Edit tour

Windows Analysis Report
ep_setup.exe

Overview

General Information

Sample name:	ep_setup.exe
Analysis ID:	1578478
MD5:	f164888a6fbc646b093f6af6663f4e63
SHA1:	3c0bb9f9a4ad9b1c521ad9fc30ec03668577c97c
SHA256:	8c5a3597666f418b5c857e68c9a13b7b6d037ea08a988204b572f053450add67
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

System process connects to network (likely due to code injection or exploit)

Contains functionality to automate explorer (e.g. start an application)

Possible COM Object hijacking

Sigma detected: Explorer NOUACCHECK Flag

Binary contains a suspicious time stamp

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (foreground window change detection)

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses taskkill to terminate processes

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w11x64_office

ep_setup.exe (PID: 8320 cmdline: "C:\Users\user\Desktop\ep_setup.exe" MD5: F164888A6FBC646B093F6AF6663F4E63)

taskkill.exe (PID: 8392 cmdline: "C:\Windows\system32\taskkill.exe" /f /im explorer.exe MD5: 050ED22BB515A81ED6FC73D042CE5DB4)

conhost.exe (PID: 8424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 9698384842DA735D80D278A427A229AB)

sc.exe (PID: 8584 cmdline: "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB MD5: FF2A4319FA5531F0D7B98DBBA9ABBD4A)

conhost.exe (PID: 8600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 9698384842DA735D80D278A427A229AB)

sc.exe (PID: 8672 cmdline: "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB MD5: FF2A4319FA5531F0D7B98DBBA9ABBD4A)

conhost.exe (PID: 8680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 9698384842DA735D80D278A427A229AB)

regsvr32.exe (PID: 8724 cmdline: "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll" MD5: AF0CDEF5F6ECB9B8EBEF4E480EBAAA5A)

regsvr32.exe (PID: 8744 cmdline: "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll" MD5: AF0CDEF5F6ECB9B8EBEF4E480EBAAA5A)

explorer.exe (PID: 8892 cmdline: "C:\Windows\explorer.exe" MD5: E2D1F700066D39814081317462A0FD74)

explorer.exe (PID: 9012 cmdline: "C:\Windows\explorer.exe" /NoUACCheck MD5: E2D1F700066D39814081317462A0FD74)

WidgetBoard.exe (PID: 3680 cmdline: "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe" -RegisterProcessAsComServer -ServerName:Microsoft.Windows.WidgetBoardServer MD5: FE1C0C15EF5C6C2B0A1508BF23EAD6CE)

cleanup

Sigma Signatures

System Summary

Sigma detected: Explorer NOUACCHECK Flag

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\explorer.exe" /NoUACCheck, CommandLine: "C:\Windows\explorer.exe" /NoUACCheck, CommandLine|base64offset|contains: y, Image: C:\Windows\explorer.exe, NewProcessName: C:\Windows\explorer.exe, OriginalFileName: C:\Windows\explorer.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1316, ProcessCommandLine: "C:\Windows\explorer.exe" /NoUACCheck, ProcessId: 9012, ProcessName: explorer.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T19:43:29.659700+0100	2803274	2	Potentially Bad Traffic	192.168.2.24	49790	20.233.83.145	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Windows\explorer.exe

Code function: 12_2_00007FFD6568FC70 CreateFileW,GetLastError,GetFileSizeEx,GetLastError,CloseHandle,CloseHandle,CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CloseHandle,CryptReleaseContext,ReadFile,CryptHashData,ReadFile,GetLastError,CryptReleaseContext,CryptDestroyHash,CloseHandle,CryptGetHashParam,GetLastError,CryptDestroyHash,CryptReleaseContext,CloseHandle,

12_2_00007FFD6568FC70

Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_setup.exe	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_gui.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_dwm.exe	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_weather_host.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\WebView2Loader.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_taskbar.2.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\Windows.UI.ShellCommon.pri	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\pris	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\pris\Windows.UI.ShellCommon.en-US.pri	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\StartUI	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\StartUI\Assets	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\StartUI\Assets\officehub150x150.png	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\StartUI\Assets\officehub71x71.png	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\StartUI\Assets\onenote150x150.png	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\StartUI\Assets\onenote71x71.png	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\StartUI\Assets\Fonts	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\StartUI\Assets\Fonts\BitMDL2.ttf	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\StartUI\Assets\Fonts\SkypeUISymbol-Regular.ttf	Jump to behavior

Source: C:\Users\user\Desktop\ep_setup.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher

Jump to behavior

Source: ep_setup.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\ep_taskbar\ep_taskbar\build\Release\x64\ep_taskbar.2.pdb9 source: ep_setup.exe, 00000001.00000003.11825212657.000001322B9BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\WebView2Loader.dll.pdb source: ep_setup.exe, 00000001.00000003.11824345024.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: explorer.pdbUGP source: explorer.exe, 0000000C.00000003.11854671315.0000000003787000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11866284977.0000000002DF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11940859745.000000000ACC6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_weather_host_stub.pdb source: ep_setup.exe, 00000001.00000003.11824140764.0000013228E54000.00000004.00000020.00020000.00000000.sdmp, ep_setup.exe, 00000001.00000003.11824101655.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: StartDocked.pdb source: explorer.exe, 0000000C.00000003.11857940561.0000000003780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11870699948.0000000002DF2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\ExplorerPatcher\explorer.pdbb8 source: explorer.exe, 0000000E.00000003.12160188405.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12152136805.0000000007A55000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12139286268.0000000007A52000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: StartUI.pdb source: ep_setup.exe, 00000001.00000003.11833035066.000001322B9B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.11858821436.0000000003785000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11871628442.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp, StartUI_.dll.1.dr
Source:	Binary string: GET /download/symbols/explorer.pdb/598A53662BD73B032010E6534F37452E1/explorer.pdb HTTP/1.1 source: explorer.exe, 0000000E.00000003.12062804617.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12104924851.0000000007A59000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Global\C::Users:user:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs.pdb] source: explorer.exe, 0000000E.00000003.12143590504.00000000079FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: explorer.pdb source: explorer.exe, 0000000C.00000003.11854671315.0000000003787000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11866284977.0000000002DF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11940859745.000000000ACC6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: JumpViewUI.pdb source: ep_setup.exe, 00000001.00000003.11830373643.000001322B9B3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /download/symbols/explorer.pdb/598A53662BD73B032010E6534F37452E1/explorer.pdb source: explorer.exe, 0000000E.00000003.12160188405.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12062804617.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12104924851.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12152136805.0000000007A55000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12139286268.0000000007A52000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_gui.pdb source: ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\ExplorerPatcher\explorer.pdb source: explorer.exe, 0000000E.00000003.12160188405.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12152136805.0000000007A55000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12139286268.0000000007A52000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: er.pdb source: explorer.exe, 0000000E.00000003.12160188405.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12062804617.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12104924851.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12152136805.0000000007A55000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12139286268.0000000007A52000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 6534F37452E1r.pdbv source: explorer.exe, 0000000E.00000003.12143590504.0000000007910000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: twinui.pcshell.pdbUGP source: explorer.exe, 0000000C.00000003.11860676089.0000000003800000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.11856615647.000000000378C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11868609315.0000000002DF4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11873625449.0000000002E7C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: twinui.pcshell.pdb source: explorer.exe, 0000000C.00000003.11860676089.0000000003800000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.11856615647.000000000378C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11868609315.0000000002DF4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11873625449.0000000002E7C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\ExplorerPatcher\explorer.pdbR9 source: explorer.exe, 0000000E.00000003.12160188405.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12152136805.0000000007A55000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12139286268.0000000007A52000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ExplorerPatcher.amd64.pdb source: ep_setup.exe, 00000001.00000003.11833924594.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: StartUI.pdb@ source: ep_setup.exe, 00000001.00000003.11833035066.000001322B9B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.11858821436.0000000003785000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11871628442.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp, StartUI_.dll.1.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\WebView2Loader.dll.pdbOGP source: ep_setup.exe, 00000001.00000003.11824345024.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_dwm.pdb source: ep_setup.exe, 00000001.00000003.11823535101.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp, ep_setup.exe, 00000001.00000003.11823575705.0000013228E56000.00000004.00000020.00020000.00000000.sdmp, ep_dwm.exe.1.dr
Source:	Binary string: r.pdb source: explorer.exe, 0000000E.00000003.12143590504.0000000007910000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: JumpViewUI.pdb\|\|#zGCTL source: ep_setup.exe, 00000001.00000003.11830373643.000001322B9B3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: xC:\Users\user\AppData\Roaming\ExplorerPatcher\explorer.pdb464,int)4 source: explorer.exe, 0000000E.00000003.12124763664.0000000010437000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12151803189.0000000010437000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\Win32\ExplorerPatcher.IA-32.pdb source: ep_setup.exe, 00000001.00000003.11822258609.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp, ep_setup.exe, 00000001.00000003.11822325754.0000013228E5F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_setup.pdb source: ep_setup.exe
Source:	Binary string: http://msdl.microsoft.com/download/symbols/explorer.pdb/598A53662BD73B032010E6534F37452E1/explorer.pdb source: explorer.exe, 0000000E.00000003.12143590504.00000000079FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12143590504.0000000007910000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ep_taskbar\ep_taskbar\build\Release\x64\ep_taskbar.2.pdb source: ep_setup.exe, 00000001.00000003.11825212657.000001322B9BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Hostmsdl.microsoft.comGET /download/symbols/explorer.pdb/598A53662BD73B032010E6534F37452E1/explorer.pdb HTTP/1.1 source: explorer.exe, 0000000E.00000003.12062804617.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12104924851.0000000007A59000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_weather_host.pdb source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp, ep_setup.exe, 00000001.00000003.11823886137.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_startmenu.pdb source: ep_setup.exe, 00000001.00000003.11829795440.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6566D980 InitializeCriticalSection,CreateEventW,CreateEventW,CreateEventW,SetEvent,SetEvent,SetEvent,CreateThread,CloseHandle,SHGetFolderPathW,PathFileExistsW,CreateDirectoryW,CreateMutexExW,CreateEventW,CreateEventW,CreateThread,CreateThread,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleW,GetCurrentProcess,K32GetModuleInformation,GetModuleHandleW,GetProcAddress,IsOS,GetCurrentProcess,K32GetModuleInformation,LoadLibraryExW,LoadLibraryW,GetProcAddress,CreateWindowExW,FreeLibraryAndExitThread,SetWindowLongPtrW,FreeLibraryAndExitThread,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,LoadLibraryExW,LoadLibraryExW,LoadLibraryExW,LoadLibraryExW,GetModuleHandleW,GetProcAddress,SHELL32_Create_IEnumUICommand,VirtualProtect,VirtualProtect,GetProcAddress,VirtualProtect,VirtualProtect,LoadLibraryW,GetProcAddress,LoadLibraryExW,GetModuleHandleExW,GetCurrentProcess,K32GetModuleInformation,VirtualProtect,VirtualProtect,GetCurrentProcess,K32GetModuleInformation,LoadLibraryExW,LoadLibraryExW,GetProcAddress,LoadLibraryExW,IsOS,FreeLibraryAndExitThread,CreateThread,CreateThread,CreateThread,CreateWindowInBand,CreateThread,CreateThread,GetWindowsDirectoryW,FindFirstFileW,FindClose,LoadLibraryW,GetProcAddress,GetLastError,	12_2_00007FFD6566D980
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6565D920 GetWindowsDirectoryW,FindFirstFileW,FindClose,GetWindowsDirectoryW,FindFirstFileW,	12_2_00007FFD6565D920
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65685AC0 RegCreateKeyExW,GetWindowsDirectoryW,RegQueryValueExA,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegDeleteTreeW,RegCreateKeyExW,GetSystemDirectoryW,RegQueryValueExA,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegCloseKey,RegDeleteTreeW,RegCreateKeyExW,GetWindowsDirectoryW,RegQueryValueExA,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegDeleteTreeW,RegCreateKeyExW,GetWindowsDirectoryW,FindFirstFileW,FindClose,GetWindowsDirectoryW,RegQueryValueExA,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegDeleteTreeW,RegCreateKeyExW,RegDeleteValueW,RegCloseKey,	12_2_00007FFD65685AC0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65685070 RegCreateKeyExW,GetWindowsDirectoryW,FindFirstFileW,FindClose,GetWindowsDirectoryW,FindFirstFileW,FindClose,GetWindowsDirectoryA,RegCloseKey,RegSetValueExW,RegSetValueExA,RegSetValueExW,RegCloseKey,	12_2_00007FFD65685070
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6565CE30 CreateFileA,CreateFileMappingW,CloseHandle,MapViewOfFile,CloseHandle,CloseHandle,UnmapViewOfFile,CloseHandle,CloseHandle,UnmapViewOfFile,CloseHandle,CloseHandle,UnmapViewOfFile,CloseHandle,CloseHandle,PathRemoveFileSpecA,UnmapViewOfFile,CloseHandle,CloseHandle,FindFirstFileA,FindClose,DeleteFileA,UnmapViewOfFile,CloseHandle,CloseHandle,	12_2_00007FFD6565CE30
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656B3948 FindFirstFileExW,	12_2_00007FFD656B3948
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6565DAC0 SHGetFolderPathW,FindFirstFileW,FindClose,	12_2_00007FFD6565DAC0

