

Function 0056B3C0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 160fileCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000102), ref: 0056B41F
CreateFileW.KERNEL32(?,00000000,00000000,00000000,00000003,00000080,00000000), ref: 0056B489
DeviceIoControl.KERNEL32(00000000,002D1400,00000000,0000000C,?,00000008,?,00000000), ref: 0056B4FC
DeviceIoControl.KERNEL32(00000000,002D1400,00000000,0000000C,00000000,?,00000000,00000000), ref: 0056B551
GetLastError.KERNEL32 ref: 0056B55B
CloseHandle.KERNEL32(00000000), ref: 0056B5A4
GetLastError.KERNEL32(?,?,?,005CAB52,00000000), ref: 0056B5B1

Strings

\\?\%s, xrefs: 0056B45A

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ControlDeviceErrorLast$CloseCreateDirectoryFileHandleSystem
String ID: \\?\%s
API String ID: 3817967100-3682370727
Opcode ID: 7f8cf9c9afc3a072e5cea594a89fdb8b89c1a72f0045419944b7728c37650c9e
Instruction ID: 0f3ff69f6f64d66849108befd708acc1c0f79a466548bebfc9dcac421dc0ff0a
Opcode Fuzzy Hash: 7f8cf9c9afc3a072e5cea594a89fdb8b89c1a72f0045419944b7728c37650c9e
Instruction Fuzzy Hash: ED51DCB1E4031867E720DB619C86FEA77BCFB58700F544199BA05E7181FB70AAC4CB65

Function 00590550 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 137libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process2,A7D6A816,005CA950), ref: 00590583
GetProcAddress.KERNEL32(00000000), ref: 0059058A
GetCurrentProcess.KERNEL32(?,?), ref: 005905A2

Part of subcall function 005BF3E0: _strftime.LIBCMT ref: 005BF444

Strings

c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp, xrefs: 005905DE
, nativeMachine:, xrefs: 0059063E
processMachine: , xrefs: 0059060E
IsWow64Process2, xrefs: 00590579
kernel32, xrefs: 0059057E

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess_strftime
String ID: , nativeMachine:$IsWow64Process2$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp$kernel32$processMachine:
API String ID: 969616773-444859122
Opcode ID: fdc34c0b216c11fda4371016669d706781c4c7e9f9907858ecd47ec237d812a9
Instruction ID: 51cff0e92b2a1a5b3183597d5f6b42c313b9b04f7ac0674015781762975f3778
Opcode Fuzzy Hash: fdc34c0b216c11fda4371016669d706781c4c7e9f9907858ecd47ec237d812a9
Instruction Fuzzy Hash: E541A171F111229FCF18AB74E85AA6E7FA2FBC5710F105929E5069B3C1DE34D9108BA1

Function 005CE798 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58libraryCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(00000000,?,?,005CEB36,0064BBE8,00648398,?,?,005A9F7E,00000007,00000000,00000000,?), ref: 005CE7AA
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,00000000,?,?,005CEB36,0064BBE8,00648398,?,?,005A9F7E,00000007,00000000,00000000,?), ref: 005CE7BF
DecodePointer.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 005CE83B

Strings

AtlThunk_AllocateData, xrefs: 005CE7D0
AtlThunk_InitData, xrefs: 005CE7E7
atlthunk.dll, xrefs: 005CE7BA
AtlThunk_FreeData, xrefs: 005CE815
AtlThunk_DataToCode, xrefs: 005CE7FE

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: 197649bb0d3c3dadba79b86a27301b537b940b72692592cc5f1dfe049384b544
Instruction ID: 368a750a482c867d6dc2c9c8d8d1f4f2ec70e16696a28730ca1ab3e18ecf64f9
Opcode Fuzzy Hash: 197649bb0d3c3dadba79b86a27301b537b940b72692592cc5f1dfe049384b544
Instruction Fuzzy Hash: F001C4716842117FDB019794EC1BFCD3F56EF02B44F0E00A8BC04A62E6EB95DA448191

Function 0056A8F0 Relevance: 13.9, APIs: 6, Strings: 3, Instructions: 402COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0056A944
GetLastError.KERNEL32 ref: 0056A97B
GetLastError.KERNEL32 ref: 0056AA36

Strings

serialNumber, xrefs: 0056ABD9
SELECT serialNumber FROM Win32_PhysicalMemory, xrefs: 0056AA54
WQL, xrefs: 0056AA76

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast
String ID: SELECT serialNumber FROM Win32_PhysicalMemory$WQL$serialNumber
API String ID: 1452528299-3844046941
Opcode ID: c6ccb1e33c6d4d98a3eb320897e01b218395a8a273e30bad17d6b4891c341382
Instruction ID: 98433e1d75d3a2d924668dcc95764d4e07a27ee3e5e59d8af00b98685104dbca
Opcode Fuzzy Hash: c6ccb1e33c6d4d98a3eb320897e01b218395a8a273e30bad17d6b4891c341382
Instruction Fuzzy Hash: 96E17E70A00209DFEB20DFA4CC49BAEBBB5BF48704F244559E901BB291D774AE04CFA1

Function 00574640 Relevance: 13.7, APIs: 4, Strings: 5, Instructions: 229COMMON

Download Yara Rule

Strings

System\CurrentControlSet\Services\, xrefs: 00575000
: Failed to get current user proxy data: , xrefs: 00574E65
MBAMInstallerService, xrefs: 0057502D
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\installerservicefactory.cpp, xrefs: 00574E41
Parameters, xrefs: 0057510C

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID: : Failed to get current user proxy data: $MBAMInstallerService$Parameters$System\CurrentControlSet\Services\$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\installerservicefactory.cpp
API String ID: 0-299308311
Opcode ID: d350eea140872c8e6deae25ea62ff68352f0d5fba3682f5cee355c5c2beb4fe8
Instruction ID: df62d991694d4f577934f86cadbf86be081f2461ac20c1d0103933577e69e7bd
Opcode Fuzzy Hash: d350eea140872c8e6deae25ea62ff68352f0d5fba3682f5cee355c5c2beb4fe8
Instruction Fuzzy Hash: 0381D774E012299BDB24DB24EC59BEEBBB5FF85700F008198F909A7281DB345E84CF65

Function 00565950 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 335stringCOMMON

Download Yara Rule

APIs

_wcsstr.LIBVCRUNTIME ref: 00565A56
EnterCriticalSection.KERNEL32(?,00000001,A7D6A816,00000000,00000000), ref: 00565C07
lstrcmpiW.KERNEL32(?,?), ref: 00565C21
LeaveCriticalSection.KERNEL32(00000000), ref: 00565C39

Strings

HKCR, xrefs: 00565A50
}}, xrefs: 00565B21
HKCU{Software{Classes, xrefs: 00565A85

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: CriticalSection$EnterLeave_wcsstrlstrcmpi
String ID: }}$HKCR$HKCU{Software{Classes
API String ID: 3949508837-1142484189
Opcode ID: 14aff6370080a2e62c1476c6ca22bb4abfa607832df500d9cebaab4a0b7f1922
Instruction ID: 837269bc9471d79823acde7325c20e36f512b518f1c74279877e121f24b394b4
Opcode Fuzzy Hash: 14aff6370080a2e62c1476c6ca22bb4abfa607832df500d9cebaab4a0b7f1922
Instruction Fuzzy Hash: D5C1AA34A40B59CFDF219FA8C888BAEBFF5BF45310F544169E806AB291EB749C44CB50

Function 005B2E00 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 278COMMON

Download Yara Rule

APIs

Part of subcall function 00563AB0: GetProcessHeap.KERNEL32 ref: 00563AF1
Part of subcall function 00563AB0: __Init_thread_footer.LIBCMT ref: 00563B1C
Part of subcall function 00563AB0: __Init_thread_footer.LIBCMT ref: 00563B9A

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 005B3170

Strings

unknown, xrefs: 005B30FC
: unable to read MBAM version, xrefs: 005B30A1
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\setuputils.cpp, xrefs: 005B2F72, 005B307D
hb, xrefs: 005B3111
: read the MBAM version as , xrefs: 005B2F96
\srvversion.dat, xrefs: 005B2E9E

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Init_thread_footer$HeapIos_base_dtorProcessstd::ios_base::_
String ID: : read the MBAM version as $: unable to read MBAM version$\srvversion.dat$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\setuputils.cpp$hb$unknown
API String ID: 1166135360-3206160510
Opcode ID: aa582bc6a7a800cc4e5218342bff73d4ac762a26d21547e3d558cb3ea6b60833
Instruction ID: c36b8c91544838aed593dbe13271996fa49a85bfa7daaefb62b3446187d97813
Opcode Fuzzy Hash: aa582bc6a7a800cc4e5218342bff73d4ac762a26d21547e3d558cb3ea6b60833
Instruction Fuzzy Hash: CDA1B670A00145CBDF14DF68D859BADBFB6BF85304F1085ACE409AB391DB75AA44CF61

Function 005B2A60 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 229COMMON

Download Yara Rule

APIs

Part of subcall function 00563AB0: GetProcessHeap.KERNEL32 ref: 00563AF1
Part of subcall function 00563AB0: __Init_thread_footer.LIBCMT ref: 00563B1C
Part of subcall function 00563AB0: __Init_thread_footer.LIBCMT ref: 00563B9A

_strftime.LIBCMT ref: 005B2B57
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005B2C42

Strings

c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\setuputils.cpp, xrefs: 005B285E, 005B2958, 005B29D0, 005B2C96
%lld, xrefs: 005B2C49
calculated days since installation as '%s', xrefs: 005B2C80
InstallTime, xrefs: 005B29B1, 005B2A60, 005B2AE6
%Y-%m-%dT%H:%M:%SZ, xrefs: 005B2B43

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Init_thread_footer$HeapProcessUnothrow_t@std@@@__ehfuncinfo$??2@_strftime
String ID: %Y-%m-%dT%H:%M:%SZ$%lld$InstallTime$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\setuputils.cpp$calculated days since installation as '%s'
API String ID: 4084923012-430565177
Opcode ID: 7936a7e6cbb86ff79fc7d2d1343fff7e594895fd84aad4417478307c475b79c0
Instruction ID: c3b66946a61c20fa470037eaafb6ef3423754142d589872e423e90fa07128acb
Opcode Fuzzy Hash: 7936a7e6cbb86ff79fc7d2d1343fff7e594895fd84aad4417478307c475b79c0
Instruction Fuzzy Hash: 3291A170D00249DFEB14DFA8C849BEEBBB5FF45304F248258E414A7292DB34AA45CFA1

Function 005A2F20 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 229libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005A3060
LoadLibraryW.KERNEL32(?,\KERNEL32.DLL,0000000D,?,?), ref: 005A30EA
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 005A30F6
GetLastError.KERNEL32 ref: 005A310B
LoadLibraryW.KERNEL32(?,?,00000000,0062E774,00000001,?,?), ref: 005A3203

Strings

SetDefaultDllDirectories, xrefs: 005A30F0
\KERNEL32.DLL, xrefs: 005A30B8

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: LibraryLoad$AddressDirectoryErrorLastProcSystem
String ID: SetDefaultDllDirectories$\KERNEL32.DLL
API String ID: 2686044577-550701061
Opcode ID: eafdf4612ced553b2edbe7f049b51199ff0cd4958ca5338b2f78775d577503e2
Instruction ID: 9f393e39de83362ac3c758e52269cb72e84c58347fa9aa8e4fb988cf24d5ab9b
Opcode Fuzzy Hash: eafdf4612ced553b2edbe7f049b51199ff0cd4958ca5338b2f78775d577503e2
Instruction Fuzzy Hash: 3CA17B749002699ADF24DF64EC8DB9DBBB6FF45308F5042E8E409A7291DB749B88CF50

Function 005667B0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 100libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,A7D6A816,00000000,00000000,?,0060F580,000000FF,?,005671AF,?), ref: 005667E9
GetProcAddress.KERNEL32(00000000,RegDeleteKeyTransactedW), ref: 005667F9
GetModuleHandleW.KERNEL32(Advapi32.dll,A7D6A816,00000000,00000000,?,0060F580,000000FF,?,005671AF,?), ref: 00566859
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00566869

Strings

RegDeleteKeyTransactedW, xrefs: 005667F3
Advapi32.dll, xrefs: 005667E4, 00566854
RegDeleteKeyExW, xrefs: 00566863

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegDeleteKeyExW$RegDeleteKeyTransactedW
API String ID: 1646373207-1053001802
Opcode ID: 3079bb867f0a83c33f29c0037efd12e85d5e756a1b1db350ae61641ba3ecbf3d
Instruction ID: 8ecb779493029d0cfa2e0b9e9af2355d88bf5bea70a66c4e583fed381b071e23
Opcode Fuzzy Hash: 3079bb867f0a83c33f29c0037efd12e85d5e756a1b1db350ae61641ba3ecbf3d
Instruction Fuzzy Hash: 7231D736749644AFD721CF64EC05B95BFE9FB45B20F00413BE80193390DB75A850CBA0

Function 005AD200 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 93COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00020480,00000000,00000000), ref: 005AD257
CloseHandle.KERNEL32(00000000), ref: 005AD26B
GetLastError.KERNEL32 ref: 005AD29C

Strings

Can't open desktop shell process: , xrefs: 005AD2D0
Unable to get PID of desktop shell., xrefs: 005AD2D7
Can't get process token of desktop shell: , xrefs: 005AD28B
No desktop shell is present, xrefs: 005AD224

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: CloseErrorHandleLastOpenProcess
String ID: Can't get process token of desktop shell: $Can't open desktop shell process: $No desktop shell is present$Unable to get PID of desktop shell.
API String ID: 3453201768-1893228452
Opcode ID: e6fdf7054ee3a17f476c8db0dfc04a8b13f9ce78c992289a19ce729ef96082ec
Instruction ID: 5bf8249ed7b2315be57323b36f3d7c68c4f25c1c99006d8da07b2e47d0c69479
Opcode Fuzzy Hash: e6fdf7054ee3a17f476c8db0dfc04a8b13f9ce78c992289a19ce729ef96082ec
Instruction Fuzzy Hash: C321A6357001145B8B14AFB5A85ABFEBFAAFF8A321B505169E90BD7680DB30DD01D7B0

Function 005E8897 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 005E88EA
FindMITargetTypeInstance.LIBVCRUNTIME ref: 005E8903
FindVITargetTypeInstance.LIBVCRUNTIME ref: 005E890A
PMDtoOffset.LIBCMT ref: 005E8929

Strings

Bad dynamic_cast!, xrefs: 005E896B

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: dfa155c3c6eea963c047718eda252a7d7177700e9867e5b1369c70e5c2152da9
Instruction ID: 31baff84c7a9728b4120424f3867b32094f35e69a2c8e0a91354b41cb5ed7d87
Opcode Fuzzy Hash: dfa155c3c6eea963c047718eda252a7d7177700e9867e5b1369c70e5c2152da9
Instruction Fuzzy Hash: 6E214972A042469FCF1CDEAACD4AA7A7FB5FF84720B204559F859D3181EF30E9008691

Function 006066F5 Relevance: 12.2, APIs: 8, Instructions: 204COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0060671F
_free.LIBCMT ref: 006067F8
_free.LIBCMT ref: 00606825

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: ee9f0e7f89d9f9cf6cbbe7c4c9a826c94e76ddb982444d15ef2c7ed51c1b8033
Instruction ID: edcd55b0db9872f3d5df3981463fa1a9412b37462f8f0558e1726d0f3382246e
Opcode Fuzzy Hash: ee9f0e7f89d9f9cf6cbbe7c4c9a826c94e76ddb982444d15ef2c7ed51c1b8033
Instruction Fuzzy Hash: 6F512971984207AFDB28AFB5D845AAF7BAAFF41324F10816DF5109B3C1EB359910CB61

Function 005C4700 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 346fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,?,?), ref: 005C47E2
CloseHandle.KERNEL32(00000000,?,?,?,?,?), ref: 005C47FA

Part of subcall function 0056FEB0: std::_Lockit::_Lockit.LIBCPMT ref: 0056FEFC
Part of subcall function 0056FEB0: std::_Lockit::_Lockit.LIBCPMT ref: 0056FF1E
Part of subcall function 0056FEB0: std::_Lockit::~_Lockit.LIBCPMT ref: 0056FF3E
Part of subcall function 0056FEB0: std::_Lockit::~_Lockit.LIBCPMT ref: 0057003C

GetLastError.KERNEL32(?,?,?,?,?), ref: 005C4B83

Strings

productCode, xrefs: 005C495D
\ServiceConfig.json, xrefs: 005C4789
hb, xrefs: 005C483C

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$CloseCreateErrorFileHandleLast
String ID: \ServiceConfig.json$hb$productCode
API String ID: 3561823020-101170542
Opcode ID: bbe289216854b953386205104850e95b9d62d388b64b6ad078964c93c3a7e94c
Instruction ID: b0a6b5fbb9e4502bd4f1168573e6e9448b7bf5612804dfbf3cf064a2dc52ba3d
Opcode Fuzzy Hash: bbe289216854b953386205104850e95b9d62d388b64b6ad078964c93c3a7e94c
Instruction Fuzzy Hash: BFD18C31A002199FDF24DBA8CC99FDDBBB9BB88304F144598E509A7291DB74AF84CF50

Function 0058E270 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 0058E2CB
_wcschr.LIBVCRUNTIME ref: 0058E2F7
_wcschr.LIBVCRUNTIME ref: 0058E323
_wcsstr.LIBVCRUNTIME ref: 0058E3D1

Strings

~d, xrefs: 0058E451
8~d, xrefs: 0058E38D

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: _wcschr$_wcsstr
String ID: ~d$8~d
API String ID: 229586744-4043318950
Opcode ID: b1f5ed3a15b11b82942fab994b002bef34ac4511f1431862ac007c25528cdc16
Instruction ID: 8aea26d7d28bda8bbb18ba9b63de2643e64e95087bffe3e5a5b86842f7d957d0
Opcode Fuzzy Hash: b1f5ed3a15b11b82942fab994b002bef34ac4511f1431862ac007c25528cdc16
Instruction Fuzzy Hash: 65A1D3319006069BDB10DF68CC4ABAEBBF9FF85314F148659E811B72D1DB74AE05CB90

Function 005AE670 Relevance: 10.8, APIs: 3, Strings: 4, Instructions: 255COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00614210,000000FF), ref: 005AE6D8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005AE7CC
GetLastError.KERNEL32 ref: 005AE89C

Part of subcall function 005BF3E0: _strftime.LIBCMT ref: 005BF444

Strings

: Error calling GetFileVersionInfoSize: , xrefs: 005AE727
: Error calling GetFileVersionInfo: , xrefs: 005AE81C
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\setuputils.cpp, xrefs: 005AE706, 005AE7FB, 005AE8CB
: Error calling VerQueryValue: , xrefs: 005AE8EC

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast$_strftime
String ID: : Error calling GetFileVersionInfo: $: Error calling GetFileVersionInfoSize: $: Error calling VerQueryValue: $c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\setuputils.cpp
API String ID: 2787424584-641942999
Opcode ID: 8b51be4cae2430e6a33cbedbeb95cd0bc2dfdec8b55e9171345bbb36536f8ae7
Instruction ID: 4fa7c1e866b20847c4c1280e46dc287f7b08b48e5cfb61ccb323f8ae1ba07ae9
Opcode Fuzzy Hash: 8b51be4cae2430e6a33cbedbeb95cd0bc2dfdec8b55e9171345bbb36536f8ae7
Instruction Fuzzy Hash: 7F918474A002059BCF04DFB4D89AAAEBFB6FF85314F104529F405EB396EA34D941C765

Function 00585936 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 240COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000360), ref: 00585C41

Strings

: Error , xrefs: 005859AD, 00585A39
: OpenSCManager failed: , xrefs: 00585C33
from RegDeleteKeyW, xrefs: 005859C1
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp, xrefs: 00585986, 00585A15, 00585C0F
from RegCreateKeyEx, xrefs: 00585A4D
mbamtestkey, xrefs: 0058593C, 00585957, 00585976

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast
String ID: from RegCreateKeyEx$ from RegDeleteKeyW$: Error $: OpenSCManager failed: $c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp$mbamtestkey
API String ID: 1452528299-1488154161
Opcode ID: 00d1cda81020a85fbc9505f104e2492f718d41b845e145024ec77c156f5c6b90
Instruction ID: f7e2bbd41643bc25e03d7b4040c086346869d56d6c4a34c6de9050713206f642
Opcode Fuzzy Hash: 00d1cda81020a85fbc9505f104e2492f718d41b845e145024ec77c156f5c6b90
Instruction Fuzzy Hash: 6C719270E006169BCF14BB74EC5EA6E7FA7FBC1311F105539E406AB296EE349D008BA1

Function 0058E970 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 236COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000100), ref: 0058E9F8
GetLastError.KERNEL32 ref: 0058EA06

Part of subcall function 005BF3E0: _strftime.LIBCMT ref: 005BF444

Strings

c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp, xrefs: 0058EA38, 0058EB5F
: Error getting WinTrust version, xrefs: 0058EB83
\wintrust.dll, xrefs: 0058EAF4
: Error calling GetSystemDirectory: , xrefs: 0058EA5C

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: DirectoryErrorLastSystem_strftime
String ID: : Error calling GetSystemDirectory: $: Error getting WinTrust version$\wintrust.dll$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp
API String ID: 2769055489-3173483295
Opcode ID: 7e18ff00e12b594c62788f77a26e879df96685e0265c2d26af890a24d299ef42
Instruction ID: 3146adae9af6310a511f236fc5c0f4e8caa04012e218ec6794baf767e105c22f
Opcode Fuzzy Hash: 7e18ff00e12b594c62788f77a26e879df96685e0265c2d26af890a24d299ef42
Instruction Fuzzy Hash: 5481F971F001199BDF18EB64DC8EBEE7B76FBC5301F1445B9E40AA7292DA349E808B51

Function 005E6400 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 005E642B
___except_validate_context_record.LIBVCRUNTIME ref: 005E6433
_ValidateLocalCookies.LIBCMT ref: 005E64C1
__IsNonwritableInCurrentImage.LIBCMT ref: 005E64EC
_ValidateLocalCookies.LIBCMT ref: 005E6541

Strings

csm, xrefs: 005E64D6

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: a235539fdfcdcda8d4342ed8efb76963185b486b74681aee80b6eb1582445f4d
Instruction ID: ab00eb6ef7d647f6038b7edc442fde63c8c480356aca9c0ce015f79bc9b12bab
Opcode Fuzzy Hash: a235539fdfcdcda8d4342ed8efb76963185b486b74681aee80b6eb1582445f4d
Instruction Fuzzy Hash: AE411834E00249EBCF18DF2AC884A9F7FB5BF94394F14805AE8559B392D731EA05CB90

Function 00600FDB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 00601046
api-ms-, xrefs: 00601032

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 54d44223b00c7f140e2d409b53769344a4ddd897482093afae8c46ccdf63295f
Instruction ID: 2a8cb5bf8f9f863ed211b4cd0e10341121d2e77789ad032ad23a13a6e81ce9f3
Opcode Fuzzy Hash: 54d44223b00c7f140e2d409b53769344a4ddd897482093afae8c46ccdf63295f
Instruction Fuzzy Hash: 2E210831E85269A7D7358A249C44BEB376AAB077A0F250125EDC7AF3D1DE70DC81C5E0

Function 00607920 Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 0060766A: _free.LIBCMT ref: 0060768F

_free.LIBCMT ref: 0060796E

Part of subcall function 005FD2A2: HeapFree.KERNEL32(00000000,00000000,?,00607694,?,00000000,?,?,?,00607939,?,00000007,?,?,00607D3E,?), ref: 005FD2B8
Part of subcall function 005FD2A2: GetLastError.KERNEL32(?,?,00607694,?,00000000,?,?,?,00607939,?,00000007,?,?,00607D3E,?,?), ref: 005FD2CA

_free.LIBCMT ref: 00607979
_free.LIBCMT ref: 00607984
_free.LIBCMT ref: 006079D8
_free.LIBCMT ref: 006079E3
_free.LIBCMT ref: 006079EE
_free.LIBCMT ref: 006079F9

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d0dfa459d330a2aee6cd92fe214e4891b163125fdc1df1696fde7ff7e4c27fe7
Instruction ID: 579da852118eb0c1cffa49cbf6c3f61ce511f41013da2eb7294fc561604d64ee
Opcode Fuzzy Hash: d0dfa459d330a2aee6cd92fe214e4891b163125fdc1df1696fde7ff7e4c27fe7
Instruction Fuzzy Hash: A2118731994B08AAD564B7B0CC07FDB7BAEAF40700F80881C769A76192E76AFA045754

Function 005BAB70 Relevance: 9.5, APIs: 6, Instructions: 495COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00000000,00000064,00000060), ref: 005BABA1
MulDiv.KERNEL32(0000000F,00000064), ref: 005BAC42
MulDiv.KERNEL32(0000000F,00000064), ref: 005BACAE
MulDiv.KERNEL32(0000000F,00000064), ref: 005BAD26
MulDiv.KERNEL32(00000320,00000064), ref: 005BADC1
MulDiv.KERNEL32(000001F8,00000064), ref: 005BADDD

Part of subcall function 00563DE0: MulDiv.KERNEL32(?,00000064,?), ref: 00563E0A
Part of subcall function 00563DE0: MulDiv.KERNEL32(?,00000064), ref: 00563E23
Part of subcall function 00563DE0: MulDiv.KERNEL32(?,00000064), ref: 00563E3F
Part of subcall function 00563DE0: MulDiv.KERNEL32(?,00000064), ref: 00563E5B

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d8f1b83f1fba58169e7c28df5be6c8c6dbe4297a846759244815653c6ed255a
Instruction ID: 64de5494f94c550413542ea927253769cb78410b57e4d650157f3853cc4436a0
Opcode Fuzzy Hash: 8d8f1b83f1fba58169e7c28df5be6c8c6dbe4297a846759244815653c6ed255a
Instruction Fuzzy Hash: AA12B374900205AFEB219F65DC49FAA7FB6FF45700F0481A9F909AB2A1DB71E944CF60

Function 005FF3AC Relevance: 9.3, APIs: 6, Instructions: 319fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 005FF3F4
__fassign.LIBCMT ref: 005FF5D3
__fassign.LIBCMT ref: 005FF5F0
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 005FF638
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 005FF678
GetLastError.KERNEL32 ref: 005FF724

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: fdafe84d2065c1f53f61f5318e72f07cfa4b65acd35cd3a7209042331a90c4b6
Instruction ID: 8c6bfb31d0bbd268d082a390404d757367fde911046a67f214eea156ad074dfa
Opcode Fuzzy Hash: fdafe84d2065c1f53f61f5318e72f07cfa4b65acd35cd3a7209042331a90c4b6
Instruction Fuzzy Hash: 32D19875D0125D9FCF15CFA8C8809EDBBB6FF48310F28016AE955EB242D635AA06CB60

Function 005FC663 Relevance: 9.3, APIs: 6, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 005FD002: GetLastError.KERNEL32(?,006483A8,?,005EB249,006483A8,00560000,00000000,?,005EA77A,006483EA,00560000,006483A8,006483A8), ref: 005FD007
Part of subcall function 005FD002: SetLastError.KERNEL32(00000000,00000006,000000FF,?,005EA77A,006483EA,00560000,006483A8,006483A8), ref: 005FD0A5

_memcmp.LIBVCRUNTIME ref: 005FC8FC
_free.LIBCMT ref: 005FC970
_free.LIBCMT ref: 005FC989
_free.LIBCMT ref: 005FC9C9
_free.LIBCMT ref: 005FC9D2
_free.LIBCMT ref: 005FC9DE

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: _free$ErrorLast$_memcmp
String ID:
API String ID: 4275183328-0
Opcode ID: 7bc066ef7827c5776e867491b6cca7b12b60a6f3cd60864ee7d46cd674d6211c
Instruction ID: 86a518f1990d71fa64d318fb9bd3ecde459fee24061104b8c40f187fb5968b7d
Opcode Fuzzy Hash: 7bc066ef7827c5776e867491b6cca7b12b60a6f3cd60864ee7d46cd674d6211c
Instruction Fuzzy Hash: 04B13975A0121E9FDB24DF18C988AADBBB5FF48304F1045EAE949A7350D775AE80CF80