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 20.233.83.145 443			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.199.110.133 443			Jump to behavior

Source: Joe Sandbox View	IP Address: 20.233.83.145 20.233.83.145
Source: Joe Sandbox View	IP Address: 185.199.110.133 185.199.110.133
Source: Joe Sandbox View	IP Address: 185.199.110.133 185.199.110.133

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.24:49790 -> 20.233.83.145:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\explorer.exe

Code function: 12_2_00007FFD65690540 InternetOpenA,InternetOpenUrlA,InternetReadFile,SHGetFolderPathW,CreateDirectoryW,GetLastError,ShellExecuteExW,WaitForSingleObject,CloseHandle,Sleep,DeleteFileW,InternetCloseHandle,InternetCloseHandle,

12_2_00007FFD65690540

Source: global traffic	HTTP traffic detected: GET /valinet/ExplorerPatcher/releases/latest/download/ep_setup.exe HTTP/1.1User-Agent: ExplorerPatcherHost: github.com
Source: global traffic	HTTP traffic detected: GET /valinet/ExplorerPatcher/releases/download/22621.4317.67.1_b93337a/ep_setup.exe HTTP/1.1User-Agent: ExplorerPatcherHost: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /github-production-release-asset-2e65be/394318710/5e5bb508-cbdc-44fb-9830-5b535df6ab52?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241219%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241219T184209Z&X-Amz-Expires=300&X-Amz-Signature=6d698d818240e4899e410aa379d337e10eebc51c67064cb29ff3b029bc673213&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dep_setup.exe&response-content-type=application%2Foctet-stream HTTP/1.1User-Agent: ExplorerPatcherConnection: Keep-AliveHost: objects.githubusercontent.com

Source: global traffic	DNS traffic detected: DNS query: srtb.msn.com
Source: global traffic	DNS traffic detected: DNS query: tse1.mm.bing.net
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: objects.githubusercontent.com

Source: WidgetBoard.exe, 00000014.00000002.13651394023.00000236E6B35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://adaptivecards.io/schemas/adaptive-card.json
Source: explorer.exe, 0000000E.00000003.12143590504.0000000007864000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: ep_setup.exe	String found in binary or memory: http://www.winimage.com/zLibDll
Source: WidgetBoard.exe, 00000014.00000002.13647627723.00000236E4E5D000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13647289234.00000236E4E47000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13647993600.00000236E4E88000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13650603961.00000236E6B02000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13649499798.00000236E4EE1000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13649266539.00000236E4ED0000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13648200876.00000236E4E9B000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13650938977.00000236E6B13000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13648434910.00000236E4EAC000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13648691521.00000236E4EBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/
Source: explorer.exe, 0000000E.00000003.12143590504.0000000007864000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 0000000E.00000003.12143590504.0000000007864000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirm
Source: ep_setup.exe, 00000001.00000003.11833924594.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, explorer.exe, 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://api.github.com/repos/valinet/ExplorerPatcher/releases?per_page=1
Source: explorer.exe, 0000000E.00000003.12160188405.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12062804617.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12104924851.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12152136805.0000000007A55000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12139286268.0000000007A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet
Source: ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet)
Source: ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher#donate
Source: ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/blob/master/CHANGELOG.md
Source: explorer.exe	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/discussions
Source: explorer.exe	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/discussions/1102
Source: ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/discussions/1679
Source: explorer.exe	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/issues
Source: ep_setup.exe, 00000001.00000003.11833924594.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/issueshttps://github.com/valinet/ExplorerPatcher/discussi
Source: explorer.exe	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/releases
Source: ep_setup.exe, 00000001.00000003.11833924594.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, explorer.exe, 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/releases/latest
Source: explorer.exe, 0000000E.00000003.12160188405.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12062804617.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12104924851.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12152136805.0000000007A55000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12139286268.0000000007A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/releases/latest/download/ep_setup.exe
Source: explorer.exe, 0000000E.00000003.12160188405.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12062804617.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12104924851.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12152136805.0000000007A55000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12139286268.0000000007A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/releases/latest/download/ep_setup.exev
Source: ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/About-advanced-settings
Source: ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/Configure-updates
Source: ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/ExplorerPatcher
Source: ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/Frequently-asked-questions
Source: ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/Settings-management
Source: ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/Simple-Window-Switcher
Source: explorer.exe, explorer.exe, 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/Symbols
Source: ep_setup.exe, 00000001.00000003.11833924594.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/SymbolsMicrosoft.Windows.Explorer
Source: ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/Using-ExplorerPatcher-as-shell-extension
Source: ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/valinet/ExplorerPatcher/wiki/Weather
Source: ep_setup.exe, 00000001.00000003.11830373643.000001322B9B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.skype.com/meetnowjoin.winshell&exp=?exp=https://go.skype.com/meetnow.winshellskype:?actio
Source: ep_setup.exe, 00000001.00000003.11827026660.000001322BA74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.skype.com/meetnowlearn.winshell
Source: WidgetBoard.exe, 00000014.00000002.13647627723.00000236E4E5D000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13647289234.00000236E4E47000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13647993600.00000236E4E88000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13650603961.00000236E6B02000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13649499798.00000236E4EE1000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13649266539.00000236E4ED0000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13648200876.00000236E4E9B000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13650938977.00000236E6B13000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13648434910.00000236E4EAC000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13648691521.00000236E4EBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: explorer.exe, 0000000E.00000003.12160188405.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12062804617.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12104924851.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12152136805.0000000007A55000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12139286268.0000000007A52000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13647627723.00000236E4E5D000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13647289234.00000236E4E47000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13647993600.00000236E4E88000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13650603961.00000236E6B02000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13649499798.00000236E4EE1000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13649266539.00000236E4ED0000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13648200876.00000236E4E9B000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13650938977.00000236E6B13000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13648434910.00000236E4EAC000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13648691521.00000236E4EBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/
Source: explorer.exe, 0000000E.00000003.12143590504.0000000007910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.local/
Source: explorer.exe, 0000000E.00000003.12143590504.0000000007910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.windows.localc
Source: explorer.exe, 0000000E.00000003.12025005518.000000000A757000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12017307599.000000000A757000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12011879661.000000000A757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://objects.githubusercontent.com/github-production-release-asset-2e65be/394318710/5e5bb508-cbdc
Source: ep_setup.exe, 00000001.00000003.11833924594.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, explorer.exe, 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://raw.githubusercontent.com/valinet/ep_make/master/ep_make_safe.ps1
Source: WidgetBoard.exe, 00000014.00000002.13647627723.00000236E4E5D000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13647289234.00000236E4E47000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13647993600.00000236E4E88000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13650603961.00000236E6B02000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13649499798.00000236E4EE1000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13649266539.00000236E4ED0000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13648200876.00000236E4E9B000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13650938977.00000236E6B13000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13648434910.00000236E4EAC000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13648691521.00000236E4EBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949438-4e0c0e0d-67bc-4c76-b75e-e0ffcead3f48.png
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949442-63f14d44-ec0e-40b2-aa1b-8e4a27ec10f5.png
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949443-062a0fa9-88c1-4e07-b6b1-8e52ff64f4f3.png
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949444-d3aea936-4c22-4f17-a201-02155396684d.png
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949445-60d12efa-a21d-40e0-b9a8-1b7a84e58944.png
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949447-a6658710-567e-4977-9316-a80007df3076.png
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949448-cd1b69af-4028-4153-8e40-288526577b58.png
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949449-9320c6f5-15ef-4c17-9e72-740708f4828c.png
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949450-7e03a3f5-580e-4414-aaeb-3a0898afd1da.png
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949451-269d02a3-08cb-4237-9789-f1e60fdc723d.png
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949452-f347fe27-5005-48f2-9c9a-899bb7b8825e.png
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949454-81d5d47d-1f33-4859-a112-5a64ceb549a1.png
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949456-04a4bdbd-ff3b-4484-bb30-8909baff8aa8.png
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949458-dc66775d-8bb9-4d04-838e-7f550d305c26.png
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949459-dfe70eba-6c2c-4b1c-b51b-27c13ce7c08c.png
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949460-7c132d89-efb7-457f-8810-9bf235f5737f.png
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949461-1f058cf3-6fdd-4aeb-80b7-68fa27b02845.png
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949462-f50c21dd-85dd-4d9c-a4eb-516e6cddfb1f.png
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949463-a427edfb-3d7f-4167-bd6f-f5019c482ea1.png
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156949465-54dd31c6-7e3a-464a-8e64-8b54b6fb7a65.png
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://user-images.githubusercontent.com/6503598/156950233-ccaadb4a-2e9a-4934-b41c-acd36a7f0d9c.png
Source: explorer.exe, 0000000E.00000003.12143590504.00000000079FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vsblobprodscussu5shard86.blob.core.windows.net/
Source: explorer.exe, 0000000E.00000003.12139286268.0000000007A52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vsblobprodscussu5shard86.blob.core.windows.net/b-4712e0edc5a240eabf23330d7df68e77/212EE6F6E5
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp, ep_setup.exe, 00000001.00000003.11823886137.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?hl=%s&q=weather%s%s%s%s%s%s%s%spCoreWebView2ExecuteScriptCompletedHand
Source: ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valinet.ro
Source: ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valinet.ro)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443

Source: C:\Windows\explorer.exe

Code function: 12_2_00007FFD65671640 GetModuleFileNameW,PathStripPathW,GetCurrentProcessId,OpenProcess,QueryFullProcessImageNameW,CloseHandle,GetSystemDirectoryW,GetWindowsDirectoryW,GetWindowsDirectoryW,GetWindowsDirectoryW,GetSystemDirectoryW,LoadLibraryExW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetSystemMetrics,RegGetValueW,RegGetValueW,FindWindowExW,FindWindowExW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,RegSetKeyValueW,SHCreateThread,RegSetKeyValueW,SHCreateThread,LoadLibraryW,RegOpenKeyW,RegCloseKey,LoadLibraryW,LoadLibraryW,GetModuleHandleExW,

12_2_00007FFD65671640

Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Windows\dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib_orig.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\JumpViewUI_.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\dxgi.dll	Jump to behavior

Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65671640	12_2_00007FFD65671640
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6565E500	12_2_00007FFD6565E500
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65668690	12_2_00007FFD65668690
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6567A120	12_2_00007FFD6567A120
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656853F0	12_2_00007FFD656853F0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6568FC70	12_2_00007FFD6568FC70
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6568F040	12_2_00007FFD6568F040
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6566D980	12_2_00007FFD6566D980
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65666BA0	12_2_00007FFD65666BA0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65685AC0	12_2_00007FFD65685AC0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6566C590	12_2_00007FFD6566C590
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6568E620	12_2_00007FFD6568E620
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656A0604	12_2_00007FFD656A0604
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6566F5E0	12_2_00007FFD6566F5E0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65690540	12_2_00007FFD65690540
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65696530	12_2_00007FFD65696530
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6565A4E0	12_2_00007FFD6565A4E0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656847D0	12_2_00007FFD656847D0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65690840	12_2_00007FFD65690840
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65688820	12_2_00007FFD65688820
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656A0808	12_2_00007FFD656A0808
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656B57F0	12_2_00007FFD656B57F0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656A46C0	12_2_00007FFD656A46C0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656A26F8	12_2_00007FFD656A26F8
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656751C0	12_2_00007FFD656751C0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656A01C4	12_2_00007FFD656A01C4
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656601B0	12_2_00007FFD656601B0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65688190	12_2_00007FFD65688190
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6565E230	12_2_00007FFD6565E230
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6569F230	12_2_00007FFD6569F230
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6565C200	12_2_00007FFD6565C200
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656520D0	12_2_00007FFD656520D0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65685070	12_2_00007FFD65685070
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6568E070	12_2_00007FFD6568E070
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6565B150	12_2_00007FFD6565B150
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6569F124	12_2_00007FFD6569F124
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6565E100	12_2_00007FFD6565E100
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656A03D0	12_2_00007FFD656A03D0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656AF394	12_2_00007FFD656AF394
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65666380	12_2_00007FFD65666380
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65655380	12_2_00007FFD65655380
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65670370	12_2_00007FFD65670370
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656A2374	12_2_00007FFD656A2374
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6569F448	12_2_00007FFD6569F448
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65684420	12_2_00007FFD65684420
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656A42BC	12_2_00007FFD656A42BC
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65664270	12_2_00007FFD65664270
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65663350	12_2_00007FFD65663350
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6569F33C	12_2_00007FFD6569F33C
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6568E310	12_2_00007FFD6568E310
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656AB308	12_2_00007FFD656AB308
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656522F0	12_2_00007FFD656522F0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65687D80	12_2_00007FFD65687D80
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6566FE40	12_2_00007FFD6566FE40
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656A0E4C	12_2_00007FFD656A0E4C
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6569EE04	12_2_00007FFD6569EE04
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65686DE0	12_2_00007FFD65686DE0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6566CCB0	12_2_00007FFD6566CCB0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656B5C8C	12_2_00007FFD656B5C8C
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656AAC6C	12_2_00007FFD656AAC6C
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6568DD30	12_2_00007FFD6568DD30
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656AED14	12_2_00007FFD656AED14
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6568BD00	12_2_00007FFD6568BD00
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6569ECF8	12_2_00007FFD6569ECF8
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65684CE0	12_2_00007FFD65684CE0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656A1FDC	12_2_00007FFD656A1FDC
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65662FD0	12_2_00007FFD65662FD0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6569FFC0	12_2_00007FFD6569FFC0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6565BFA0	12_2_00007FFD6565BFA0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6565EF90	12_2_00007FFD6565EF90
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6566CF80	12_2_00007FFD6566CF80
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65652F60	12_2_00007FFD65652F60
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656A1058	12_2_00007FFD656A1058
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6569F01C	12_2_00007FFD6569F01C
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656A4FE8	12_2_00007FFD656A4FE8
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656A3E84	12_2_00007FFD656A3E84
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65656F20	12_2_00007FFD65656F20
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6569EF10	12_2_00007FFD6569EF10
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65653EF0	12_2_00007FFD65653EF0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656A0A14	12_2_00007FFD656A0A14
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65663880	12_2_00007FFD65663880
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656AE880	12_2_00007FFD656AE880
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656B3948	12_2_00007FFD656B3948
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65666930	12_2_00007FFD65666930
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65664900	12_2_00007FFD65664900
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656ACBAC	12_2_00007FFD656ACBAC
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656A4B84	12_2_00007FFD656A4B84
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656A0C48	12_2_00007FFD656A0C48
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65662C20	12_2_00007FFD65662C20
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6565FBE0	12_2_00007FFD6565FBE0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6569EBEC	12_2_00007FFD6569EBEC
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6565CAC0	12_2_00007FFD6565CAC0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65659AA0	12_2_00007FFD65659AA0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656B9A98	12_2_00007FFD656B9A98
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65665B50	12_2_00007FFD65665B50
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65657B50	12_2_00007FFD65657B50
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65651B20	12_2_00007FFD65651B20
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65670AE0	12_2_00007FFD65670AE0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6569EAE0	12_2_00007FFD6569EAE0

Source: C:\Windows\explorer.exe	Code function: String function: 00007FFD656511B0 appears 172 times
Source: C:\Windows\explorer.exe	Code function: String function: 00007FFD656A7C0C appears 61 times
Source: C:\Windows\explorer.exe	Code function: String function: 00007FFD6565D290 appears 81 times
Source: C:\Windows\explorer.exe	Code function: String function: 00007FFD656740C0 appears 70 times
Source: C:\Windows\explorer.exe	Code function: String function: 00007FFD656A7DF4 appears 42 times

Source: ep_setup.exe	Static PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: ep_setup.exe.1.dr	Static PE information: Resource name: RT_RCDATA type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: ep_gui.dll.1.dr	Static PE information: Resource name: RT_STRING type: COM executable for DOS

Source: ep_setup.exe	Binary or memory string: OriginalFilename vs ep_setup.exe
Source: ep_setup.exe, 00000001.00000003.11824384028.0000013228E62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebView2Loader.dll~/ vs ep_setup.exe
Source: ep_setup.exe, 00000001.00000003.11833924594.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExplorerPatcher.dll@ vs ep_setup.exe
Source: ep_setup.exe, 00000001.00000003.11822258609.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExplorerPatcher.dll@ vs ep_setup.exe
Source: ep_setup.exe, 00000001.00000003.11823535101.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameep_dwm.exe@ vs ep_setup.exe
Source: ep_setup.exe, 00000001.00000003.11833035066.000001322B9B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStartUI.dllj% vs ep_setup.exe
Source: ep_setup.exe, 00000001.00000003.11822864276.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExplorerPatcher.dll@ vs ep_setup.exe
Source: ep_setup.exe, 00000001.00000003.11830373643.000001322B9B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameJumpviewUI.dllj% vs ep_setup.exe
Source: ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameep_gui.dll@ vs ep_setup.exe
Source: ep_setup.exe, 00000001.00000003.11823575705.0000013228E56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameep_dwm.exe@ vs ep_setup.exe
Source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameep_weather_host.exe@ vs ep_setup.exe
Source: ep_setup.exe, 00000001.00000003.11823886137.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameep_weather_host.exe@ vs ep_setup.exe
Source: ep_setup.exe, 00000001.00000003.11829795440.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExplorerPatcher.dll@ vs ep_setup.exe
Source: ep_setup.exe, 00000001.00000003.11830518926.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameJumpviewUI.dllj% vs ep_setup.exe
Source: ep_setup.exe, 00000001.00000003.11824345024.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebView2Loader.dll~/ vs ep_setup.exe
Source: ep_setup.exe, 00000001.00000003.11822325754.0000013228E5F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExplorerPatcher.dll@ vs ep_setup.exe
Source: ep_setup.exe, 00000001.00000003.11829837528.0000013228E62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExplorerPatcher.dll@ vs ep_setup.exe

Source: classification engine

Classification label: mal60.evad.winEXE@18/35@4/2

Source: C:\Windows\explorer.exe

Code function: 12_2_00007FFD656935A0 VirtualProtect,GetLastError,FormatMessageA,GetLastError,

12_2_00007FFD656935A0

Source: C:\Windows\explorer.exe

Code function: 12_2_00007FFD6565DCF0 GetWindowsDirectoryW,CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,QueryFullProcessImageNameW,TerminateProcess,CloseHandle,Process32NextW,CloseHandle,

12_2_00007FFD6565DCF0

Source: C:\Windows\explorer.exe

Code function: 12_2_00007FFD6566A6C0 CoCreateInstance,CoCreateInstance,

12_2_00007FFD6566A6C0

Source: C:\Windows\explorer.exe

Code function: 12_2_00007FFD6568E620 SHGetFolderPathW,LoadLibraryExW,FindResourceW,SizeofResource,LoadResource,LockResource,LocalAlloc,FreeResource,VerQueryValueW,LocalFree,LoadStringW,LoadStringW,LoadStringW,GetModuleFileNameW,CreateFileW,CreateFileMappingW,CloseHandle,MapViewOfFile,_invalid_parameter_noinfo,UnmapViewOfFile,CloseHandle,CloseHandle,LoadStringW,LoadStringW,LoadStringW,LoadStringW,LoadStringW,LoadStringW,FreeLibrary,LoadStringW,LoadStringW,LoadStringW,FreeLibrary,

12_2_00007FFD6568E620

Source: C:\Users\user\Desktop\ep_setup.exe

File created: C:\Program Files\ExplorerPatcher

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\ExplorerPatcher

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8424:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8680:120:WilError_03

Source: C:\Users\user\Desktop\ep_setup.exe	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\Desktop\ep_setup.exe	Process created: C:\Windows\explorer.exe	Jump to behavior

Source: ep_setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "explorer.exe")

Source: C:\Users\user\Desktop\ep_setup.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ep_setup.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: explorer.exe

String found in binary or memory: Could not modify already-installed funchook handle.