Function 005F7922 Relevance: 9.3, APIs: 6, Instructions: 265COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 005F7AAC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005F7AC8
__allrem.LIBCMT ref: 005F7ADF
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005F7AFD
__allrem.LIBCMT ref: 005F7B14
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005F7B32

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 73fbcd1b14e5b7f894cd3b5a61331a24ddc33496598faf79a2fc702dad82e267
Instruction ID: 142918c5bee120e320318532bf47b2f0fac7898ca1ae84742ed1532d9cd74d16
Opcode Fuzzy Hash: 73fbcd1b14e5b7f894cd3b5a61331a24ddc33496598faf79a2fc702dad82e267
Instruction Fuzzy Hash: A881F571604B0E9BE724AE28CC82B7BBBFABF49360F24452DE655D62C1E778D9008754

Function 005BECE0 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 187COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 005BED2E

Part of subcall function 005BF3E0: _strftime.LIBCMT ref: 005BF444

Strings

MBRW-C, xrefs: 005BF333
MBAMService, xrefs: 005BEDF9
Error opening SCM: , xrefs: 005BED8A
d:\jenkins\workspace\n_sucommon\src\sucommon\setuputilities.cpp, xrefs: 005BED5D
SCCommService, xrefs: 005BEDEC

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast_strftime
String ID: Error opening SCM: $MBAMService$MBRW-C$SCCommService$d:\jenkins\workspace\n_sucommon\src\sucommon\setuputilities.cpp
API String ID: 1231846183-3848066212
Opcode ID: de99e37e39b944f22fe97cb13ffc7557ecd39e23fd7b8a564a7ca9466319c3f4
Instruction ID: dc7e7cb625f5f0668e8ea323f1a6e97b417a6ba67ca07bf2326fcff918df108e
Opcode Fuzzy Hash: de99e37e39b944f22fe97cb13ffc7557ecd39e23fd7b8a564a7ca9466319c3f4
Instruction Fuzzy Hash: 8D51B771B002459BDF14AB74EC9ABEFBBAAFBC5710F14452DE80697381DA34BD0087A5

Function 00566AAF Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 163stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,Delete,00000000), ref: 00566B60
lstrcmpiW.KERNEL32(00000000,ForceRemove), ref: 00566B71
lstrcmpiW.KERNEL32(00000000,00628C10,00000000), ref: 00566BF9
lstrcmpiW.KERNEL32(00000000,NoRemove,00000000), ref: 00566C9B
lstrcmpiW.KERNEL32(00000000,Val), ref: 00566CC9

Strings

RegOpenKeyTransactedW, xrefs: 00566C06
ForceRemove, xrefs: 00566B68
Delete, xrefs: 00566B50

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: lstrcmpi
String ID: Delete$ForceRemove$RegOpenKeyTransactedW
API String ID: 1586166983-1181399445
Opcode ID: 8d5af8f0552787ff4907a73b1913fab2ab135bd038d76ca6a2eece8a5c949e04
Instruction ID: a38d228b47fbcf184b1573b0254d18ca6f0814d6ea0da1952ea0a61ec09d72d2
Opcode Fuzzy Hash: 8d5af8f0552787ff4907a73b1913fab2ab135bd038d76ca6a2eece8a5c949e04
Instruction Fuzzy Hash: 9151FB31D0462AEBCB259F94CC687AABFB4FF88714F0441ADE80697350D7758D84CB90

Function 005BF5D0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 128COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00615948,000000FF), ref: 005BF707

Part of subcall function 005BF3E0: _strftime.LIBCMT ref: 005BF444

GetLastError.KERNEL32(00000231,?,?,00000000,00615948,000000FF,?,005C192C,?,?,?,00000000,?,?,?,A7D6A816), ref: 005BF66F

Strings

MBSetup, xrefs: 005BF602
d:\jenkins\workspace\n_sucommon\src\sucommon\setuputilities.cpp, xrefs: 005BF63D
: Error on WinHttpOpen: , xrefs: 005BF661
Error on WinHttpSetOption(SECURE_PROTOCOLS): , xrefs: 005BF6F6

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast$_strftime
String ID: : Error on WinHttpOpen: $Error on WinHttpSetOption(SECURE_PROTOCOLS): $MBSetup$d:\jenkins\workspace\n_sucommon\src\sucommon\setuputilities.cpp
API String ID: 2787424584-1059581191
Opcode ID: 864a8b72472f2cd8b0b4dd8270a80128e83fa89eb6cd45fdc884aa950ad5e297
Instruction ID: 5f1f0c0edb68fcc6c6449d8211365a7c3331d2ed688cd681005e2b8f5a738cd9
Opcode Fuzzy Hash: 864a8b72472f2cd8b0b4dd8270a80128e83fa89eb6cd45fdc884aa950ad5e297
Instruction Fuzzy Hash: EC41B671B002069BDB04AB74EC4ABAE7FA6FBC5754F505439F502DB295EE34A90087A1

Function 005F8812 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 376COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 005F88F8
__freea.LIBCMT ref: 005F8998
__freea.LIBCMT ref: 005F89B6

Strings

a/p, xrefs: 005F8A7E
am/pm, xrefs: 005F8A1A

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: 32da36d1d2688e9410a4b445e531781d4b2beba95a9f4b61279004fdc4d96633
Instruction ID: c1a1470382f8ecfb3161159a029411cb8ae3a9a197f9900d79f64cfe468aa0f2
Opcode Fuzzy Hash: 32da36d1d2688e9410a4b445e531781d4b2beba95a9f4b61279004fdc4d96633
Instruction Fuzzy Hash: 45C1E17190020EDBCB248FA8C999ABEBFB1FF45710F24445AEB41AF250DB799D41CB61

Function 0059E030 Relevance: 9.1, APIs: 6, Instructions: 123COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0059E079
std::_Lockit::_Lockit.LIBCPMT ref: 0059E09B
std::_Lockit::~_Lockit.LIBCPMT ref: 0059E0BB
__Getctype.LIBCPMT ref: 0059E151
std::_Facet_Register.LIBCPMT ref: 0059E170
std::_Lockit::~_Lockit.LIBCPMT ref: 0059E188

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: de71f5cdbd539f9c1d4e8f7da1c62c153a189876b6ba3d2639c36ba72955ff1f
Instruction ID: a5ea5c82037e7d085c12c1b45899e2eb2609a7def0262ad1cd65f38bc815b42d
Opcode Fuzzy Hash: de71f5cdbd539f9c1d4e8f7da1c62c153a189876b6ba3d2639c36ba72955ff1f
Instruction Fuzzy Hash: F441AA71D00209DFDF20DF94D846BAABBB5FB44710F15816DE806AB392EB31AE41CB91

Function 0059E5E0 Relevance: 9.1, APIs: 6, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0059E615
std::_Lockit::_Lockit.LIBCPMT ref: 0059E637
std::_Lockit::~_Lockit.LIBCPMT ref: 0059E657
__Getcvt.LIBCPMT ref: 0059E6F0
std::_Facet_Register.LIBCPMT ref: 0059E727
std::_Lockit::~_Lockit.LIBCPMT ref: 0059E73F

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcvtRegister
String ID:
API String ID: 3552396256-0
Opcode ID: 217fefff6f1f7e0c73e23c2b633c8982c429596c11a062aabcb6bdc58b61b0ff
Instruction ID: c523e1f44e8ca1da2a3395fdb74b8bb51c01954c40a6bda16cf4c63f7187a640
Opcode Fuzzy Hash: 217fefff6f1f7e0c73e23c2b633c8982c429596c11a062aabcb6bdc58b61b0ff
Instruction Fuzzy Hash: E541BF759002158FDF20DF94E842BAEBBB5FF64710F11925DE806AB352DB30AE85CB91

Function 005D925C Relevance: 9.1, APIs: 6, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

QueryDepthSList.KERNEL32 ref: 005D92DB
InterlockedPushEntrySList.KERNEL32(?,?), ref: 005D92F4
QueryDepthSList.KERNEL32(?), ref: 005D92FB
InterlockedFlushSList.KERNEL32(?), ref: 005D932E
Concurrency::details::SafePointInvocation::InvokeAtNextSafePoint.LIBCONCRT ref: 005D9343
InterlockedPushEntrySList.KERNEL32(?,?), ref: 005D934B

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: List$Interlocked$DepthEntryPointPushQuerySafe$Concurrency::details::FlushInvocation::InvokeNext
String ID:
API String ID: 80210428-0
Opcode ID: bdbd66fef1be31e4d940a17c9cf1814fd3afcd1a8ccbe5e0edafe39d1584b5f5
Instruction ID: 346c263102f4071a61968c0825c20eb4496eeca579561708dbf123fcbe4f4456
Opcode Fuzzy Hash: bdbd66fef1be31e4d940a17c9cf1814fd3afcd1a8ccbe5e0edafe39d1584b5f5
Instruction Fuzzy Hash: 9A31BE35200611AFC765CF19CA848AABBF5FF89315714891FE95AC7750DB30FA42DBA0

Function 005D935E Relevance: 9.1, APIs: 6, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

QueryDepthSList.KERNEL32(?,?,?,-00000004,?,?,?,005D9530,?,?,00000001,?,005D896D,?), ref: 005D93DD
InterlockedPushEntrySList.KERNEL32(?,?,?,005D9530,?,?,00000001,?,005D896D,?), ref: 005D93F6
QueryDepthSList.KERNEL32(?,?,005D9530,?,?,00000001,?,005D896D,?), ref: 005D93FD
InterlockedFlushSList.KERNEL32(?,?,005D9530,?,?,00000001,?,005D896D,?), ref: 005D9430
Concurrency::details::SafePointInvocation::InvokeAtNextSafePoint.LIBCONCRT ref: 005D9445
InterlockedPushEntrySList.KERNEL32(?,?,?,005D9530,?,?,00000001,?,005D896D,?), ref: 005D944D

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: List$Interlocked$DepthEntryPointPushQuerySafe$Concurrency::details::FlushInvocation::InvokeNext
String ID:
API String ID: 80210428-0
Opcode ID: 8c93d1f4efb9646bed2ba76c4d6be08516f71b472dd4f652c36a01c1ce27b68b
Instruction ID: d2fef67d84f7bdf6f5322d827228f229ba7ee16f1533b91b02f60b650a40edb9
Opcode Fuzzy Hash: 8c93d1f4efb9646bed2ba76c4d6be08516f71b472dd4f652c36a01c1ce27b68b
Instruction Fuzzy Hash: DF31AB35100601EFCB25CF59DA949AABBF1FF89314B14891FE84AC7650DB70FA02DBA1

Function 005E2577 Relevance: 9.1, APIs: 6, Instructions: 95COMMONLIBRARYCODE

Download Yara Rule

APIs

QueryDepthSList.KERNEL32(?,?,?,00000000,?,?,?,005E2717,00000000,00000000,00000000,00000000,?,?,005E24E7,00000000), ref: 005E25F6
InterlockedPushEntrySList.KERNEL32(?,?,?,005E2717,00000000,00000000,00000000,00000000,?,?,005E24E7,00000000), ref: 005E260F
QueryDepthSList.KERNEL32(?,?,005E2717,00000000,00000000,00000000,00000000,?,?,005E24E7,00000000), ref: 005E2616
InterlockedFlushSList.KERNEL32(?,?,005E2717,00000000,00000000,00000000,00000000,?,?,005E24E7,00000000), ref: 005E2641
Concurrency::details::SafePointInvocation::InvokeAtNextSafePoint.LIBCONCRT ref: 005E2656
InterlockedPushEntrySList.KERNEL32(?,?,?,005E2717,00000000,00000000,00000000,00000000,?,?,005E24E7,00000000), ref: 005E265E

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: List$Interlocked$DepthEntryPointPushQuerySafe$Concurrency::details::FlushInvocation::InvokeNext
String ID:
API String ID: 80210428-0
Opcode ID: 5ac5463ae3a573025b435fce1ab953592cf6782bd13fca16fee7ae0e42964f94
Instruction ID: 47d9c6731f91f73b3002f941457192343d7d8d7820bb14443b5b2a056a856596
Opcode Fuzzy Hash: 5ac5463ae3a573025b435fce1ab953592cf6782bd13fca16fee7ae0e42964f94
Instruction Fuzzy Hash: BA31A335101651AFC729CF1ACA94CAABBF9FF99714B10861EE48687654DF30F942CB60

Function 005DAE07 Relevance: 9.1, APIs: 6, Instructions: 95COMMONLIBRARYCODE

Download Yara Rule

APIs

QueryDepthSList.KERNEL32(?,?,?,?,?,?,?,005DAD82,?,?,00000001,000000A4,?,005E308D,00000000), ref: 005DAE86
InterlockedPushEntrySList.KERNEL32(?,-00000018,?,?,?,?,?,?,005DAD82,?,?,00000001,000000A4,?,005E308D,00000000), ref: 005DAE9F
QueryDepthSList.KERNEL32(?,?,?,?,?,?,?,005DAD82,?,?,00000001,000000A4,?,005E308D,00000000), ref: 005DAEA6
InterlockedFlushSList.KERNEL32(?,?,?,?,?,?,?,005DAD82,?,?,00000001,000000A4,?,005E308D,00000000), ref: 005DAED1
Concurrency::details::SafePointInvocation::InvokeAtNextSafePoint.LIBCONCRT ref: 005DAEE6
InterlockedPushEntrySList.KERNEL32(?,-00000018,?,?,?,?,?,?,005DAD82,?,?,00000001,000000A4,?,005E308D,00000000), ref: 005DAEEE

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: List$Interlocked$DepthEntryPointPushQuerySafe$Concurrency::details::FlushInvocation::InvokeNext
String ID:
API String ID: 80210428-0
Opcode ID: b608ebe2b525c6bf55d55b437c144a347e34296da38d57295e2b1d340c98c0a9
Instruction ID: e01e30bec6ee768b5fa6c9257192a49ba3d1394a15669eb9c1f12ece632f7c14
Opcode Fuzzy Hash: b608ebe2b525c6bf55d55b437c144a347e34296da38d57295e2b1d340c98c0a9
Instruction Fuzzy Hash: A2316D35101611AFCB25CF1DC9848ABBBF9FF89314710861FE85697A50DB34BA42DBA2