Source: unknown	Process created: C:\Users\user\Desktop\ep_setup.exe "C:\Users\user\Desktop\ep_setup.exe"
Source: C:\Users\user\Desktop\ep_setup.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /f /im explorer.exe
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ep_setup.exe	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ep_setup.exe	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ep_setup.exe	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"
Source: C:\Users\user\Desktop\ep_setup.exe	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"
Source: C:\Users\user\Desktop\ep_setup.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"
Source: unknown	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" /NoUACCheck
Source: unknown	Process created: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe "C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe" -RegisterProcessAsComServer -ServerName:Microsoft.Windows.WidgetBoardServer
Source: C:\Users\user\Desktop\ep_setup.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /f /im explorer.exe	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: cfgmgr32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: virtdisk.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: servicingcommon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\sc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\sc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: webview2loader.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.fileexplorer.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winuicohabitation.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinui.pcshell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wincorlib.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.hardwareconfirmator.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: profext.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: stobject.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pnidui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: inputswitch.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windowsudk.shellcommon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: peopleband.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wpnapps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.fileexplorer.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winuicohabitation.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinui.pcshell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wincorlib.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.hardwareconfirmator.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: profext.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: stobject.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pnidui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: inputswitch.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windowsudk.shellcommon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: peopleband.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wpnapps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cfgmgr32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.applicationmodel.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: languageoverlayutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: usermgrproxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: appextension.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sndvolsso.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: tiledatarepository.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: staterepository.core.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepository.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.immersiveshell.serviceprovider.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: deviceassociation.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinui.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cldapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: applicationframe.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.shellcommon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: activationclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: photometadatahandler.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.web.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.system.launcher.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: container.policy.manager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: holographicextensions.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: abovelockapphost.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pfclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.core.textinput.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.shell.bluelightreduction.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.signals.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: directxdatabasehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mfplat.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rtworkq.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.gaming.input.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.ui.shell.windowtabmanager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: notificationcontrollerps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pcshellcommonproxystub.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: settingshandlers_desktoptaskbar.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: systemsettings.datamodel.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.accessibility.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: switcherdatamodel.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: structuredquery.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.search.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptngc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dmenrollengine.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cflapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.security.authentication.web.core.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: daxexec.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: container.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: shellcommoncommonproxystub.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winbio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cloudexperiencehostredirection.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp140_app.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1_app.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_app.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_app.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1_app.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_app.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.management.inprocobjects.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: capabilityaccessmanagerclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: batmeter.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wmiclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: prnfldr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wpnclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.media.devices.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: syncreg.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: actioncenter.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dusmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wpdshserviceobj.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: portabledevicetypes.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: portabledeviceapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cscobj.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srchadmin.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: synccenter.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: imapi2.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: networkuxbroker.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ethernetmediamanager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ncsi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: microsoft.internal.frameworkudk.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: microsoft.ui.windowing.core.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: microsoft.internal.frameworkudk.system.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mrm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bluetoothapis.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: marshal.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmcorei.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: microsoft.ui.composition.ossupport.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: d3dcompiler_47.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: marshal.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: microsoft.inputstatemanager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: microsoft.ui.input.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: themecpl.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: microsoft.directmanipulation.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.energy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: microsoft.ui.xaml.internal.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: threadpoolwinrt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wscinterop.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wscapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: werconcpl.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: diagnosticdatasettings.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: hcproviders.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: vcruntime140_1_app.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: vcruntime140_app.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: vcruntime140_app.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: widgetboardview.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: msvcp140_app.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: d2d1.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: dwmapi.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: windows.staterepositoryclient.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: userenv.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: xmllite.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: wintypes.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: powrprof.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: powrprof.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: rometadata.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: umpdc.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: execmodelclient.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: execmodelproxy.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: windowsudk.shellcommon.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: capauthz.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: shellcommoncommonproxystub.dll
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Section loaded: coremessaging.dll

Source: C:\Users\user\Desktop\ep_setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Properties (ExplorerPatcher).lnk.1.dr

LNK file: ..\..\..\..\..\..\Windows\System32\rundll32.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_setup.exe	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_gui.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_dwm.exe	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_weather_host.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\WebView2Loader.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\ep_taskbar.2.dll	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\Windows.UI.ShellCommon.pri	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\pris	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\pris\Windows.UI.ShellCommon.en-US.pri	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\StartUI	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\StartUI\Assets	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\StartUI\Assets\officehub150x150.png	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\StartUI\Assets\officehub71x71.png	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\StartUI\Assets\onenote150x150.png	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\StartUI\Assets\onenote71x71.png	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\StartUI\Assets\Fonts	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\StartUI\Assets\Fonts\BitMDL2.ttf	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Directory created: C:\Program Files\ExplorerPatcher\StartUI\Assets\Fonts\SkypeUISymbol-Regular.ttf	Jump to behavior

Source: C:\Users\user\Desktop\ep_setup.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcher

Jump to behavior

Source: ep_setup.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: ep_setup.exe

Static file information: File size 11143168 > 1048576

Source: ep_setup.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0xa68600

Source: ep_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ep_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ep_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ep_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ep_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ep_setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ep_setup.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: ep_setup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\ep_taskbar\ep_taskbar\build\Release\x64\ep_taskbar.2.pdb9 source: ep_setup.exe, 00000001.00000003.11825212657.000001322B9BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\WebView2Loader.dll.pdb source: ep_setup.exe, 00000001.00000003.11824345024.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: explorer.pdbUGP source: explorer.exe, 0000000C.00000003.11854671315.0000000003787000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11866284977.0000000002DF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11940859745.000000000ACC6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_weather_host_stub.pdb source: ep_setup.exe, 00000001.00000003.11824140764.0000013228E54000.00000004.00000020.00020000.00000000.sdmp, ep_setup.exe, 00000001.00000003.11824101655.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: StartDocked.pdb source: explorer.exe, 0000000C.00000003.11857940561.0000000003780000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11870699948.0000000002DF2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\ExplorerPatcher\explorer.pdbb8 source: explorer.exe, 0000000E.00000003.12160188405.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12152136805.0000000007A55000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12139286268.0000000007A52000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: StartUI.pdb source: ep_setup.exe, 00000001.00000003.11833035066.000001322B9B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.11858821436.0000000003785000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11871628442.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp, StartUI_.dll.1.dr
Source:	Binary string: GET /download/symbols/explorer.pdb/598A53662BD73B032010E6534F37452E1/explorer.pdb HTTP/1.1 source: explorer.exe, 0000000E.00000003.12062804617.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12104924851.0000000007A59000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Global\C::Users:user:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs.pdb] source: explorer.exe, 0000000E.00000003.12143590504.00000000079FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: explorer.pdb source: explorer.exe, 0000000C.00000003.11854671315.0000000003787000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11866284977.0000000002DF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11940859745.000000000ACC6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: JumpViewUI.pdb source: ep_setup.exe, 00000001.00000003.11830373643.000001322B9B3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /download/symbols/explorer.pdb/598A53662BD73B032010E6534F37452E1/explorer.pdb source: explorer.exe, 0000000E.00000003.12160188405.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12062804617.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12104924851.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12152136805.0000000007A55000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12139286268.0000000007A52000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_gui.pdb source: ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\ExplorerPatcher\explorer.pdb source: explorer.exe, 0000000E.00000003.12160188405.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12152136805.0000000007A55000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12139286268.0000000007A52000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: er.pdb source: explorer.exe, 0000000E.00000003.12160188405.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12062804617.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12104924851.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12152136805.0000000007A55000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12139286268.0000000007A52000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 6534F37452E1r.pdbv source: explorer.exe, 0000000E.00000003.12143590504.0000000007910000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: twinui.pcshell.pdbUGP source: explorer.exe, 0000000C.00000003.11860676089.0000000003800000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.11856615647.000000000378C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11868609315.0000000002DF4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11873625449.0000000002E7C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: twinui.pcshell.pdb source: explorer.exe, 0000000C.00000003.11860676089.0000000003800000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.11856615647.000000000378C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11868609315.0000000002DF4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11873625449.0000000002E7C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\ExplorerPatcher\explorer.pdbR9 source: explorer.exe, 0000000E.00000003.12160188405.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12152136805.0000000007A55000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12139286268.0000000007A52000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ExplorerPatcher.amd64.pdb source: ep_setup.exe, 00000001.00000003.11833924594.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: StartUI.pdb@ source: ep_setup.exe, 00000001.00000003.11833035066.000001322B9B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.11858821436.0000000003785000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11871628442.0000000002DFC000.00000004.00000020.00020000.00000000.sdmp, StartUI_.dll.1.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\WebView2Loader.dll.pdbOGP source: ep_setup.exe, 00000001.00000003.11824345024.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_dwm.pdb source: ep_setup.exe, 00000001.00000003.11823535101.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp, ep_setup.exe, 00000001.00000003.11823575705.0000013228E56000.00000004.00000020.00020000.00000000.sdmp, ep_dwm.exe.1.dr
Source:	Binary string: r.pdb source: explorer.exe, 0000000E.00000003.12143590504.0000000007910000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: JumpViewUI.pdb\|\|#zGCTL source: ep_setup.exe, 00000001.00000003.11830373643.000001322B9B3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: xC:\Users\user\AppData\Roaming\ExplorerPatcher\explorer.pdb464,int)4 source: explorer.exe, 0000000E.00000003.12124763664.0000000010437000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12151803189.0000000010437000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\Win32\ExplorerPatcher.IA-32.pdb source: ep_setup.exe, 00000001.00000003.11822258609.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp, ep_setup.exe, 00000001.00000003.11822325754.0000013228E5F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_setup.pdb source: ep_setup.exe
Source:	Binary string: http://msdl.microsoft.com/download/symbols/explorer.pdb/598A53662BD73B032010E6534F37452E1/explorer.pdb source: explorer.exe, 0000000E.00000003.12143590504.00000000079FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12143590504.0000000007910000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ep_taskbar\ep_taskbar\build\Release\x64\ep_taskbar.2.pdb source: ep_setup.exe, 00000001.00000003.11825212657.000001322B9BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Hostmsdl.microsoft.comGET /download/symbols/explorer.pdb/598A53662BD73B032010E6534F37452E1/explorer.pdb HTTP/1.1 source: explorer.exe, 0000000E.00000003.12062804617.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12104924851.0000000007A59000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_weather_host.pdb source: ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp, ep_setup.exe, 00000001.00000003.11823886137.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\ExplorerPatcher\ExplorerPatcher\build\Release\x64\ep_startmenu.pdb source: ep_setup.exe, 00000001.00000003.11829795440.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp

Source: ep_setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ep_setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ep_setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ep_setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ep_setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: JumpViewUI_.dll.1.dr

Static PE information: 0xC8146642 [Fri May 15 14:54:58 2076 UTC]