Function 005DF1A8 Relevance: 9.1, APIs: 6, Instructions: 95COMMONLIBRARYCODE

Download Yara Rule

APIs

QueryDepthSList.KERNEL32 ref: 005DF227
InterlockedPushEntrySList.KERNEL32(?,?), ref: 005DF243
QueryDepthSList.KERNEL32(?), ref: 005DF24A
InterlockedFlushSList.KERNEL32(?), ref: 005DF275
Concurrency::details::SafePointInvocation::InvokeAtNextSafePoint.LIBCONCRT ref: 005DF28A
InterlockedPushEntrySList.KERNEL32(?,?), ref: 005DF292

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: List$Interlocked$DepthEntryPointPushQuerySafe$Concurrency::details::FlushInvocation::InvokeNext
String ID:
API String ID: 80210428-0
Opcode ID: ca8e2b2349e879d5b2fd43cf344e68165e7d793873d2ebc6567b02c85ac1fe66
Instruction ID: 37c1121ecc7e381f30b7c22cb0232800706acf7ee917a7fbc6872f25aec913ba
Opcode Fuzzy Hash: ca8e2b2349e879d5b2fd43cf344e68165e7d793873d2ebc6567b02c85ac1fe66
Instruction Fuzzy Hash: AA31A039140611EFC725DF19C9948AABBF1FF89310754866FE84B87750CB30BA42CBA0

Function 005E1585 Relevance: 9.1, APIs: 6, Instructions: 95COMMONLIBRARYCODE

Download Yara Rule

APIs

QueryDepthSList.KERNEL32 ref: 005E1604
InterlockedPushEntrySList.KERNEL32(?,?), ref: 005E1620
QueryDepthSList.KERNEL32(?), ref: 005E1627
InterlockedFlushSList.KERNEL32(?), ref: 005E1652
Concurrency::details::SafePointInvocation::InvokeAtNextSafePoint.LIBCONCRT ref: 005E1667
InterlockedPushEntrySList.KERNEL32(?,?), ref: 005E166F

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: List$Interlocked$DepthEntryPointPushQuerySafe$Concurrency::details::FlushInvocation::InvokeNext
String ID:
API String ID: 80210428-0
Opcode ID: 9ec9d0c1b204dbd7d985c1b7e057d7b9a5c29e86dc4525f23ac9ddf7df3d23d0
Instruction ID: 413507973af2119c5cfa55a71aa9287364efe6b5f8384c1b3eaa5b60c2bbbf87
Opcode Fuzzy Hash: 9ec9d0c1b204dbd7d985c1b7e057d7b9a5c29e86dc4525f23ac9ddf7df3d23d0
Instruction Fuzzy Hash: B731A675100A51EFC719CF2ACA848AABBF5FF89314714855EE49783A50DB30FA42DFA4

Function 005E89B4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,005E89AB,005E6132,0060DE1B,00000008,0060E130,?,?,?,?,005E341B,?,?,A7D6A816), ref: 005E89C2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 005E89D0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 005E89E9
SetLastError.KERNEL32(00000000,?,005E89AB,005E6132,0060DE1B,00000008,0060E130,?,?,?,?,005E341B,?,?,A7D6A816), ref: 005E8A3B

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ff7e667ec779feba00ce73b020ea0b64212f8e8044220ac4c11bb163aed77908
Instruction ID: d3845b897a4d8dd40c5c26cc83ec571ddb9f621e0a20ce70e1e33b3801dcc5c7
Opcode Fuzzy Hash: ff7e667ec779feba00ce73b020ea0b64212f8e8044220ac4c11bb163aed77908
Instruction Fuzzy Hash: 7501D43650C7A69EA72C2B77BC8987B2F85FB527B5734133BF598911E2EF114C015250

Function 0058E540 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 245COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 0058E59B
_wcschr.LIBVCRUNTIME ref: 0058E5C7
_wcsstr.LIBVCRUNTIME ref: 0058E677

Strings

8~d, xrefs: 0058E62D
~d, xrefs: 0058E6F6

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: _wcschr$_wcsstr
String ID: ~d$8~d
API String ID: 229586744-4043318950
Opcode ID: 784f597de6d310d266e3581e6ebe8c6fcd4dc2fd13242ce8a01cae9697ce3f7d
Instruction ID: 6c33a66055a2ec256b4e40a5ee4b9a691d1009bdf2db49929510719938907cca
Opcode Fuzzy Hash: 784f597de6d310d266e3581e6ebe8c6fcd4dc2fd13242ce8a01cae9697ce3f7d
Instruction Fuzzy Hash: CC91A371900506DFDB10DF68CD4ABAEBBF5FF85314F148258E811AB291EB74AE05CBA0

Function 005703C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167COMMON

Download Yara Rule

APIs

__Getcvt.LIBCPMT ref: 0057041E
__Getcvt.LIBCPMT ref: 00570468

Strings

true, xrefs: 005704E0
false, xrefs: 005704C7

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Getcvt
String ID: false$true
API String ID: 1921796781-2658103896
Opcode ID: 7e351fc1791b01dc72e3f7ee89f1bb05e76878d9b48529c3a3392220d8d42202
Instruction ID: 05c2f894f1ce19a2983edb9812d09f7cec00976a48dbe7673cdbe6d519f1fbda
Opcode Fuzzy Hash: 7e351fc1791b01dc72e3f7ee89f1bb05e76878d9b48529c3a3392220d8d42202
Instruction Fuzzy Hash: 7151B3B1D003489FDB10DFA4C845BEEBBF8FF48700F14825AE855A7281E775A944CBA5

Function 00571970 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0057199D

Part of subcall function 005E66D1: RaiseException.KERNEL32(?,?,?,?), ref: 005E6731

__CxxThrowException@8.LIBVCRUNTIME ref: 005719E2

Strings

ios_base::badbit set, xrefs: 005719A7, 005719D2, 00571A06
ios_base::eofbit set, xrefs: 005719B6
ios_base::failbit set, xrefs: 005719B1

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3476068407-1866435925
Opcode ID: 550d3718ca538abbaa5c8c7dfa2f15daae0ddd354ad0b22916b3b3dcffff463c
Instruction ID: 186e9c3953bb3d59ff635d7c4c5bcd263e77930ca6984fecc65425ab8acba48d
Opcode Fuzzy Hash: 550d3718ca538abbaa5c8c7dfa2f15daae0ddd354ad0b22916b3b3dcffff463c
Instruction Fuzzy Hash: A731FB72D10619ABCB04DFACD856BFEBBB8EF84300F148169E949D7241E6309A0587A5

Function 005AC510 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,?,BINARY), ref: 005AC532
SizeofResource.KERNEL32(00000000,00000000), ref: 005AC545
LoadResource.KERNEL32(00000000,00000000), ref: 005AC558
LockResource.KERNEL32(00000000), ref: 005AC567

Strings

BINARY, xrefs: 005AC527

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID: BINARY
API String ID: 3473537107-907554435
Opcode ID: 012a786ba1f0cd3a0e33f911c3ea4ed84cdf818114be1ef01b4aa918b75d8ecf
Instruction ID: c3256c1e1ae530aa85e21ac16d0d5f6debb08eca8bdfe8c2acb9c8ef94474c87
Opcode Fuzzy Hash: 012a786ba1f0cd3a0e33f911c3ea4ed84cdf818114be1ef01b4aa918b75d8ecf
Instruction Fuzzy Hash: 8421A075A01215AFC7209F65DC59FABBFF9EB4A751F00802EF906DB250DB309900CBA0

Function 005DC7C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 005DC7D4
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 005DC7F8
std::invalid_argument::invalid_argument.LIBCONCRT ref: 005DC80B
__CxxThrowException@8.LIBVCRUNTIME ref: 005DC819

Strings

pScheduler, xrefs: 005DC803

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentException@8Manager::Proxy::RemoveSchedulerThreadThrowstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 3657713681-923244539
Opcode ID: 8e341a59dc66a0d48842257763fe6866a58a1f5dc889157be547ab5675e4a40f
Instruction ID: fb042aca346e0ccf3bb339d6d482cc1b5f329ae3083e29c0e4ea5ea040736bf0
Opcode Fuzzy Hash: 8e341a59dc66a0d48842257763fe6866a58a1f5dc889157be547ab5675e4a40f
Instruction Fuzzy Hash: 88F05935900206A7C734FA58D846C9EBFB9BED0720B20842FE40217381DF70ED46C6A0

Function 005EE03D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,005EE032,?,?,005EDFFA,006483A8,00560000,?), ref: 005EE052
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 005EE065
FreeLibrary.KERNEL32(00000000,?,?,005EE032,?,?,005EDFFA,006483A8,00560000,?), ref: 005EE088

Strings

CorExitProcess, xrefs: 005EE05D
mscoree.dll, xrefs: 005EE04B

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: c733f26ee535988613d6ed385f181c02c7f73a55487591fae89793e7c01808da
Instruction ID: ffb4071bf6a9a8a32ed409785bd98837c218f97ab83fb8ee3a432e6354807c9c
Opcode Fuzzy Hash: c733f26ee535988613d6ed385f181c02c7f73a55487591fae89793e7c01808da
Instruction Fuzzy Hash: DFF08931911218F7CB15DBA1DD0EBDD7F7AEB00711F144155FC04A2150CB718F40D6A5

Function 0060D3E0 Relevance: 7.7, APIs: 5, Instructions: 245COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,0060D69E,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 0060D483
__alloca_probe_16.LIBCMT ref: 0060D539
__alloca_probe_16.LIBCMT ref: 0060D5CF
__freea.LIBCMT ref: 0060D63A
__freea.LIBCMT ref: 0060D646

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: 5e7830ebb179446abd3e5dc3253bfa09e4d67d59f35eb796387ef086c03110f6
Instruction ID: aeffec5adaa91a3c10a726502891a567ea3bb570634f9d3e1424ba32f608e70a
Opcode Fuzzy Hash: 5e7830ebb179446abd3e5dc3253bfa09e4d67d59f35eb796387ef086c03110f6
Instruction Fuzzy Hash: 5A81B17198021A9BDF299ED48C95EEF7BF7AF49314F180259E908A72C1D6329C40CBA4

Function 0057A750 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,005A51A8,A7D6A816,0064CA84), ref: 0057AB25
GetLastError.KERNEL32(?,?,005A51A8,A7D6A816,0064CA84), ref: 0057AB56

Part of subcall function 00563C20: __CxxThrowException@8.LIBVCRUNTIME ref: 00563C36

Strings

Error %lu calling HrInit(), hr=0x%08X, xrefs: 0057AB30
Error %lu calling CoCreateInstance(), hr=0x%08X, xrefs: 0057AB61
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\taskbarprogress.cpp, xrefs: 0057AB44, 0057AB75

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast$Exception@8Throw
String ID: Error %lu calling CoCreateInstance(), hr=0x%08X$Error %lu calling HrInit(), hr=0x%08X$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\taskbarprogress.cpp
API String ID: 4186728697-3549548636
Opcode ID: 62a63f547dad7e337d3c1dc2df6a335ce6e3a1329c926c35ad674211ff16d483
Instruction ID: e3a1cf5325fad61e809311a952b6e58071ad39ce7b7090e277bacad77d9be3ea
Opcode Fuzzy Hash: 62a63f547dad7e337d3c1dc2df6a335ce6e3a1329c926c35ad674211ff16d483
Instruction Fuzzy Hash: 80C112B05012069FE704CF55C59879ABFA5FF49308F1482B9D9085F796CBBA8588CFE1

Function 005FEFE5 Relevance: 7.7, APIs: 5, Instructions: 200COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 005FF069
__alloca_probe_16.LIBCMT ref: 005FF12F
__freea.LIBCMT ref: 005FF19B

Part of subcall function 005FD254: HeapAlloc.KERNEL32(00000000,?,00000004,?,005FD324,?,00000000,?,005EA57E,?,00000004,00000004,?,00000000,?,005FB18C), ref: 005FD286

__freea.LIBCMT ref: 005FF1A4
__freea.LIBCMT ref: 005FF1C9

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 1cad0ae5a75382d5562d2e349b44de9d6bd0e5960fb9a921a976eca0adb0b97e
Instruction ID: b21fbbdc43b91169d83291116d63320c2ab204c15cc249f8535a9184ed25b1c6
Opcode Fuzzy Hash: 1cad0ae5a75382d5562d2e349b44de9d6bd0e5960fb9a921a976eca0adb0b97e
Instruction Fuzzy Hash: 5951D17260021AAFEB259E60CC45EBB3FAAFF84750F154528FE04A6240EB79DC00C7A0

Function 005C4FB0 Relevance: 7.7, APIs: 5, Instructions: 193COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005C504D
std::_Lockit::_Lockit.LIBCPMT ref: 005C506F
std::_Lockit::~_Lockit.LIBCPMT ref: 005C5090
std::_Facet_Register.LIBCPMT ref: 005C512C
std::_Lockit::~_Lockit.LIBCPMT ref: 005C5148

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 535342d7cff520b087e40aeab47bbd582cf0a86007f9d715796fd526ab1ccf9c
Instruction ID: fba2a30da4043422889da11aac56cfbc200faaa173187a35b91174c05c961a8f
Opcode Fuzzy Hash: 535342d7cff520b087e40aeab47bbd582cf0a86007f9d715796fd526ab1ccf9c
Instruction Fuzzy Hash: 40813574A012059FDB14CFA8C998FADBBF1BF48314F18809DE84AAB351DB71A944CB91

Function 005FC1DA Relevance: 7.7, APIs: 5, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 005FD254: HeapAlloc.KERNEL32(00000000,?,00000004,?,005FD324,?,00000000,?,005EA57E,?,00000004,00000004,?,00000000,?,005FB18C), ref: 005FD286

_free.LIBCMT ref: 005FC2E9
_free.LIBCMT ref: 005FC300
_free.LIBCMT ref: 005FC31F
_free.LIBCMT ref: 005FC33A
_free.LIBCMT ref: 005FC351

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: _free$AllocHeap
String ID:
API String ID: 1835388192-0
Opcode ID: a6f6678508fde252f64b4b768866aad5fd20deed311cc775589d7ce6677c649b
Instruction ID: 8bc1cf120a5189bd3577ae1198a728f5934ecbb4fc9fdc6f79c90062eb035766
Opcode Fuzzy Hash: a6f6678508fde252f64b4b768866aad5fd20deed311cc775589d7ce6677c649b
Instruction Fuzzy Hash: 4351F332A0020D9FDB20DF69C942A7A7FF5FF94750B044979EA49D7290E739E900CB90

Function 005AB700 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0064840C,?,?), ref: 005AB72E
LeaveCriticalSection.KERNEL32(0064840C,?,?), ref: 005AB799
LeaveCriticalSection.KERNEL32(0064840C,?,?), ref: 005AB8B8

Strings

ATL:%p, xrefs: 005AB805
0, xrefs: 005AB760

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: 0$ATL:%p
API String ID: 2978645861-2453800769
Opcode ID: 0f6ac6970734b541651459dcb972c63767d3f019ba03e54f3f922c1cfdb6bef3
Instruction ID: f1c496684a713a0ad113e4579f00e828d2a2f0ab5f5f674f0a634bd16a010852
Opcode Fuzzy Hash: 0f6ac6970734b541651459dcb972c63767d3f019ba03e54f3f922c1cfdb6bef3
Instruction Fuzzy Hash: 31518F75A00308DBEF109FA8DC85AAE7BB9FF49314F106159ED08AB256E770D981CB90

Function 0056C8F8 Relevance: 7.6, APIs: 5, Instructions: 132threadCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000E), ref: 0056C95A
GetCurrentThreadId.KERNEL32 ref: 0056C99E
EnterCriticalSection.KERNEL32(0064840C), ref: 0056C9AF
LeaveCriticalSection.KERNEL32(0064840C), ref: 0056C9C8
GetCurrentThreadId.KERNEL32 ref: 0056CAF7

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: CriticalCurrentSectionThread$EnterErrorLastLeave
String ID:
API String ID: 3536840179-0
Opcode ID: 0d1f185de16155bb5065f03afcb5eeded776c81c797f6d36a18821a012aa7e09
Instruction ID: 3f73836d8ed704eef4d730c3945911f75d2fa42447e17efd4a706d33308db9e7
Opcode Fuzzy Hash: 0d1f185de16155bb5065f03afcb5eeded776c81c797f6d36a18821a012aa7e09
Instruction Fuzzy Hash: 25419E3560030A9FDB24DF70D88AB6ABFE6FF49700F54456AE989DB191EB31E800CB54

Function 005FB103 Relevance: 7.6, APIs: 5, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 005FB171
_free.LIBCMT ref: 005FB191
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 005FB1F2
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 005FB204
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 005FB211

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: __crt_fast_encode_pointer$_free
String ID:
API String ID: 366466260-0
Opcode ID: dc5627f55c2b729349b3d6b6d8649a63f1055e96ad72d73e4100adf3d130c1cf
Instruction ID: 42d88a2aa4490b5d3cdaa4c3d1ca99daeb1dbd53c51d4b3fce64dd6fcc54e37f
Opcode Fuzzy Hash: dc5627f55c2b729349b3d6b6d8649a63f1055e96ad72d73e4100adf3d130c1cf
Instruction Fuzzy Hash: 8841D436A00208DFDB14DF68C895A6DBBB6FFC9710F1540A8EA55EB341D735AE01CB80

Function 0059CA50 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0059CA86
std::_Lockit::_Lockit.LIBCPMT ref: 0059CAA6
std::_Lockit::~_Lockit.LIBCPMT ref: 0059CAC6
std::_Facet_Register.LIBCPMT ref: 0059CB61
std::_Lockit::~_Lockit.LIBCPMT ref: 0059CB79

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 38b37c17de3df5dc75f802a49e3fc8789b367795d4e51f80295819e0dde6226d
Instruction ID: 95ed8c08d24f7a6da78d7379f1b3197e29a1f17dc4ab16741b0fa5c7607a4110
Opcode Fuzzy Hash: 38b37c17de3df5dc75f802a49e3fc8789b367795d4e51f80295819e0dde6226d
Instruction Fuzzy Hash: 5F41BA719012198FDF20CF94D896BAEBFB6FB45720F14416DE80AAB381DB31AD41CB81

Function 005DA8AB Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 005DA8D0

Part of subcall function 005D0C2D: _SpinWait.LIBCONCRT ref: 005D0C45

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 005DA8E4
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 005DA916
List.LIBCMT ref: 005DA999
List.LIBCMT ref: 005DA9A8

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: d6fe27637f116eef60954a583411b2040660e6ce179c4d8e9ec433a7d2759bc8
Instruction ID: ff10de96178d2100f7f443ffb5aff6de2df4725f6713931de3a297deb71e8737
Opcode Fuzzy Hash: d6fe27637f116eef60954a583411b2040660e6ce179c4d8e9ec433a7d2759bc8
Instruction Fuzzy Hash: 41316632D01656DFCB20EFA8D5A56EEBFB1BF40704F05406BD84167782CB316904DBA6

Function 005D71C7 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005D20FF: TlsGetValue.KERNEL32(?,?,005D1679,005D1492,?,?), ref: 005D2105

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 005D71F1

Part of subcall function 005E0971: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 005E0998
Part of subcall function 005E0971: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 005E09B1
Part of subcall function 005E0971: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 005E0A27
Part of subcall function 005E0971: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 005E0A2F

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 005D71FF
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 005D7209
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 005D7213
__CxxThrowException@8.LIBVCRUNTIME ref: 005D7231

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredException@8ExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceThrowValueVirtualWork
String ID:
API String ID: 4266703842-0
Opcode ID: aadc46f194e9e1fca696cb5052a658fa6988e7f63e01267c793b13ead9684af8
Instruction ID: c98320746fa3fcc1e1baa934f44e89402be0d01bd49555ffa88dec2b7b2aecd2
Opcode Fuzzy Hash: aadc46f194e9e1fca696cb5052a658fa6988e7f63e01267c793b13ead9684af8
Instruction Fuzzy Hash: B5F0C23660412A67CB39B66D981A96EFF6ABBD5B50B00011BF40083392EF648E56C782

Function 006073F0 Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00607408

Part of subcall function 005FD2A2: HeapFree.KERNEL32(00000000,00000000,?,00607694,?,00000000,?,?,?,00607939,?,00000007,?,?,00607D3E,?), ref: 005FD2B8
Part of subcall function 005FD2A2: GetLastError.KERNEL32(?,?,00607694,?,00000000,?,?,?,00607939,?,00000007,?,?,00607D3E,?,?), ref: 005FD2CA

_free.LIBCMT ref: 0060741A
_free.LIBCMT ref: 0060742C
_free.LIBCMT ref: 0060743E
_free.LIBCMT ref: 00607450

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 162809332ca941882213477d33755998d00561156db96f32d80c6659d8b2647f
Instruction ID: 05b0c89cd3f7354f3f36510b70a6e2e21533d66bfb020537bec2c5d2a4eaad85
Opcode Fuzzy Hash: 162809332ca941882213477d33755998d00561156db96f32d80c6659d8b2647f
Instruction Fuzzy Hash: 45F0687694C104ABC724EB59F586C577FEBFE917107589805F108D7641C738FC4096A4

Function 005DC678 Relevance: 7.5, APIs: 5, Instructions: 30threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::CurrentSubscriptionLevel.LIBCONCRT ref: 005DC682
Concurrency::details::SchedulerProxy::DecrementFixedCoreCount.LIBCONCRT ref: 005DC6B3
GetCurrentThread.KERNEL32 ref: 005DC6BC
Concurrency::details::SchedulerProxy::DecrementCoreSubscription.LIBCONCRT ref: 005DC6CF
Concurrency::details::SchedulerProxy::DestroyExecutionResource.LIBCONCRT ref: 005DC6D8

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$CoreCurrentDecrementResourceSubscription$CountDestroyExecutionFixedLevelManager::Thread
String ID:
API String ID: 2583373041-0
Opcode ID: a11331f37b2e6def66c209580db068d9f91a1ef68b422d4154fb5187d24dd510
Instruction ID: a02b02ae6b142bda9f4385c95591bda3bf4b37f3c67d4386a3f3bc690ff224f1
Opcode Fuzzy Hash: a11331f37b2e6def66c209580db068d9f91a1ef68b422d4154fb5187d24dd510
Instruction Fuzzy Hash: 68F082322005029B8635EF59E9559BA7F76BFC4710350554FE44B46751CF21E841DB71

Function 005A3770 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 369COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 005A37E3

Strings

V\, xrefs: 005A3B26

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: DrivesLogical
String ID: V\
API String ID: 999431828-47835167
Opcode ID: 3c3cb2e59841b39679f7588798106dcc9eea607e3ba24be6d2672e7eeddb0a15
Instruction ID: 079ae7a53f9d7344f28de4f2f61b73caa690150325469a1f3fc5066fcfe24c75
Opcode Fuzzy Hash: 3c3cb2e59841b39679f7588798106dcc9eea607e3ba24be6d2672e7eeddb0a15
Instruction Fuzzy Hash: 83C10771A01309AFEB20DF60CC5AFAE7BA9BF06718F144159B945B71D0EB719F448B60

Function 005B6F90 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 312COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 005B731D
__CxxThrowException@8.LIBVCRUNTIME ref: 005B7377

Strings

\u%04x\u%04x, xrefs: 005B7214
\u%04x, xrefs: 005B71D8

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Exception@8Throw
String ID: \u%04x$\u%04x\u%04x
API String ID: 2005118841-2104106325
Opcode ID: 5671f51f778c7dd451263429229b6d303c6716d5b8486067ec586bcaedc84842
Instruction ID: 64a5cdb6126ac3af64f905dc41dc4def315b78458f6b2c626b99ac4739d7cc39
Opcode Fuzzy Hash: 5671f51f778c7dd451263429229b6d303c6716d5b8486067ec586bcaedc84842
Instruction Fuzzy Hash: 7EC1B37590865ADFD710CF68C884BE9BFB4FF59304F6441A9E445AB382D336EA04CBA1

Function 0057E440 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 255COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(0000000D,00000064,?), ref: 0057E493
MulDiv.KERNEL32(0000000D,00000064), ref: 0057E4F3
MulDiv.KERNEL32(00000012,00000064), ref: 0057E566

Part of subcall function 00563DE0: MulDiv.KERNEL32(?,00000064,?), ref: 00563E0A
Part of subcall function 00563DE0: MulDiv.KERNEL32(?,00000064), ref: 00563E23
Part of subcall function 00563DE0: MulDiv.KERNEL32(?,00000064), ref: 00563E3F
Part of subcall function 00563DE0: MulDiv.KERNEL32(?,00000064), ref: 00563E5B

Strings

QUe, xrefs: 0057E627

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID: QUe
API String ID: 0-1747689811
Opcode ID: e32cba7098dcfdb02b22a54559cd7dc24f4ef1c9092fa285df61347ecca020e3
Instruction ID: d9d42ac93aaf35b30460afbb9097a95408ed52c792ddace3ce9ccde62ed0a1c2
Opcode Fuzzy Hash: e32cba7098dcfdb02b22a54559cd7dc24f4ef1c9092fa285df61347ecca020e3
Instruction Fuzzy Hash: 23A13E75900214AFDB10DFA5DC49F5ABFBAFF49710F058195EA08AB2A2C7B1E944CF90

Function 0058E050 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 0058E0AB
_wcschr.LIBVCRUNTIME ref: 0058E0D7
_wcsstr.LIBVCRUNTIME ref: 0058E120

Strings

~d, xrefs: 0058E1A1

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: _wcschr$_wcsstr
String ID: ~d
API String ID: 229586744-1013935819
Opcode ID: 94331928e6c537b88c432a37b47c99f29b35c888cf420527221f0212895b5f99
Instruction ID: c23f4c18d376779060332816a2ac8cc8daec2927c0f7d09324f460a8bb5f677b
Opcode Fuzzy Hash: 94331928e6c537b88c432a37b47c99f29b35c888cf420527221f0212895b5f99
Instruction Fuzzy Hash: 4D71A231900506DBDB14EB68CD4ABAEBBB5FF85314F148658EC11BB2D1DB74AE05CBA0

Function 00602BC2 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 173timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00620C1C), ref: 00602C2C
_free.LIBCMT ref: 00602C1A

Part of subcall function 005FD2A2: HeapFree.KERNEL32(00000000,00000000,?,00607694,?,00000000,?,?,?,00607939,?,00000007,?,?,00607D3E,?), ref: 005FD2B8
Part of subcall function 005FD2A2: GetLastError.KERNEL32(?,?,00607694,?,00000000,?,?,?,00607939,?,00000007,?,?,00607D3E,?,?), ref: 005FD2CA

_free.LIBCMT ref: 00602DE8

Strings

-`, xrefs: 00602BD5, 00602CF0, 00602BDB

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID: -`
API String ID: 2155170405-2309599019
Opcode ID: 66dadd49fb1a7f53b82368e343210df3298f3e49d586c719a1a01f047ff38906
Instruction ID: 085162c0a7cd68b2eb059f13e7c5b377f9a951c84b27a075788b9c1781e37b8b
Opcode Fuzzy Hash: 66dadd49fb1a7f53b82368e343210df3298f3e49d586c719a1a01f047ff38906
Instruction Fuzzy Hash: EA51F97194020BAFDB58EF69DC999AFBBBEEF41320B10425EE410973D1E7309E418B94

Function 0058E7F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,00000000,00000400,?,?,00000000,00612158,000000FF,?,005A6CA5,00647E38,?,?,?,00000000), ref: 0058E84B

Part of subcall function 005BF3E0: _strftime.LIBCMT ref: 005BF444

GetLastError.KERNEL32(00000A06,?,?,?,00000000,00612158,000000FF,?,005A6CA5), ref: 0058E8FE

Strings

c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp, xrefs: 0058E8C0
GetModuleFileName failed: , xrefs: 0058E8F0

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorFileLastModuleName_strftime
String ID: GetModuleFileName failed: $c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp
API String ID: 3237989562-559641331
Opcode ID: 2e5edae9afac1181e72a3b8eeb309f63949928950f528bd1b0b89c6486fb2e09
Instruction ID: a055de916dbaee358b66daba8fd7e0a30f616218eab6a517fb783c8e62384eb5
Opcode Fuzzy Hash: 2e5edae9afac1181e72a3b8eeb309f63949928950f528bd1b0b89c6486fb2e09
Instruction Fuzzy Hash: 0341D071B001459BDB08AB78EC4AB6F7FA6FBC5710F14457DE906EB381EA35D8008BA1