Source: C:\Windows\explorer.exe

Code function: 12_2_00007FFD6566BFE0 LoadLibraryW,GetProcAddress,LoadLibraryW,GetCurrentProcess,K32GetModuleInformation,CreateWindowExW,SetWindowLongPtrW,LoadLibraryW,GetProcAddress,LoadLibraryExW,GetCurrentProcess,K32GetModuleInformation,CreateWindowExW,SetWindowLongPtrW,GetCurrentProcess,K32GetModuleInformation,LoadLibraryExW,CreateWindowExW,SetWindowLongPtrW,RegGetValueW,GetModuleHandleW,GetProcAddress,LoadLibraryW,

12_2_00007FFD6566BFE0

Source: ep_weather_host_stub.dll.1.dr	Static PE information: section name: .orpc
Source: WebView2Loader.dll.1.dr	Static PE information: section name: .gxfg
Source: WebView2Loader.dll.1.dr	Static PE information: section name: .retplne
Source: WebView2Loader.dll.1.dr	Static PE information: section name: _RDATA
Source: JumpViewUI_.dll.1.dr	Static PE information: section name: .didat
Source: StartUI_.dll.1.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\ep_setup.exe

Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"

Persistence and Installation Behavior

Possible COM Object hijacking

Source: c:\program files\explorerpatcher\ep_weather_host.dll	COM Object registered for dropped file: hkey_local_machine\software\classes\clsid\{a6ea9c2d-4982-4827-9204-0ac532959f6d}\inprocserver32
Source: c:\program files\explorerpatcher\ep_weather_host_stub.dll	COM Object registered for dropped file: hkey_local_machine\software\classes\clsid\{cdbf3734-f847-4f1b-b953-a605434dc1e7}\inprocserver32

Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Windows\dxgi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\dxgi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Program Files\ExplorerPatcher\ep_setup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Program Files\ExplorerPatcher\ep_gui.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\JumpViewUI_.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Program Files\ExplorerPatcher\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Program Files\ExplorerPatcher\ep_taskbar.2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Program Files\ExplorerPatcher\ep_weather_host.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Program Files\ExplorerPatcher\ep_dwm.exe	Jump to dropped file

Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Windows\dxgi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\dxgi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\JumpViewUI_.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib.dll	Jump to dropped file

Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ExplorerPatcher			Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ExplorerPatcher\Properties (ExplorerPatcher).lnk			Jump to behavior

Source: C:\Users\user\Desktop\ep_setup.exe

Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB

Source: C:\Windows\explorer.exe

12_2_00007FFD65671640

Source: C:\Users\user\Desktop\ep_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\explorer.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Windows\explorer.exe

Code function: GetForegroundWindow,GetClassNameW,Sleep,GetForegroundWindow,GetClassNameW,GetForegroundWindow,GetClassNameW,Sleep,GetForegroundWindow,GetClassNameW,RegDeleteTreeW,Sleep,

12_2_00007FFD6565DEA0

Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 483			Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 470			Jump to behavior

Source: C:\Users\user\Desktop\ep_setup.exe	Dropped PE file which has not been started: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	Dropped PE file which has not been started: C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	Dropped PE file which has not been started: C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	Dropped PE file which has not been started: C:\Program Files\ExplorerPatcher\ep_gui.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	Dropped PE file which has not been started: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\JumpViewUI_.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	Dropped PE file which has not been started: C:\Program Files\ExplorerPatcher\ep_taskbar.2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	Dropped PE file which has not been started: C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	Dropped PE file which has not been started: C:\Program Files\ExplorerPatcher\ep_weather_host.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ep_setup.exe	Dropped PE file which has not been started: C:\Program Files\ExplorerPatcher\ep_dwm.exe	Jump to dropped file

Source: C:\Windows\explorer.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Windows\explorer.exe TID: 3636	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\explorer.exe TID: 3636	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\explorer.exe

Code function: 12_2_00007FFD65657B50 GetSystemTimeAsFileTime followed by cmp: cmp r15, 02h and CTI: jne 00007FFD65658362h

12_2_00007FFD65657B50

Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6566D980 InitializeCriticalSection,CreateEventW,CreateEventW,CreateEventW,SetEvent,SetEvent,SetEvent,CreateThread,CloseHandle,SHGetFolderPathW,PathFileExistsW,CreateDirectoryW,CreateMutexExW,CreateEventW,CreateEventW,CreateThread,CreateThread,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetModuleHandleW,GetCurrentProcess,K32GetModuleInformation,GetModuleHandleW,GetProcAddress,IsOS,GetCurrentProcess,K32GetModuleInformation,LoadLibraryExW,LoadLibraryW,GetProcAddress,CreateWindowExW,FreeLibraryAndExitThread,SetWindowLongPtrW,FreeLibraryAndExitThread,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,LoadLibraryExW,LoadLibraryExW,LoadLibraryExW,LoadLibraryExW,GetModuleHandleW,GetProcAddress,SHELL32_Create_IEnumUICommand,VirtualProtect,VirtualProtect,GetProcAddress,VirtualProtect,VirtualProtect,LoadLibraryW,GetProcAddress,LoadLibraryExW,GetModuleHandleExW,GetCurrentProcess,K32GetModuleInformation,VirtualProtect,VirtualProtect,GetCurrentProcess,K32GetModuleInformation,LoadLibraryExW,LoadLibraryExW,GetProcAddress,LoadLibraryExW,IsOS,FreeLibraryAndExitThread,CreateThread,CreateThread,CreateThread,CreateWindowInBand,CreateThread,CreateThread,GetWindowsDirectoryW,FindFirstFileW,FindClose,LoadLibraryW,GetProcAddress,GetLastError,	12_2_00007FFD6566D980
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6565D920 GetWindowsDirectoryW,FindFirstFileW,FindClose,GetWindowsDirectoryW,FindFirstFileW,	12_2_00007FFD6565D920
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65685AC0 RegCreateKeyExW,GetWindowsDirectoryW,RegQueryValueExA,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegDeleteTreeW,RegCreateKeyExW,GetSystemDirectoryW,RegQueryValueExA,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegCloseKey,RegDeleteTreeW,RegCreateKeyExW,GetWindowsDirectoryW,RegQueryValueExA,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegDeleteTreeW,RegCreateKeyExW,GetWindowsDirectoryW,FindFirstFileW,FindClose,GetWindowsDirectoryW,RegQueryValueExA,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegDeleteTreeW,RegCreateKeyExW,RegDeleteValueW,RegCloseKey,	12_2_00007FFD65685AC0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65685070 RegCreateKeyExW,GetWindowsDirectoryW,FindFirstFileW,FindClose,GetWindowsDirectoryW,FindFirstFileW,FindClose,GetWindowsDirectoryA,RegCloseKey,RegSetValueExW,RegSetValueExA,RegSetValueExW,RegCloseKey,	12_2_00007FFD65685070
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6565CE30 CreateFileA,CreateFileMappingW,CloseHandle,MapViewOfFile,CloseHandle,CloseHandle,UnmapViewOfFile,CloseHandle,CloseHandle,UnmapViewOfFile,CloseHandle,CloseHandle,UnmapViewOfFile,CloseHandle,CloseHandle,PathRemoveFileSpecA,UnmapViewOfFile,CloseHandle,CloseHandle,FindFirstFileA,FindClose,DeleteFileA,UnmapViewOfFile,CloseHandle,CloseHandle,	12_2_00007FFD6565CE30
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656B3948 FindFirstFileExW,	12_2_00007FFD656B3948
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6565DAC0 SHGetFolderPathW,FindFirstFileW,FindClose,	12_2_00007FFD6565DAC0

Source: C:\Windows\explorer.exe

Code function: 12_2_00007FFD65692D90 GetSystemInfo,VirtualAlloc,

12_2_00007FFD65692D90

Source: explorer.exe, 0000000E.00000003.12139286268.0000000007A52000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 0000000E.00000003.12143590504.0000000007864000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00ge
Source: explorer.exe, 0000000E.00000003.12160188405.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12062804617.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12104924851.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12152136805.0000000007A55000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12139286268.0000000007A52000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWf
Source: explorer.exe, 0000000E.00000003.12143590504.0000000007864000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00.Explorerll
Source: explorer.exe, 0000000E.00000003.11983899185.000000000A7EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 0000000E.00000003.12003123513.000000000A7E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 63}#00000013CCA00000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{887c27cf-b658-19ef-a77e-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{887c27cf-b658-19ef-a77e-806e6f6e6963}i!
Source: explorer.exe, 0000000E.00000003.12160188405.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12062804617.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12104924851.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12152136805.0000000007A55000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12139286268.0000000007A52000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW:\x1

Source: C:\Windows\explorer.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\explorer.exe

Code function: 12_2_00007FFD65681100 GetCurrentThreadId,IsDebuggerPresent,OutputDebugStringW,

12_2_00007FFD65681100

Source: C:\Windows\explorer.exe

12_2_00007FFD6566BFE0

Source: C:\Windows\explorer.exe

Code function: 12_2_00007FFD6567A7B0 GetProcessHeap,

12_2_00007FFD6567A7B0

Source: C:\Windows\System32\taskkill.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65690EC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00007FFD65690EC0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65691BB0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00007FFD65691BB0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD656ABA88 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00007FFD656ABA88

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 20.233.83.145 443			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.199.110.133 443			Jump to behavior

Contains functionality to automate explorer (e.g. start an application)

Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6565F4C0 FindWindowW,SendMessageTimeoutW,	12_2_00007FFD6565F4C0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65663DA0 FindWindowExW,FindWindowExW,FindWindowExW,SendMessageW,	12_2_00007FFD65663DA0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65663880 GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,FindWindowExW,FindWindowExW,FindWindowW,FindWindowExW,FindWindowExW,GetCursorPos,GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,MonitorFromPoint,GetMonitorInfoW,FindWindowExW,MonitorFromWindow,GetMonitorInfoW,GetWindowRect,SetCursorPos,SetCursorPos,FindWindowW,PostMessageW,PostMessageW,FindWindowExW,FindWindowW,GetCursorPos,GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,MonitorFromPoint,GetMonitorInfoW,FindWindowExW,MonitorFromWindow,GetMonitorInfoW,GetWindowRect,SetCursorPos,FindWindowExW,PostMessageW,GetWindowLongPtrW,GetWindowLongPtrW,SendMessageCallbackW,PostMessageW,	12_2_00007FFD65663880
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65663880 GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,FindWindowExW,FindWindowExW,FindWindowW,FindWindowExW,FindWindowExW,GetCursorPos,GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,MonitorFromPoint,GetMonitorInfoW,FindWindowExW,MonitorFromWindow,GetMonitorInfoW,GetWindowRect,SetCursorPos,SetCursorPos,FindWindowW,PostMessageW,PostMessageW,FindWindowExW,FindWindowW,GetCursorPos,GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,MonitorFromPoint,GetMonitorInfoW,FindWindowExW,MonitorFromWindow,GetMonitorInfoW,GetWindowRect,SetCursorPos,FindWindowExW,PostMessageW,GetWindowLongPtrW,GetWindowLongPtrW,SendMessageCallbackW,PostMessageW,	12_2_00007FFD65663880
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65663880 GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,FindWindowExW,FindWindowExW,FindWindowW,FindWindowExW,FindWindowExW,GetCursorPos,GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,MonitorFromPoint,GetMonitorInfoW,FindWindowExW,MonitorFromWindow,GetMonitorInfoW,GetWindowRect,SetCursorPos,SetCursorPos,FindWindowW,PostMessageW,PostMessageW,FindWindowExW,FindWindowW,GetCursorPos,GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,MonitorFromPoint,GetMonitorInfoW,FindWindowExW,MonitorFromWindow,GetMonitorInfoW,GetWindowRect,SetCursorPos,FindWindowExW,PostMessageW,GetWindowLongPtrW,GetWindowLongPtrW,SendMessageCallbackW,PostMessageW,	12_2_00007FFD65663880
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65663880 GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,FindWindowExW,FindWindowExW,FindWindowW,FindWindowExW,FindWindowExW,GetCursorPos,GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,MonitorFromPoint,GetMonitorInfoW,FindWindowExW,MonitorFromWindow,GetMonitorInfoW,GetWindowRect,SetCursorPos,SetCursorPos,FindWindowW,PostMessageW,PostMessageW,FindWindowExW,FindWindowW,GetCursorPos,GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,MonitorFromPoint,GetMonitorInfoW,FindWindowExW,MonitorFromWindow,GetMonitorInfoW,GetWindowRect,SetCursorPos,FindWindowExW,PostMessageW,GetWindowLongPtrW,GetWindowLongPtrW,SendMessageCallbackW,PostMessageW,	12_2_00007FFD65663880
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65663880 GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,FindWindowExW,FindWindowExW,FindWindowW,FindWindowExW,FindWindowExW,GetCursorPos,GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,MonitorFromPoint,GetMonitorInfoW,FindWindowExW,MonitorFromWindow,GetMonitorInfoW,GetWindowRect,SetCursorPos,SetCursorPos,FindWindowW,PostMessageW,PostMessageW,FindWindowExW,FindWindowW,GetCursorPos,GetCursorPos,MonitorFromPoint,FindWindowExW,MonitorFromWindow,MonitorFromPoint,GetMonitorInfoW,FindWindowExW,MonitorFromWindow,GetMonitorInfoW,GetWindowRect,SetCursorPos,FindWindowExW,PostMessageW,GetWindowLongPtrW,GetWindowLongPtrW,SendMessageCallbackW,PostMessageW,	12_2_00007FFD65663880

Source: C:\Windows\explorer.exe	Code function: GetModuleFileNameW,PathStripPathW,GetCurrentProcessId,OpenProcess,QueryFullProcessImageNameW,CloseHandle,GetSystemDirectoryW,GetWindowsDirectoryW,GetWindowsDirectoryW,GetWindowsDirectoryW,GetSystemDirectoryW,LoadLibraryExW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetSystemMetrics,RegGetValueW,RegGetValueW,FindWindowExW,FindWindowExW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,RegSetKeyValueW,SHCreateThread,RegSetKeyValueW,SHCreateThread,LoadLibraryW,RegOpenKeyW,RegCloseKey,LoadLibraryW,LoadLibraryW,GetModuleHandleExW, \explorer.exe		12_2_00007FFD65671640
Source: C:\Windows\explorer.exe	Code function: Sleep,GetWindowsDirectoryW,CreateProcessW,FreeConsole,GetCurrentProcessId,OpenProcess,TerminateProcess, \explorer.exe		12_2_00007FFD6568FAB0

Source: C:\Windows\explorer.exe

Code function: 12_2_00007FFD65670370 SetProcessDpiAwarenessContext,GetModuleFileNameW,GetCurrentDirectoryW,GetModuleHandleW,ShellExecuteExW,GetLastError,LoadStringW,LoadStringW,MessageBoxW,GetModuleFileNameW,GetLastError,RegCreateKeyExW,RegSetValueExW,RegSetValueExW,RegCloseKey,PathRemoveExtensionW,PathRemoveExtensionW,RegCreateKeyExW,RegSetValueExW,RegSetValueExW,RegCloseKey,RegCreateKeyExW,RegSetValueExW,RegCloseKey,

12_2_00007FFD65670370

Source: C:\Users\user\Desktop\ep_setup.exe	Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /f /im explorer.exe	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Process created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"	Jump to behavior
Source: C:\Users\user\Desktop\ep_setup.exe	Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ep_setup.exe

Process created: C:\Windows\System32\taskkill.exe "C:\Windows\system32\taskkill.exe" /f /im explorer.exe

Jump to behavior

Source: C:\Windows\explorer.exe

Code function: 12_2_00007FFD6565E860 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,GetLengthSid,CopySid,DeriveAppContainerSidFromAppContainerName,SetEntriesInAclW,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,LocalFree,CreateMutexExW,FreeSid,

12_2_00007FFD6565E860

Source: C:\Windows\explorer.exe

Code function: 12_2_00007FFD6565D7C0 AllocateAndInitializeSid,CheckTokenMembership,GetLastError,FreeSid,

12_2_00007FFD6565D7C0

Source: ep_setup.exe, 00000001.00000003.11825212657.000001322B9BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ClockButtonTrayClockWClassintlshell\explorer\ClockButton.cppShell_TrayWndShowSecondsInSystemClockSoftware\Microsoft\Windows\CurrentVersion\Explorer\AdvancedControl Panel\TimeDate\AdditionalClocks\%uEnableDisplayNameTzRegKeyName ()
Source: ep_setup.exe, 00000001.00000003.11833924594.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, explorer.exe, 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: Progman: %d
Source: ep_setup.exe, 00000001.00000003.11833924594.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, explorer.exe, 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: Progman hook: %d
Source: explorer.exe, 0000000C.00000003.11854671315.0000000003787000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11866284977.0000000002DF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11940859745.000000000ACC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ProgmanProxy DesktopLocal\ExplorerIsShellMutex58
Source: explorer.exe	Binary or memory string: Shell_TrayWnd
Source: ep_setup.exe	Binary or memory string: runasExplorerPatcherntdll.dllRtlGetVersion\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersionUBRShell_TrayWnd\explorer.exeopenep_taskbar.0.dllep_taskbar.1.dllep_taskbar.2.dllep_taskbar.3.dllep_taskbar.4.dllep_taskbar.5.dll\ExplorerFrame.dll (ExplorerPatcher).lnk\shell32.dllSOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}_ExplorerPatcherUninstallStringDisplayNameVALINET Solutions SRLPublisherNoModifyNoRepair\ExplorerPatcher.amd64.dll%d.%d.%d.%dDisplayVersionVersionMajorVersionMinorDisplayIcon\ExplorerPatcher\cleanup_.tmp.preven-USmuipriep_taskbar.0.dllep_taskbar.2.dllep_taskbar.3.dllep_taskbar.4.dllep_taskbar.5.dll\*.../extractIsWow64Process2kernel32.dllx64ARM64/uninstall/uninstall_silentep_uninstall.exe/update_silentUndockingDisabledSOFTWARE\Microsoft\Windows\CurrentVersion\Shell\Update\PackagesGlobal\ep_setup_D17F1E1A-5919-4427-8F89-A1A8503CA3EB/f /im explorer.exeGlobal\ep_dwm_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EBExplorerPatcher_GUI_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}Software\ExplorerPatcherOpenPropertiesAtNextStartep_setup.exeSOFTWARE\Classes\CLSID\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}\InProcServer32\ExplorerPatcher\ExplorerPatcher.amd64.dll"\regsvr32.exeExplorerPatcher.IA-32.dllExplorerPatcher.IA-32.dllExplorerPatcher.amd64.dllExplorerPatcher.amd64.dllep_gui.dllep_gui.dllep_dwm.exeep_dwm.exeep_weather_host.dllep_weather_host.dllep_weather_host_stub.dllep_weather_host_stub.dllWebView2Loader.dllWebView2Loader.dllar-SAbg-BGca-EScs-CZda-DKde-DEel-GRen-GBes-ESes-MXet-EEeu-ESfi-FIfr-CAfr-FRgl-EShe-ILhr-HRhu-HUid-IDit-ITja-JPko-KRlt-LTlv-LVnb-NOnl-NLpl-PLpt-BRpt-PTro-ROru-RUsk-SKsl-SIsr-Latn-RSsv-SEth-THtr-TRuk-UAvi-VNzh-CNzh-TWprisStartUIWindows.UI.ShellCommon.pripnidui/Windows.UI.ShellCommon/pnidui.dllpnidui/pnidui.dllSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{C2796011-81BA-4148-8FCA-C6643245113F}AutoStartdxgi.dll\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewywincorlib.dllep_startmenu.dllwincorlib_orig.dll\wincorlib.dll\wincorlib_orig.dllJumpViewUI_.dllJumpViewUI/JumpViewUI.dllStartUI_.dllStartUI/StartUI.dllAppResolverLegacy.dllStartTileDataLegacy.dll\en-USStartTileDataLegacy.dll.mui\pris2Windows.UI.ShellCommon.en-US.pri\SystemApps\ShellExperienceHost_cw5n1h2txyewy\rundll32.exe "\ExplorerPatcher\ep_gui.dll",ZZGUI\ExplorerPatcher\ep_setup.exe" /uninstallstart ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EBdelete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB\ExplorerPatcher\ep_weather_host.dll"\ExplorerPatcher\ep_weather_host_stub.dll"SOFTWARE\Policies\Microsoft\Windows\ExplorerSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\cleanupSOFTWARE\Microsoft\Windows\CurrentVersion\RunOncecmd /c rmdir /s /q ""ExplorerPatcherCleanupIsUpdatePendingrbr+bwb1.3.1.1-motley unzip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll@
Source: explorer.exe	Binary or memory string: Progman
Source: ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: eptmpw+Unknown exceptionbad array new lengthSoftware\ExplorerPatcherLanguageen-USvector too long\Shell_TrayWnd
Source: explorer.exe, 0000000C.00000003.11854671315.0000000003787000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11866284977.0000000002DF9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11940859745.000000000ACC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %s%sLocal\AppReadinessCompletionEventAssignedAccessConfigurationSOFTWARE\Microsoft\Windows\AssignedAccessConfigurationShell_TrayWndVersion%s\%sUserStateSoftware\Microsoft\Windows\CurrentVersion\AppReadinessAppReadinessServicesActiveConfigsGroupConfigsGlobalProfileIdSOFTWARE\Microsoft\Windows Embedded\LockdownPostAppInstallTasksCompletedMicrosoft.Windows.ContentDeliveryManager_cw5n1h2txyewyWaitOnShellStartupntdll.dllRtlIsStateSeparationEnabledEnable Balloon TipStartLayoutReadyEventAppResolverReadyEventLocal\ShellStartupEventShellDesktopSwitchEventReuseImmersiveShellPointerShowOnlyQuickLaunchDeskBandAllLogonTasksTerminateShellApplicationsTestUnlockDataTestQueryDataTestReportelapsedTimeRestartSavedAppstesterrorslogversion
Source: ep_setup.exe, 00000001.00000003.11822258609.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ntdll.dllRtlGetVersion\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersionUBRShell_TrayWnd\explorer.exe\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI.dll\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dllep_taskbar.0.dllep_taskbar.1.dllep_taskbar.2.dllep_taskbar.3.dllep_taskbar.4.dllep_taskbar.5.dll\ExplorerPatcher\ImmersiveContextMenuArray[ROD]: Level %d Position %d/%d Status %d
Source: explorer.exe	Binary or memory string: Progman: %d
Source: explorer.exe	Binary or memory string: Progman hook: %d
Source: explorer.exe, 0000000C.00000003.11860676089.0000000003800000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000003.11856615647.000000000378C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.11868609315.0000000002DF4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndIsAutoHideEnabledUndockedSearchAppExperienceManager_PositionSearchAppWindowLauncherInvokeActivitySetViewPosition~,B;+,,N
Source: ep_setup.exe, 00000001.00000003.11833924594.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: Microsoft-Symbol-Server/10.0.10036.206msdl.microsoft.comabcdefghijklmnopqrstuvwxyzProgmanProxy Desktop\explorer.exeopenInputSwitch.dllxx??x??xxx????xxD8t
Source: ep_setup.exe, 00000001.00000003.11833924594.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: Shlwapi.dllSHRegGetValueFromHKCUHKLMShell_TrayWndntdll.dllRtlGetVersion\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersionUBRMicrosoft.Windows.ShellManagedWindowAsNormalWindowShell_SecondaryTrayWndvalinet.ExplorerPatcher.ShellManagedWindowExplorerFrame.dllDesktopSHELLDLL_DefViewWorkerWComctl32.dllLoadIconWithScaleDownwin32u.dllNtUserBuildHwndListuser32.dllHungWindowFromGhostWindowGhostWindowFromHungWindowSetWindowCompositionAttributeCreateWindowInBandGetWindowBandSetWindowBandIsTopLevelWindowInternalGetWindowTextInternalGetWindowIconuxtheme.dllshcore.dll