Function 005FA93F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\tOE2mg8TbU.exe, xrefs: 005FA97D, 005FA984, 005FA9B8

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\tOE2mg8TbU.exe
API String ID: 0-3415364703
Opcode ID: 53b2461fedb9f207ab43d8d93b0414ecaf83735d2b6d78edb43d3d1f71b2df47
Instruction ID: f45054dfbbc4db262e8bad0e3fe46ea15b9cb988229f70276fc9b3099772a495
Opcode Fuzzy Hash: 53b2461fedb9f207ab43d8d93b0414ecaf83735d2b6d78edb43d3d1f71b2df47
Instruction Fuzzy Hash: 3341A2B1A0020DAFCB25DF99C985DBEBFB9FB85310B104066E649D7311D7749E04DB62

Function 00566530 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,A7D6A816,00000010), ref: 00566584
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 0056659B

Strings

RegOpenKeyTransactedW, xrefs: 00566595
Advapi32.dll, xrefs: 0056657F

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 1646373207-3913318428
Opcode ID: 146e91fde70959af74c65382a3717f396599c29547a379e1d28ca0e116b59b31
Instruction ID: 57fe07ee2701acecead86a0bdda396738634ab1f52e4c8735608a5884d52058c
Opcode Fuzzy Hash: 146e91fde70959af74c65382a3717f396599c29547a379e1d28ca0e116b59b31
Instruction Fuzzy Hash: 88318071A00206AFDB14CF59DD56BABBBB9FB48710F50452AF806E7284DB74E900CBA0

Function 0057C350 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84memorywindowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001300,00000000,00637780,00000400,0062AD80,00000000,00000000,00000000,00000000,0062AD74,0057CE02,000000BB), ref: 0057C376
LocalAlloc.KERNEL32(00000000,00000040), ref: 0057C3C9

Strings

Unknown error 0x%0lX, xrefs: 0057C40E
IDispatch error #%d, xrefs: 0057C3F7

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: AllocFormatLocalMessage
String ID: IDispatch error #%d$Unknown error 0x%0lX
API String ID: 3960703613-2934499512
Opcode ID: 6de1c8dce3062a7259ef831c1454acf67901ad896e5ce129a2b35b670edb8911
Instruction ID: 014159d42736f53513cb7b0378739e9e89008b44f4e3b95352c7131c331d23df
Opcode Fuzzy Hash: 6de1c8dce3062a7259ef831c1454acf67901ad896e5ce129a2b35b670edb8911
Instruction Fuzzy Hash: F62107353002115BDB349F18EC06BB9BBA6FF84716F20C46EF259DB6C0C770A8569794

Function 00570D00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00570D2D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00570D7C

Part of subcall function 005CB986: _Yarn.LIBCPMT ref: 005CB9A5
Part of subcall function 005CB986: _Yarn.LIBCPMT ref: 005CB9C9

__CxxThrowException@8.LIBVCRUNTIME ref: 00570DAE

Strings

bad locale name, xrefs: 00570D98

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
String ID: bad locale name
API String ID: 3628047217-1405518554
Opcode ID: 64c2798040fe507d93025205214d284a989a8c47b48b655535db93ce5c233237
Instruction ID: acffc02e99a76a27e49023fe4c7e9941d98046f8b1c2ad036751e223cb6d268f
Opcode Fuzzy Hash: 64c2798040fe507d93025205214d284a989a8c47b48b655535db93ce5c233237
Instruction Fuzzy Hash: D421BEB18047509FD720DF68D805B87BBF8FF18700F008A1EE499D3781E7B5A6048B95

Function 00587A70 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMON

Download Yara Rule

Strings

\drivers, xrefs: 00587D75
~d, xrefs: 00587DBB
~d, xrefs: 00587C37

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID: \drivers$~d$~d
API String ID: 0-1323642608
Opcode ID: ff7941d8bfdcd433775defe17b0bf8267e2f13b437a2222e5b5a7f4746fe245f
Instruction ID: 8a0788d272b527fd369a14b446b1ff8bf64bafc0bdb9a826449f3bd1d33d4064
Opcode Fuzzy Hash: ff7941d8bfdcd433775defe17b0bf8267e2f13b437a2222e5b5a7f4746fe245f
Instruction Fuzzy Hash: 6021B03084425D9ADF20FBA0DC99FE97B79BF55744F500294AA05731A1EF705EC8CBA0

Function 0060C9D2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(?,?,?,?,?,?,00000000,00000000), ref: 0060CA3D
_free.LIBCMT ref: 0060CA4C
_free.LIBCMT ref: 0060CA5B

Strings

h`, xrefs: 0060CA27

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: _free$EnvironmentVariable
String ID: h`
API String ID: 1464849758-78058603
Opcode ID: 6794977d694c8d4f6132709406d03a8f6ea92b340d5320c8a37b0b0eb24a9c36
Instruction ID: 3f862331a12bb79eddebc030980579d6093089d728b6c5e4051fa9bbdb544426
Opcode Fuzzy Hash: 6794977d694c8d4f6132709406d03a8f6ea92b340d5320c8a37b0b0eb24a9c36
Instruction Fuzzy Hash: 2E113D71D0121DABDF01EFAA98895EEFFB9BF48310F54416EE908B2251E7354A448BA4

Function 005D5628 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 005D5658
__CxxThrowException@8.LIBVCRUNTIME ref: 005D5666

Strings

version, xrefs: 005D563D
pScheduler, xrefs: 005D5650

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 1687795959-3154422776
Opcode ID: 52767e921e4078c91053db6964196cbef799aa532e2cc4ecd31783972f252e08
Instruction ID: 21daffc0d9eb72e1e62a1139669d940d5f561a748866f320c4e60a2884013f62
Opcode Fuzzy Hash: 52767e921e4078c91053db6964196cbef799aa532e2cc4ecd31783972f252e08
Instruction Fuzzy Hash: 8DE08630580208BACB26FA59C80FBDC7F69BB60385F408423B51115194A7B4D698CA81

Function 005A1AF0 Relevance: 6.4, APIs: 4, Instructions: 426COMMON

Download Yara Rule

APIs

Part of subcall function 00563AB0: GetProcessHeap.KERNEL32 ref: 00563AF1
Part of subcall function 00563AB0: __Init_thread_footer.LIBCMT ref: 00563B1C
Part of subcall function 00563AB0: __Init_thread_footer.LIBCMT ref: 00563B9A

Part of subcall function 0057C130: FindResourceW.KERNEL32(00000000,?,00000006,?,0063066C,00540053,?,005A9AA7,00540053), ref: 0057C159

_wcschr.LIBVCRUNTIME ref: 005A1B83
_wcschr.LIBVCRUNTIME ref: 005A1BAB
_wcschr.LIBVCRUNTIME ref: 005A1E11

Part of subcall function 00563C20: __CxxThrowException@8.LIBVCRUNTIME ref: 00563C36

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: _wcschr$Init_thread_footer$Exception@8FindHeapProcessResourceThrow
String ID:
API String ID: 293293980-0
Opcode ID: fa8f705ae9af0247012f888ba9e3d84504710c120388815027d6aa6e5c78ba43
Instruction ID: f0fbe6e8569e360722150aa4ff6561d370a1ae34a099f737715a928bcb511e65
Opcode Fuzzy Hash: fa8f705ae9af0247012f888ba9e3d84504710c120388815027d6aa6e5c78ba43
Instruction Fuzzy Hash: 16F19E71A00609DFDB15CFA8C945AAEBFF5FF46320F148259E425EB291DB30AE01CB94

Function 005FD70C Relevance: 6.3, APIs: 4, Instructions: 321COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 005FD793

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: cb15d26a1335ec8cfc5b95704212c7b5c16ead0f753a4c5266c01536cc51493e
Instruction ID: d2373ed91f0cf6a67864d8215f37ba7c7807244695fa811668306e89a6545e15
Opcode Fuzzy Hash: cb15d26a1335ec8cfc5b95704212c7b5c16ead0f753a4c5266c01536cc51493e
Instruction Fuzzy Hash: 82B135329042899FDB15DF68C8417BEBFF6FF55340F1484AAEA449B241D2799E01CB70

Function 0059F840 Relevance: 6.2, APIs: 4, Instructions: 185COMMON

Download Yara Rule

APIs

___std_fs_convert_wide_to_narrow@20.LIBCPMT ref: 0059F8BF
___std_fs_convert_wide_to_narrow@20.LIBCPMT ref: 0059F8E7

Part of subcall function 0059F750: __CxxThrowException@8.LIBVCRUNTIME ref: 0059F779

__CxxThrowException@8.LIBVCRUNTIME ref: 0059F936

Part of subcall function 005E66D1: RaiseException.KERNEL32(?,?,?,?), ref: 005E6731

__CxxThrowException@8.LIBVCRUNTIME ref: 0059F959

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Exception@8Throw$___std_fs_convert_wide_to_narrow@20$ExceptionRaise
String ID:
API String ID: 2706076302-0
Opcode ID: b8ae4a42dc55d05a0bf2f9dfb423332d0420c33f338a2d3d2c3d3b9ba3a02f6e
Instruction ID: 851553ec7d69b31690b60f0ba787e3208829e13c9952231a2b01c0eff8af138e
Opcode Fuzzy Hash: b8ae4a42dc55d05a0bf2f9dfb423332d0420c33f338a2d3d2c3d3b9ba3a02f6e
Instruction Fuzzy Hash: 9651B471A00205AFDF14DFA4DD85BAEBBB9FF84750F20463DE416D7281DB70AA458BA0

Function 0059F780 Relevance: 6.2, APIs: 4, Instructions: 164COMMON

Download Yara Rule

APIs

___std_fs_convert_wide_to_narrow@20.LIBCPMT ref: 0059F8BF
___std_fs_convert_wide_to_narrow@20.LIBCPMT ref: 0059F8E7

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ___std_fs_convert_wide_to_narrow@20
String ID:
API String ID: 4283068201-0
Opcode ID: cce7ef70906391973a525eb2070ecbe3f255356ded3095bb0f5a822685097c2b
Instruction ID: 20022016ebc4887da3eb2770f48598abdbbd43ea8bf667d4ff73cde234256c3d
Opcode Fuzzy Hash: cce7ef70906391973a525eb2070ecbe3f255356ded3095bb0f5a822685097c2b
Instruction Fuzzy Hash: 3E517D71A00219AFDF14EFA4DD45FAEBFB9FB48710F104529F411A7281DB75AA44CBA0

Function 0060D26E Relevance: 6.1, APIs: 4, Instructions: 133fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0060D33E
_free.LIBCMT ref: 0060D367
SetEndOfFile.KERNEL32(00000000,0060BD72,00000000,0060419F,?,?,?,?,?,?,?,0060BD72,0060419F,00000000), ref: 0060D399
GetLastError.KERNEL32(?,?,?,?,?,?,?,0060BD72,0060419F,00000000,?,?,?,?,00000000), ref: 0060D3B5

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 7e16b494ed68d77c043bb7020c63bcb0822745c55c65973f8a459b04106983f7
Instruction ID: 7cdc347c5cccd19fdc8b1dc9a15e9354896dd1247f240fb3495d1a777c10a59f
Opcode Fuzzy Hash: 7e16b494ed68d77c043bb7020c63bcb0822745c55c65973f8a459b04106983f7
Instruction Fuzzy Hash: 7541E2329806069BDB2D6AF9DC46B9F3B67EF86360F141614F924A72D1E734D8008762

Function 005F1293 Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c8d1657baa983caf8f7ded9b4f1221c94c3d3686a789918cb331d97e5f992f6
Instruction ID: d99fe146307bde0321ffd3f47d9c7cfda0dd1660cdb1c0033df0d44c94f3c8b1
Opcode Fuzzy Hash: 8c8d1657baa983caf8f7ded9b4f1221c94c3d3686a789918cb331d97e5f992f6
Instruction Fuzzy Hash: CD410A71A00B58EFD7289F78C845B6EBFE9FB88710F104929F111DB6C1D379A9408B84

Function 00596C40 Relevance: 6.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000003,00000000,?,0058AA9B,?,?,00000000,00000000,?,0058AA9B,?,unknown,00000007), ref: 00596CA0
GetLastError.KERNEL32(?,0058AA9B,?,unknown,00000007), ref: 00596CB1
WideCharToMultiByte.KERNEL32(00000003,00000000,?,0058AA9B,00000000,00000000,00000000,00000000,?,0058AA9B,?,unknown,00000007), ref: 00596CCD
WideCharToMultiByte.KERNEL32(00000003,00000000,?,0058AA9B,?,00000000,00000000,00000000,?,?,?,0058AA9B,?,unknown,00000007), ref: 00596CF5

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: cdfd7931cf0513dacbe35668ceb88d8b7a16efd3b1e5af30d19bc83936b28e82
Instruction ID: d03be03efbf130d2e2b7a23e6f0477b9e53a8c28230391549a8d6b23899d75d1
Opcode Fuzzy Hash: cdfd7931cf0513dacbe35668ceb88d8b7a16efd3b1e5af30d19bc83936b28e82
Instruction Fuzzy Hash: 032105B5700302BBEB104F54DC96F967B6DFF48751F244129FA099B280E7B17E0886B4

Function 005F1557 Relevance: 6.1, APIs: 4, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e0c13bfc9c24991876144dbe1b88ca1dab2dfaee2cb6cdde390428c3ce83fcb
Instruction ID: ce1bc30faa09a0e915039457f13c90b78ba51cbce5352da582075360c095d838
Opcode Fuzzy Hash: 1e0c13bfc9c24991876144dbe1b88ca1dab2dfaee2cb6cdde390428c3ce83fcb
Instruction Fuzzy Hash: 3D21D071600A0AEFDF24AF718C8497B7BADFF843687148915F615E2541EB34EC008BA8

Function 005FD002 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,006483A8,?,005EB249,006483A8,00560000,00000000,?,005EA77A,006483EA,00560000,006483A8,006483A8), ref: 005FD007
_free.LIBCMT ref: 005FD064
_free.LIBCMT ref: 005FD09A
SetLastError.KERNEL32(00000000,00000006,000000FF,?,005EA77A,006483EA,00560000,006483A8,006483A8), ref: 005FD0A5