Source: C:\Windows\explorer.exe

Code function: 12_2_00007FFD656B98E0 cpuid

12_2_00007FFD656B98E0

Source: C:\Windows\explorer.exe	Code function: CoCreateInstance,IUnknown_QueryService,FindWindowW,GetPropW,GetThreadUILanguage,GetLocaleInfoW,		12_2_00007FFD656893F0
Source: C:\Windows\explorer.exe	Code function: RegCreateKeyExW,RegQueryValueExW,GetLocaleInfoW,GetLocaleInfoW,SetThreadPreferredUILanguages,RegCloseKey,		12_2_00007FFD65674E90

Source: C:\Users\user\Desktop\ep_setup.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\ep_setup.exe

Code function: 1_2_00007FF611E98E6C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_00007FF611E98E6C

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD6566A5A0 SHBindToObject,		12_2_00007FFD6566A5A0
Source: C:\Windows\explorer.exe	Code function: 12_2_00007FFD65690840 SHParseDisplayName,SHBindToParent,CreatePopupMenu,TrackPopupMenuEx,RegQueryValueW,RegGetValueW,GetMenuItemInfoW,RegQueryValueW,RegGetValueW,GetMenuItemInfoW,InsertMenuItemW,InsertMenuItemW,InsertMenuItemW,GetMenuItemInfoW,DestroyMenu,CoTaskMemFree,		12_2_00007FFD65690840

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	11 Input Capture	11 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 Component Object Model Hijacking	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	11 Input Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	2 Windows Service	1 Component Object Model Hijacking	1 Obfuscated Files or Information	Security Account Manager	35 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Service Execution	1 Registry Run Keys / Startup Folder	2 Windows Service	1 Timestomp	NTDS	41 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	122 Process Injection	1 DLL Side-Loading	LSA Secrets	2 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	23 Masquerading	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	122 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Regsvr32	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ep_setup.exe	8%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll	0%	ReversingLabs
C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll	0%	ReversingLabs
C:\Program Files\ExplorerPatcher\WebView2Loader.dll	0%	ReversingLabs
C:\Program Files\ExplorerPatcher\ep_dwm.exe	3%	ReversingLabs
C:\Program Files\ExplorerPatcher\ep_gui.dll	0%	ReversingLabs
C:\Program Files\ExplorerPatcher\ep_setup.exe	8%	ReversingLabs
C:\Program Files\ExplorerPatcher\ep_taskbar.2.dll	0%	ReversingLabs
C:\Program Files\ExplorerPatcher\ep_weather_host.dll	0%	ReversingLabs
C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll	3%	ReversingLabs
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\JumpViewUI_.dll	0%	ReversingLabs
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll	0%	ReversingLabs
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll	0%	ReversingLabs
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib.dll	0%	ReversingLabs
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\dxgi.dll	0%	ReversingLabs
C:\Windows\dxgi.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
github.com	20.233.83.145	true	false	high
ax-0001.ax-msedge.net	150.171.28.10	true	false	high
objects.githubusercontent.com	185.199.110.133	true	false	high
srtb.msn.com	unknown	unknown	false	high
tse1.mm.bing.net	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://user-images.githubusercontent.com/6503598/156949459-dfe70eba-6c2c-4b1c-b51b-27c13ce7c08c.png	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://login.microsoftonline.com/	explorer.exe, 0000000E.00000003.12160188405.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12062804617.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12104924851.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12152136805.0000000007A55000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12139286268.0000000007A52000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13647627723.00000236E4E5D000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13647289234.00000236E4E47000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13647993600.00000236E4E88000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13650603961.00000236E6B02000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13649499798.00000236E4EE1000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13649266539.00000236E4ED0000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13648200876.00000236E4E9B000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13650938977.00000236E6B13000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13648434910.00000236E4EAC000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13648691521.00000236E4EBF000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.valinet.ro)	ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://adaptivecards.io/schemas/adaptive-card.json	WidgetBoard.exe, 00000014.00000002.13651394023.00000236E6B35000.00000004.00000020.00020000.00000000.sdmp	false	high
https://signup.live.com/	WidgetBoard.exe, 00000014.00000002.13647627723.00000236E4E5D000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13647289234.00000236E4E47000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13647993600.00000236E4E88000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13650603961.00000236E6B02000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13649499798.00000236E4EE1000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13649266539.00000236E4ED0000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13648200876.00000236E4E9B000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13650938977.00000236E6B13000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13648434910.00000236E4EAC000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13648691521.00000236E4EBF000.00000004.00000020.00020000.00000000.sdmp	false	high
https://go.skype.com/meetnowlearn.winshell	ep_setup.exe, 00000001.00000003.11827026660.000001322BA74000.00000004.00000020.00020000.00000000.sdmp	false	high
https://user-images.githubusercontent.com/6503598/156949442-63f14d44-ec0e-40b2-aa1b-8e4a27ec10f5.png	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/valinet	ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://user-images.githubusercontent.com/6503598/156949445-60d12efa-a21d-40e0-b9a8-1b7a84e58944.png	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://user-images.githubusercontent.com/6503598/156949452-f347fe27-5005-48f2-9c9a-899bb7b8825e.png	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://user-images.githubusercontent.com/6503598/156949451-269d02a3-08cb-4237-9789-f1e60fdc723d.png	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://user-images.githubusercontent.com/6503598/156949465-54dd31c6-7e3a-464a-8e64-8b54b6fb7a65.png	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://login.windows.local/	explorer.exe, 0000000E.00000003.12143590504.0000000007910000.00000004.00000020.00020000.00000000.sdmp	false	high
https://aka.ms/Vh5j3k	explorer.exe, 0000000E.00000003.12143590504.0000000007864000.00000004.00000020.00020000.00000000.sdmp	false	high
https://objects.githubusercontent.com/github-production-release-asset-2e65be/394318710/5e5bb508-cbdc	explorer.exe, 0000000E.00000003.12025005518.000000000A757000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12017307599.000000000A757000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12011879661.000000000A757000.00000004.00000020.00020000.00000000.sdmp	false	high
https://account.live.com/	WidgetBoard.exe, 00000014.00000002.13647627723.00000236E4E5D000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13647289234.00000236E4E47000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13647993600.00000236E4E88000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13650603961.00000236E6B02000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13649499798.00000236E4EE1000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13649266539.00000236E4ED0000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13648200876.00000236E4E9B000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13650938977.00000236E6B13000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13648434910.00000236E4EAC000.00000004.00000020.00020000.00000000.sdmp, WidgetBoard.exe, 00000014.00000002.13648691521.00000236E4EBF000.00000004.00000020.00020000.00000000.sdmp	false	high
https://aka.ms/odirm	explorer.exe, 0000000E.00000003.12143590504.0000000007864000.00000004.00000020.00020000.00000000.sdmp	false	high
https://user-images.githubusercontent.com/6503598/156949438-4e0c0e0d-67bc-4c76-b75e-e0ffcead3f48.png	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://raw.githubusercontent.com/valinet/ep_make/master/ep_make_safe.ps1	ep_setup.exe, 00000001.00000003.11833924594.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, explorer.exe, 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmp	false	high
https://www.google.com/search?hl=%s&q=weather%s%s%s%s%s%s%s%spCoreWebView2ExecuteScriptCompletedHand	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp, ep_setup.exe, 00000001.00000003.11823886137.0000013228E3A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://user-images.githubusercontent.com/6503598/156949444-d3aea936-4c22-4f17-a201-02155396684d.png	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/	explorer.exe, 0000000E.00000003.12160188405.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12062804617.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12104924851.0000000007A59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12152136805.0000000007A55000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.12139286268.0000000007A52000.00000004.00000020.00020000.00000000.sdmp	false	high
https://user-images.githubusercontent.com/6503598/156949443-062a0fa9-88c1-4e07-b6b1-8e52ff64f4f3.png	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://user-images.githubusercontent.com/6503598/156949461-1f058cf3-6fdd-4aeb-80b7-68fa27b02845.png	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.valinet.ro	ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://user-images.githubusercontent.com/6503598/156949449-9320c6f5-15ef-4c17-9e72-740708f4828c.png	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/valinet)	ep_setup.exe, 00000001.00000003.11823232661.000001322B7B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://user-images.githubusercontent.com/6503598/156949458-dc66775d-8bb9-4d04-838e-7f550d305c26.png	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://login.windows.localc	explorer.exe, 0000000E.00000003.12143590504.0000000007910000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://user-images.githubusercontent.com/6503598/156949462-f50c21dd-85dd-4d9c-a4eb-516e6cddfb1f.png	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://user-images.githubusercontent.com/6503598/156949448-cd1b69af-4028-4153-8e40-288526577b58.png	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.winimage.com/zLibDll	ep_setup.exe	false	high
https://user-images.githubusercontent.com/6503598/156949450-7e03a3f5-580e-4414-aaeb-3a0898afd1da.png	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://user-images.githubusercontent.com/6503598/156949456-04a4bdbd-ff3b-4484-bb30-8909baff8aa8.png	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://user-images.githubusercontent.com/6503598/156949460-7c132d89-efb7-457f-8810-9bf235f5737f.png	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://user-images.githubusercontent.com/6503598/156949447-a6658710-567e-4977-9316-a80007df3076.png	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://user-images.githubusercontent.com/6503598/156949463-a427edfb-3d7f-4167-bd6f-f5019c482ea1.png	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://user-images.githubusercontent.com/6503598/156950233-ccaadb4a-2e9a-4934-b41c-acd36a7f0d9c.png	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://user-images.githubusercontent.com/6503598/156949454-81d5d47d-1f33-4859-a112-5a64ceb549a1.png	ep_setup.exe, 00000001.00000003.11823830987.000001322B6B1000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
20.233.83.145	github.com	United States		8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.199.110.133	objects.githubusercontent.com	Netherlands		54113	FASTLYUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578478
Start date and time:	2024-12-19 19:42:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 11 23H2 with Office Professional Plus 2021, Chrome 131, Firefox 133, Adobe Reader DC 24, Java 8 Update 431, 7zip 24.09
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ep_setup.exe
Detection:	MAL
Classification:	mal60.evad.winEXE@18/35@4/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 72% Number of executed functions: 53 Number of non-executed functions: 186
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SearchHost.exe, SIHClient.exe, appidcertstorecheck.exe, backgroundTaskHost.exe, audiodg.exe, BackgroundTransferHost.exe, ShellExperienceHost.exe, conhost.exe, StartMenuExperienceHost.exe, mobsync.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 204.79.197.203, 204.79.197.219, 20.209.194.1, 20.209.117.33, 20.209.116.33, 20.150.79.68, 20.150.70.36, 20.150.38.228, 20.150.38.4, 20.223.35.26, 104.126.116.104, 104.126.37.171, 20.12.23.50, 40.126.53.19
Excluded domains from analysis (whitelisted): blob.sat09prdstrz08a.trafficmanager.net, slscr.update.microsoft.com, msdl-microsoft-com.a-0016.a-msedge.net, cxcs.microsoft.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, msdl.microsoft.com, vsblobprodscussu5shard73.blob.core.windows.net, a-0016.a-msedge.net, login.live.com, th.bing.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, c.pki.goog, www.bing.com, client.wns.windows.com, fs.microsoft.com, fd.api.iris.microsoft.com, a-0003.a-msedge.net, ctldl.windowsupdate.com, blob.sat12prdstrz10a.store.core.windows.net, www-msn-com.a-0003.a-msedge.net, x1.c.lencr.org, blob.sat12prdstrz10a.trafficmanager.net, vsblobprodscussu5shard86.blob.core.windows.net, mm-mm.bing.net.trafficmanager.net, blob.sat09prdstrz08a.store.core.windows.net, res.public.onecdn.static.microsoft, msdl.microsoft.akadns.net, vsblobprodscussu5shard82.blob.core.windows.net, blob.sat09prdstr04a.store.core.windows.net
Execution Graph export aborted for target ep_setup.exe, PID 8320 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: ep_setup.exe