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: afab411d9b02c7a82f3a3695a8a37a2f69595460fff34d653d97636e3e37a7a7
Instruction ID: 9029ca95abf4d77fe1e4780e5abb8cfaf553eacf6c2dbd0994e7054a6db95542
Opcode Fuzzy Hash: afab411d9b02c7a82f3a3695a8a37a2f69595460fff34d653d97636e3e37a7a7
Instruction Fuzzy Hash: AC11E3362481096ED73536799C8E93F2D6FBBD2775F240628F724861D1EF69CD025134

Function 005E30BF Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000), ref: 005E3109
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 005E30F1

Part of subcall function 005DB116: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 005DB137

__CxxThrowException@8.LIBVCRUNTIME ref: 005E313A
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 005E3163

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Context$Event$Base::Concurrency::details::$ThrowTrace$Exception@8
String ID:
API String ID: 2630251706-0
Opcode ID: 2e16f945a691997e88dc38e546986e0a68b01d6132f32208ac35509316d06b54
Instruction ID: 5a3402a7cccb4104a62a4c3e8533a494694d95af09e38086ffb70bf967626bdb
Opcode Fuzzy Hash: 2e16f945a691997e88dc38e546986e0a68b01d6132f32208ac35509316d06b54
Instruction Fuzzy Hash: 6911E630700201ABDB18AB69DCDE9ADBF6AFB84360F154167FA0597392CB70DD01CA90

Function 005FD159 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,005EA12B,005FD342,?,005EA57E,?,00000004,00000004,?,00000000,?,005FB18C,?,00000004), ref: 005FD15E
_free.LIBCMT ref: 005FD1BB
_free.LIBCMT ref: 005FD1F1
SetLastError.KERNEL32(00000000,00000006,000000FF,?,005EA57E,?,00000004,00000004,?,00000000,?,005FB18C,?,00000004,00000004), ref: 005FD1FC

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 0df6eebc098d39953f1bddf2bbd8d4c9289c74b409f781dc152a898dea2d0520
Instruction ID: ab65c40ae708e50508a6075eaa2c9829188f6c2a7bcad7c575c035cd19f6f174
Opcode Fuzzy Hash: 0df6eebc098d39953f1bddf2bbd8d4c9289c74b409f781dc152a898dea2d0520
Instruction Fuzzy Hash: 5C11E1366441093ED72537B8AC86D7F2E6BBBD2775B280628F324861E1DB68CD02C530

Function 0056C040 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003), ref: 0056C0C1
VerSetConditionMask.KERNEL32(00000000), ref: 0056C0C5
VerSetConditionMask.KERNEL32(00000000), ref: 0056C0C9
VerifyVersionInfoW.KERNEL32(0000011C,00000023,00000000), ref: 0056C0EF

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: c77b7b5ff03027b858f42eeb85fadd8f9869119bb058b30ade69c08446319f23
Instruction ID: d638fa6bed50f82e38cff410b2535354af2fe0ca66ef2fc2cf17320301546aa5
Opcode Fuzzy Hash: c77b7b5ff03027b858f42eeb85fadd8f9869119bb058b30ade69c08446319f23
Instruction Fuzzy Hash: 031130B0A41318AAEB24DF64DD1ABEF7BB8EF48710F004099A508A7280D7755B548BA5

Function 005E8CA3 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 005E8CBD

Part of subcall function 005E8C0A: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 005E8C39
Part of subcall function 005E8C0A: ___AdjustPointer.LIBCMT ref: 005E8C54

_UnwindNestedFrames.LIBCMT ref: 005E8CD2
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 005E8CE3
CallCatchBlock.LIBVCRUNTIME ref: 005E8D0B

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 009b330a3b05bcd86df672cb968c624856bdd1e241153295b599eacee5e84756
Instruction ID: 6c8434764525fe5c6b87c3cef6a85d6f82ccb16d1b42c55a3df46f9128408dc5
Opcode Fuzzy Hash: 009b330a3b05bcd86df672cb968c624856bdd1e241153295b599eacee5e84756
Instruction Fuzzy Hash: 19015772100189BBCF165E92CC49EEB3F6AFF89354F044008FA889A121D632E861DBA0

Function 005E5AFE Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 005E5B18
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 005E5B2C
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 005E5B44
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 005E5B5C

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: c8ef6192b05c3357363908c599ceeaf6275af44595a57e37f7ac34529dc1d332
Instruction ID: 94a7067124faff71677cdcf40a672b3e2bfc469ffc8138398abeab9e3302cc26
Opcode Fuzzy Hash: c8ef6192b05c3357363908c599ceeaf6275af44595a57e37f7ac34529dc1d332
Instruction Fuzzy Hash: F6012B32600555A7CF29EE568845EAF7F5EBF94354F000056FD92A7281E970ED0086A0

Function 005DB88A Relevance: 6.0, APIs: 4, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Compare_exchange_acquire_4.LIBCONCRT ref: 005DB8BC
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 005DB8CC
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 005DB8DC
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 005DB8F0

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Compare_exchange_acquire_4std::_
String ID:
API String ID: 3973403980-0
Opcode ID: 8a03b3312db81275153a14d669996abd4e5c3aeb84c1ac1d5f3a8e82b28c4f22
Instruction ID: d89d2893b9dd9b0ff8e92cfa87e94ed104029ed2e382977e5857d15622999949
Opcode Fuzzy Hash: 8a03b3312db81275153a14d669996abd4e5c3aeb84c1ac1d5f3a8e82b28c4f22
Instruction Fuzzy Hash: F401A43640420AEBEF229E99DC469AA3F6BBF44350B168413F91889231D733CA61BB41

Function 005D2DAA Relevance: 6.0, APIs: 4, Instructions: 39threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::LoadLibraryAndCreateThread.LIBCONCRT ref: 005D2DC3

Part of subcall function 005D2271: ___crtGetTimeFormatEx.LIBCMT ref: 005D2287
Part of subcall function 005D2271: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 005D22A6

GetLastError.KERNEL32 ref: 005D2DDF
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 005D2DF5
__CxxThrowException@8.LIBVCRUNTIME ref: 005D2E03

Part of subcall function 005D2047: SetThreadPriority.KERNEL32(?,?), ref: 005D2053

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Concurrency::details::LibraryLoadThread$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorException@8FormatLastPriorityReferenceThrowTime___crt
String ID:
API String ID: 1674182817-0
Opcode ID: c07ae8b4770bf902f84aeda974144f252465b22177f9e857be7d775561c1ae41
Instruction ID: f6eb6fbf400e1db6994af486ddf1d3bcd55ba8a25a00977fd3a9ff881ee7b9bf
Opcode Fuzzy Hash: c07ae8b4770bf902f84aeda974144f252465b22177f9e857be7d775561c1ae41
Instruction Fuzzy Hash: F6F0A7B29003267AD734B27D4C0FFBB3DACBB51750F40485BB841E6285FDA4D80142B4

Function 005CD33D Relevance: 6.0, APIs: 4, Instructions: 39timeCOMMON

Download Yara Rule

APIs

Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 005D1AC2

Part of subcall function 005D146B: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 005D148D
Part of subcall function 005D146B: Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 005D14AE

Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 005D1AD5
Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 005D1AE1
Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 005D1AEA

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Concurrency::details::$LockQueue$Concurrency::critical_section::_NodeNode::Timer$Acquire_lockAsyncBase::ContextCurrentDerefLibraryLoadRegisterSchedulerSwitch_to_active
String ID:
API String ID: 4284812201-0
Opcode ID: 16a3285ed3bbc16e42b3a5042958489ac89673610d790d33aaa10952c45194d9
Instruction ID: 71618e04f456db5170f827215a4906a14a2fac911d056c8ede022df8fe49b0ab
Opcode Fuzzy Hash: 16a3285ed3bbc16e42b3a5042958489ac89673610d790d33aaa10952c45194d9
Instruction Fuzzy Hash: 82F09624701A067B8B24AAB84459AAD6D977BC0350B08453BF9125B391CE614D4193D9

Function 0060D0C2 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000,?,?,0060B294,?,00000001,?,?,?,005FF783), ref: 0060D0D9
GetLastError.KERNEL32(?,0060B294,?,00000001,?,?,?,005FF783), ref: 0060D0E5

Part of subcall function 0060D0AB: CloseHandle.KERNEL32(FFFFFFFE,0060D0F5,?,0060B294,?,00000001,?,?,?,005FF783), ref: 0060D0BB

___initconout.LIBCMT ref: 0060D0F5

Part of subcall function 0060D06D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0060D09C,0060B281,?,?,005FF783), ref: 0060D080

WriteConsoleW.KERNEL32(?,?,?,00000000,?,0060B294,?,00000001,?,?,?,005FF783), ref: 0060D10A

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 98f37cd00904de8da1488ca813749b1d90a00ff8270c803350c9c9298e0ddaf3
Instruction ID: e18e9384f930b8032923d1bc8928006e4c977864c3c6a84dbf10b71eb6d1070f
Opcode Fuzzy Hash: 98f37cd00904de8da1488ca813749b1d90a00ff8270c803350c9c9298e0ddaf3
Instruction Fuzzy Hash: B5F01C3A540115BBCF262FE5DC0A9CF3F67EB093B1F148154FA0985160DA3289A0EBA5

Function 005D8B70 Relevance: 6.0, APIs: 4, Instructions: 26memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005D20B4: TlsAlloc.KERNEL32(00000000,?,?), ref: 005D20BA

TlsAlloc.KERNEL32(00000000,?,?), ref: 005E334F
GetLastError.KERNEL32 ref: 005E3361
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 005E3377
__CxxThrowException@8.LIBVCRUNTIME ref: 005E3385

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Alloc$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3735082963-0
Opcode ID: a4c85ff6b89cbf972aadb195ee2d080ecf417c96b2ff6aa952236389cf83c9f8
Instruction ID: e8911673050d9fc29ce4f0d07810050b22c4f2f5f9f02b7bbcf9058a06bde06a
Opcode Fuzzy Hash: a4c85ff6b89cbf972aadb195ee2d080ecf417c96b2ff6aa952236389cf83c9f8
Instruction Fuzzy Hash: 84E09B748001569BC714FB7A9C1EA6E7D697605764B100D17F052D22A1DE708100C6A5

Function 005D2047 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

SetThreadPriority.KERNEL32(?,?), ref: 005D2053
GetLastError.KERNEL32 ref: 005D205F
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 005D2075
__CxxThrowException@8.LIBVCRUNTIME ref: 005D2083

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastPriorityThreadThrow
String ID:
API String ID: 4286982218-0
Opcode ID: 26b876321805a3cccb0e30ea0bd77996aad7167747b93bd4fb675ad1f83a502e
Instruction ID: 9387b1ced1fb8bd428326973e4036d28056bbb368fb4aac5242ba293e086988a
Opcode Fuzzy Hash: 26b876321805a3cccb0e30ea0bd77996aad7167747b93bd4fb675ad1f83a502e
Instruction Fuzzy Hash: 88E0863451011AABCB10BB75CC0DFFB7B6DBB04380F044817B811D51A2EA75D510D6A1

Function 005D210D Relevance: 6.0, APIs: 4, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,00000000,005D7218,00000000,?,?,?,?), ref: 005D2119
GetLastError.KERNEL32 ref: 005D2125
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 005D213B
__CxxThrowException@8.LIBVCRUNTIME ref: 005D2149

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrowValue
String ID:
API String ID: 1964976909-0
Opcode ID: cef28be059bae92a8b2a4e4067eda1c76dfeb4c4252d14954c909ef6a21867c2
Instruction ID: 6319855efd7ebf5b568970337c259dfd571da348a6eee4ac59b6e86453384b55
Opcode Fuzzy Hash: cef28be059bae92a8b2a4e4067eda1c76dfeb4c4252d14954c909ef6a21867c2
Instruction Fuzzy Hash: D5E04F3450011AABCB15BBB5CC4EFEA7A697B04344F448857B511D51A1DA74D51186A0

Function 005D20B4 Relevance: 6.0, APIs: 4, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsAlloc.KERNEL32(00000000,?,?), ref: 005D20BA
GetLastError.KERNEL32 ref: 005D20C7
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 005D20DD
__CxxThrowException@8.LIBVCRUNTIME ref: 005D20EB

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: AllocConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3103352999-0
Opcode ID: 5c29253fb46333e39016924122fe3345be30c5f14609c3a1cebb06dfa18a9877
Instruction ID: 9152ecbcc76acf717f9bc537fcf356a026d613175cb69cc35878e436975ff298
Opcode Fuzzy Hash: 5c29253fb46333e39016924122fe3345be30c5f14609c3a1cebb06dfa18a9877
Instruction Fuzzy Hash: FAE0C27040012A97C724B7BA9C0EBBF7AAD7A00350F540A17F022D12E1EA74D40482B1

Function 005FB42C Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005FB435

Part of subcall function 005FD2A2: HeapFree.KERNEL32(00000000,00000000,?,00607694,?,00000000,?,?,?,00607939,?,00000007,?,?,00607D3E,?), ref: 005FD2B8
Part of subcall function 005FD2A2: GetLastError.KERNEL32(?,?,00607694,?,00000000,?,?,?,00607939,?,00000007,?,?,00607D3E,?,?), ref: 005FD2CA

_free.LIBCMT ref: 005FB448
_free.LIBCMT ref: 005FB459
_free.LIBCMT ref: 005FB46A

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c36bf6e6f175a732d2bc01824038d180a602098f0b9f15acc2653e483523317b
Instruction ID: 8658e0f1e0ee13fdf63a249a7201fbed9c7174de12f401bc017c1fb0fd6cc10c
Opcode Fuzzy Hash: c36bf6e6f175a732d2bc01824038d180a602098f0b9f15acc2653e483523317b
Instruction Fuzzy Hash: 86E0127C806120AAC7823F2ABC0A8193F33FB86730340B006F4000333AD7396822AFE5

Function 005BB200 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

Part of subcall function 005CED5F: EnterCriticalSection.KERNEL32(0064BC04,?,?,?,00563B3C,0064CA30,0056135E,A7D6A816,?,0060F600,000000FF), ref: 005CED6A
Part of subcall function 005CED5F: LeaveCriticalSection.KERNEL32(0064BC04,?,?,?,00563B3C,0064CA30,0056135E,A7D6A816,?,0060F600,000000FF), ref: 005CEDA7

Part of subcall function 005CF0BB: __onexit.LIBCMT ref: 005CF0C1

__Init_thread_footer.LIBCMT ref: 005BB288

Part of subcall function 005CED15: EnterCriticalSection.KERNEL32(0064BC04,?,?,00563B9F,0064CA30,00617390), ref: 005CED1F
Part of subcall function 005CED15: LeaveCriticalSection.KERNEL32(0064BC04,?,?,00563B9F,0064CA30,00617390), ref: 005CED52

Strings

c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\uninstallprogressscreen.cpp, xrefs: 005BB5CB
: Installer service has completed, xrefs: 005BB5EF

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit
String ID: : Installer service has completed$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\uninstallprogressscreen.cpp
API String ID: 2974294136-66232262
Opcode ID: 878e5c99e7ced067b7fcb939a41ab49a7be31c2ddf6b83f1f5454c0f2cab6290
Instruction ID: b46ddba738f94506a7d3475c513deb02c46e233acd21493ab34f855fddfb9bed
Opcode Fuzzy Hash: 878e5c99e7ced067b7fcb939a41ab49a7be31c2ddf6b83f1f5454c0f2cab6290
Instruction Fuzzy Hash: A2E1B270901249DFEB10DFA8D849B9EBFB2FF45314F148168E405AB3A2DBB5AD04CB91

Function 005FA5DD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 005FA66D

Strings

pow, xrefs: 005FA645, 005FA662

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 91dad68304dfce0578f37ca5f18d55b6e4b40eedce31f23348f6de39f1e6b5e5
Instruction ID: 02cebc6b3835ae6779099ead5e599acfdf93ea89e6bcec02fd6b8b6564440cf5
Opcode Fuzzy Hash: 91dad68304dfce0578f37ca5f18d55b6e4b40eedce31f23348f6de39f1e6b5e5
Instruction Fuzzy Hash: B451AFA1D5690596DB1A7714CD013BB2FAAFF40740F684C59E08B823F9EF398C919E47

Function 006063F3 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00605F8C: GetOEMCP.KERNEL32(00000000,00606202,006483A8,006483EA,005EA77A,005EA77A,006483EA,00560000,006483A8), ref: 00605FB7

IsValidCodePage.KERNEL32(-00000030,00000000,00280000,00560000,?,?,00606249,00560000,00000000,006483A8,00000000,00560000,?,?,?,005EA77A), ref: 00606451
GetCPInfo.KERNEL32(00000000,Ib`,?,?,00606249,00560000,00000000,006483A8,00000000,00560000,?,?,?,005EA77A,006483EA,00560000), ref: 00606493

Strings

Ib`, xrefs: 0060648E, 00606491

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: Ib`
API String ID: 546120528-2591229728
Opcode ID: fdd8af0faa4b052c76c5392d4fa298e741d00cf46d73366548fdbaffeec49cde
Instruction ID: 7055e79079f4842bc723e87ceff2c6c0599aab31e5479dac0ab361eebaa05825
Opcode Fuzzy Hash: fdd8af0faa4b052c76c5392d4fa298e741d00cf46d73366548fdbaffeec49cde
Instruction Fuzzy Hash: 0B5101709802469EDB2A8F75C8416FBBBE6AF91300F14846EE0968B291D7749A56CB90

Function 005B5680 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(A7D6A816,00647C88,?), ref: 005B56AE

Part of subcall function 005AE990: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00000001), ref: 005AE9AD
Part of subcall function 005AE990: Process32FirstW.KERNEL32(00000000,0000022C), ref: 005AE9E5
Part of subcall function 005AE990: Process32NextW.KERNEL32(00000000,0000022C), ref: 005AEA05
Part of subcall function 005AE990: CloseHandle.KERNEL32(00000000), ref: 005AEA0E

Part of subcall function 00563AB0: GetProcessHeap.KERNEL32 ref: 00563AF1
Part of subcall function 00563AB0: __Init_thread_footer.LIBCMT ref: 00563B1C
Part of subcall function 00563AB0: __Init_thread_footer.LIBCMT ref: 00563B9A

_wcsstr.LIBVCRUNTIME ref: 005B582B

Strings

c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\setuputils.cpp, xrefs: 005B4EA1, 005B4EEA, 005B4FD7, 005B501F, 005B5414, 005B54D6, 005B5590, 005B55AB, 005B572C, 005B5893, 005B58AE
Failed to query parent process, xrefs: 005B5722

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Init_thread_footerProcessProcess32$CloseCreateCurrentFirstHandleHeapNextSnapshotToolhelp32_wcsstr
String ID: Failed to query parent process$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\setuputils.cpp
API String ID: 3690990950-120794212
Opcode ID: 57355cdd89836c6fb3542c3226f71c368537d1921c8eca9d2fa750b09fd7e2fb
Instruction ID: e901730a9a336651989aee975f99d06ab0fbe8de265f11ee2dc637c27adcaced
Opcode Fuzzy Hash: 57355cdd89836c6fb3542c3226f71c368537d1921c8eca9d2fa750b09fd7e2fb
Instruction Fuzzy Hash: 2851F872901516DBDB18DF68C85A7AEFFA5FF80320F144269E855AB382DB34AD04CBD1

Function 0056CA1B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Part of subcall function 005BF3E0: _strftime.LIBCMT ref: 005BF444

GetCurrentThreadId.KERNEL32 ref: 0056CAF7

Strings

: showing BrowserGuard screen, xrefs: 0056CA66
c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mainframe.cpp, xrefs: 0056CA45

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: CurrentThread_strftime
String ID: : showing BrowserGuard screen$c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mainframe.cpp
API String ID: 3692370876-2087066748
Opcode ID: 3b1337e9ee24e6c8421eb502da505e76e3cd6ef66e934d9fdb7cd2f1d4c982f2
Instruction ID: 75899f7d596b904d7c6eafd032da17757e3d662de124ebb3b0ddc2ae1802d3f1
Opcode Fuzzy Hash: 3b1337e9ee24e6c8421eb502da505e76e3cd6ef66e934d9fdb7cd2f1d4c982f2
Instruction Fuzzy Hash: 7941B470B0020A8BDB14EF64D899B6E7FA6FFC0304F50892DE595DB292EB35E900CB50

Function 005B83B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 005B8406

Strings

d, xrefs: 005B8434
d, xrefs: 005B83F6

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: __aulldiv
String ID: d$d
API String ID: 3732870572-195624457
Opcode ID: 9fd5db8abb90f31910d4e87b1f592903bd82b7ee4f481985a2e14253cdd42d53
Instruction ID: 7dbb3abe0a97c350fa45785420f8d47494eb0429a3ce8ef8e206a1c23f3c0d9d
Opcode Fuzzy Hash: 9fd5db8abb90f31910d4e87b1f592903bd82b7ee4f481985a2e14253cdd42d53
Instruction Fuzzy Hash: B6216A356043819FCF11CB69A855ABEBFF9EBDA304B1440BEE5848B322CD329900C760

Function 005CE092 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000D,?,00000004,ios_base::failbit set,?,005CB5F6,00000001,00000000,005719CA,00000000,?,005717A7,0064CB94,00571770,0064CB8C), ref: 005CE116

Strings

ios_base::failbit set, xrefs: 005CE095

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ErrorLast
String ID: ios_base::failbit set
API String ID: 1452528299-3924258884
Opcode ID: 2066b042f6b9d4d074e2f18dadb3406966b49e45a5409cc8cc9e188edc724aa6
Instruction ID: 7b54f77045109cf703625dfd4ef98db90ddde8c57547f43e2407f506f8f33297
Opcode Fuzzy Hash: 2066b042f6b9d4d074e2f18dadb3406966b49e45a5409cc8cc9e188edc724aa6
Instruction Fuzzy Hash: B511E536200125AFCF125FA0DC89AAABF66FF08751B04803DF905A7250D7B09C10CBE0

Function 005BF3E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

_strftime.LIBCMT ref: 005BF444

Strings

c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp, xrefs: 005BF3F3
%F %T (UTC %z) , xrefs: 005BF433

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: _strftime
String ID: %F %T (UTC %z) $c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbutils.cpp
API String ID: 1867682108-2181180755
Opcode ID: aaac0c4ef3e2418f24a6ed53dbb6ee6940eb8992bf827e6fea15779968f09a20
Instruction ID: f8e84079f4f967e83205d1e4e0ed6261fcd32b6e7810853bb0ecb46eac85763e
Opcode Fuzzy Hash: aaac0c4ef3e2418f24a6ed53dbb6ee6940eb8992bf827e6fea15779968f09a20
Instruction Fuzzy Hash: 8311547590131D9ACB20EF64CC4ABEAB7B8BF48700F4446DEA95993241EB746B84CF90

Function 005DD3BE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 005DD406
__CxxThrowException@8.LIBVCRUNTIME ref: 005DD414

Strings

pContext, xrefs: 005DD3FE

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 1687795959-2046700901
Opcode ID: 9e6590763afcb95e5ca89191d25d61a8ef7c7e41e176026041cd50481df1999d
Instruction ID: 11f9045368ad80a2e088bdd59d6074582bad7c9aa0d30f1a2be51dee747e2ed4
Opcode Fuzzy Hash: 9e6590763afcb95e5ca89191d25d61a8ef7c7e41e176026041cd50481df1999d
Instruction Fuzzy Hash: B0F0B435B002186B8B14ABA9D899C9EFB7DAF957A07054027E902A7351DB70ED0187A1

Function 005AD0D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,DestroyEnvironmentBlock), ref: 005AD107
FreeLibrary.KERNEL32(?,A7D6A816,?,?,0060F5C0,000000FF), ref: 005AD118

Strings

DestroyEnvironmentBlock, xrefs: 005AD101

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: DestroyEnvironmentBlock
API String ID: 3013587201-3932814116
Opcode ID: 4d31fa624dc98ab9aedcd8b5a13b7ea8c8390a385be890048d13c6fa8918b8f9
Instruction ID: a21dd4ae1c7b292f8d7705eaa3dbd65c1c3ac83e48a9d57f9ee2170f16050705
Opcode Fuzzy Hash: 4d31fa624dc98ab9aedcd8b5a13b7ea8c8390a385be890048d13c6fa8918b8f9
Instruction Fuzzy Hash: ACF09031504604EFD7219F58DC06B56B7F9FB05B60F00862EF822C3A90DB35A940CA60

Function 005E8951 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

std::__non_rtti_object::__construct_from_string_literal.LIBVCRUNTIME ref: 005E895D
__CxxThrowException@8.LIBVCRUNTIME ref: 005E8984

Part of subcall function 005E66D1: RaiseException.KERNEL32(?,?,?,?), ref: 005E6731

Part of subcall function 005EA50D: _free.LIBCMT ref: 005EA520

Strings

Access violation - no RTTI data!, xrefs: 005E8954

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow_freestd::__non_rtti_object::__construct_from_string_literal
String ID: Access violation - no RTTI data!
API String ID: 2536551521-2158758863
Opcode ID: 11d53c5acee010ae0b8181b1a526bcd744dae1e4d51a67900716a98e74c476f0
Instruction ID: 89569d8ac09dc6f7c57c95a61f7f095adbdb3ef4569176dab56d11a14fe21e94
Opcode Fuzzy Hash: 11d53c5acee010ae0b8181b1a526bcd744dae1e4d51a67900716a98e74c476f0
Instruction Fuzzy Hash: F8E0DF72C082495A8B0CEAE2988BCBA7BACED04740B640896FA48D2442EE61FD404162

Function 005E0C7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 005E0C99
__CxxThrowException@8.LIBVCRUNTIME ref: 005E0CA7

Strings

pThreadProxy, xrefs: 005E0C91

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pThreadProxy
API String ID: 1687795959-3651400591
Opcode ID: af1bd0aa00bedd7cb1af57f0ec5d77079967664933d8cb93e7eecba82c1e6843
Instruction ID: 6fac0bc2d58b11e4e6a72873a1f86570ae7df18a1edd499322378c55048fab53
Opcode Fuzzy Hash: af1bd0aa00bedd7cb1af57f0ec5d77079967664933d8cb93e7eecba82c1e6843
Instruction Fuzzy Hash: 4ED05E71D102086ADB08EAA9C84BE8DBBA86B50784F5445386915A6086EBB0E944CA90

Function 005CEA05 Relevance: 5.0, APIs: 4, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000008,?,005A9F5E,?), ref: 005CEA0A
HeapAlloc.KERNEL32(00000000), ref: 005CEA11
GetProcessHeap.KERNEL32(00000000,00000000), ref: 005CEA57
HeapFree.KERNEL32(00000000), ref: 005CEA5E

Part of subcall function 005CE8A4: GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,005CEA4D,00648398), ref: 005CE8C8
Part of subcall function 005CE8A4: HeapAlloc.KERNEL32(00000000,?,005CEA4D,00648398), ref: 005CE8CF

Memory Dump Source

Source File: 00000000.00000002.2579700525.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2579681168.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579855781.0000000000619000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579893064.0000000000647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579911306.0000000000649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579927370.000000000064B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000064D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000078C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2580035395.000000000079C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_tOE2mg8TbU.jbxd

Similarity

API ID: Heap$Process$Alloc$Free
String ID:
API String ID: 1864747095-0
Opcode ID: 42b7586d0581b06fa13fc60fc1017ef2e70d2e2be059379ae03ed9f11e9fc3a4
Instruction ID: e89c25d672297ce8e903581fb178235e58e10d07cf1b77b024220f7297ba8b23
Opcode Fuzzy Hash: 42b7586d0581b06fa13fc60fc1017ef2e70d2e2be059379ae03ed9f11e9fc3a4
Instruction Fuzzy Hash: B9F09032A44612AFDB256BF97C1FE9A2E6ABFC1761B19941EF405C7150DE3088408B60

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report tOE2mg8TbU.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
tOE2mg8TbU.exe

Function 005A0310 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 376
COMMON

Function 0059D0F0 Relevance: 8.0, APIs: 1, Strings: 4, Instructions: 455
memoryCOMMON

Function 0059D150 Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 430
memoryCOMMON

Function 0059D800 Relevance: .3, Instructions: 261
COMMON

Function 005A03A0 Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Function 00586149 Relevance: 50.6, APIs: 1, Strings: 32, Instructions: 1053
COMMON

Function 005AFA70 Relevance: 46.5, APIs: 2, Strings: 24, Instructions: 1020
COMMON