Simulations

Behavior and APIs

Time	Type	Description
19:43:20	Task Scheduler	Run new task: CreateExplorerShellUnelevatedTask path: C:\Windows\explorer.exe s>/NoUACCheck

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
20.233.83.145	Y5kEUsYDFr.exe	Get hash	malicious	Unknown	Browse	github.com/keygroup777-Ransomware/DOWNLOADER/raw/refs/heads/main/telefron.exe
185.199.110.133	sys_upd.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_menu..ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_phshop..ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_atCAD.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	xK44OOt7vD.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	SecuriteInfo.com.Trojan.GenericKD.74126573.27896.28845.dll	Get hash	malicious	Metasploit	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber_mnr.txt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
github.com	https://pdf.ac/3eQ2md	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.112.3
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	140.82.121.4
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	20.233.83.145
	https://github.com/starise/win11-virtual-desktop-extension/releases/download/1.1.0/VirtualDesktopExtension-1.1.0.msi	Get hash	malicious	Unknown	Browse	20.233.83.145
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	20.233.83.145
	main.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
objects.githubusercontent.com	https://pdf.ac/3eQ2md	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	185.199.108.133
	https://github.com/starise/win11-virtual-desktop-extension/releases/download/1.1.0/VirtualDesktopExtension-1.1.0.msi	Get hash	malicious	Unknown	Browse	185.199.108.133
	in.exe	Get hash	malicious	Babadeda, HTMLPhisher	Browse	185.199.111.133
	https://github.com/greenshot/greenshot/releases/download/Greenshot-RELEASE-1.2.10.6/Greenshot-INSTALLER-1.2.10.6-RELEASE.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	Dfim58cp4J.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	185.199.110.133
	QlyOUFGIFB.exe	Get hash	malicious	MicroClip	Browse	185.199.111.133
	Cooperative Agreement0000800380.docx.exe	Get hash	malicious	Babadeda, Blank Grabber	Browse	185.199.109.133
	https://github.com/kernelwernel/VMAware/releases/download/v1.9/vmaware64.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	SplpM1fFkV.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
ax-0001.ax-msedge.net	https://pdf.ac/3eQ2md	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	150.171.28.10
	IzFEtXcext.dll	Get hash	malicious	Unknown	Browse	150.171.27.10
	slifdgjsidfg19.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	150.171.28.10
	1AqzGcCKey.exe	Get hash	malicious	Quasar	Browse	150.171.27.10
	kqeGVKtpy2.exe	Get hash	malicious	Quasar	Browse	150.171.28.10
	22054200882739718047.js	Get hash	malicious	Strela Downloader	Browse	150.171.27.10
	bPkG0wTVon.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://pdf.ac/4lLzbt	Get hash	malicious	Unknown	Browse	150.171.28.10
	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9Uby5lZW1qaGl1bHoucnUvek83UkZORy8=	Get hash	malicious	Unknown	Browse	150.171.28.10

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	bad.txt	Get hash	malicious	AsyncRAT	Browse	199.232.214.172
	(Lhambright)VWAV.html	Get hash	malicious	Unknown	Browse	151.101.194.137
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.199.109.133
	EFT Remittance_(Dmorris)CQDM.html	Get hash	malicious	Unknown	Browse	151.101.66.137
	Timesheet ACH-Tbconsulting.November 16, 2024.html	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://whtt.termlicari.ru/HnkNbg/	Get hash	malicious	Unknown	Browse	151.101.2.137
	https://go.eu.sparkpostmail1.com/f/a/lgobNkIfvQXGgmbryxpFvQ~~/AAGCxAA~/RgRpPCorP0QoaHR0cHM6Ly9iZXJhemVsLmNvbS93ZWxsbmVzcy9zb3V0aC9pbmRleFcFc3BjZXVCCmdVK6VZZ3GvOmFSFmV0aGFubG9nYW40M0BnbWFpbC5jb21YBAAAAAE~#a3RhdHJvZUBob3VzaW5nY2VudGVyLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	199.232.168.159
	https://gmail.net-login.com/Xb1Rnb3pKRC9CUEdpbldIVTREbHhIK1Vza1NvaWlrblBIbkN4aUdCZUt0Y2NlSGJiWmZ2d0M1dTB5dEpRbnRoVDdBVkFTcEJqWGowNVZycWJNWHlIUHlLOG1qS0FvemVPSXpFRFhGcUhmaVU1ekQwMklrVmM0QjVpNmhLaDdoY1I4UlhMcFo1TTJaSFhtaWpiWWFqWGZ5WEg4TnBiOUl4MDI1RFMyWStQRFoyNFo5UFZNUUpmWXBtaUg0Y0FjUG1jejdSVnFVOXJQL2VzdmNLM1lEaWtmRkZnZEk2Vi0tVHFIeU0vOWxTN01YVEtXbS0tTTh5Skh1eEtsc0xTT0J5Rzg2Q2ZJQT09?cid=2330416057%3EOpen	Get hash	malicious	KnowBe4	Browse	199.232.196.193
	https://pdf.ac/3eQ2md	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	185.199.108.133
MICROSOFT-CORP-MSN-AS-BLOCKUS	(Lhambright)VWAV.html	Get hash	malicious	Unknown	Browse	52.98.61.34
	6CWcISKhf1.msi	Get hash	malicious	AteraAgent	Browse	20.50.88.227
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	20.233.83.145
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	22.164.114.95
	https://whtt.termlicari.ru/HnkNbg/	Get hash	malicious	Unknown	Browse	52.123.128.14
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	20.203.184.73
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	20.47.11.21
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	40.64.15.168
	https://pdf.ac/3eQ2md	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	52.146.76.30

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files\ExplorerPatcher\WebView2Loader.dll	https://github.com/valinet/ExplorerPatcher	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	156672
Entropy (8bit):	6.364786295249098
Encrypted:	false
SSDEEP:	3072:cwWidqj5vQxW0UwC7yqs2Pa+lpshaVXPHefiCaSveMhouw:cwWioKUwC7yqPaKpdmfUAw
MD5:	E5BB14C2B9AF4D5BF6C38E0759F454DD
SHA1:	8CE23BE643A9AC1745EE824FF91621A0B8FCDAF8
SHA-256:	A4FD75AC8F852EDC8BDB88A705EEEE2C93F6EC51EF9FA0739A11A690A067C66D
SHA-512:	D2E0E3176304289F0EFE635D3F751A6389B48AFFF4E2348E478993A29ABA7941624E53F076BC09BBA4BA0470E171CD2582254261584D2369D7CEB9DBD45A56CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$R..`3..`3..`3..+K..j3..+K...3..+K..t3..p...t3..p...q3..p...A3..+K..u3..`3...3..+...f3..+...a3..+.;.a3..`3S.a3..+...a3..Rich`3..........................PE..L.../,&g...........!...).z...........J....................................................@.........................0...x............P...0..........................P...p...............................@...............T............................text....x.......z.................. ..`.rdata..,............~..............@..@.data........0......................@....rsrc....0...P...2..................@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	716288
Entropy (8bit):	6.218933147794801
Encrypted:	false
SSDEEP:	12288:tAZZrKVjXMzFheHhMwJXOI8mw03edresazpaek4Yc9edrtvL9suuuuuuaW5q77gt:6ZBsjXMzFhySwJXOIpOSsgpapXcqrNO7
MD5:	8BFCA71ADD96D3DE75173D464792E2B9
SHA1:	FE6BC3C30C26D6CE1C149B173B5D79C80102D5B9
SHA-256:	5AAA6BAB20B7116B32BDDBA1DF216F7476557BB48397E1968A49EDE14E6C377D
SHA-512:	B560415727D15CEEB09E5D9E39EA2B4043848BF4239FBF5068AAAC86F64B3D05D4E21EB197416DB0FB4172C68F782C05AEAE18AC70C27F80566040B6BA79159A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........%.^.D...D...D...<...D...<..uD.......D.......D...<4..D....Z..D.......D.......D.......D...<...D...<...D...D...F.......D.......D....X..D...D0..D.......D..Rich.D..................PE..d...m,&g.........." ...).....N......l........................................P............`..........................................U......DZ...........0.......I...........@......`\|..p...............................@...............h............................text............................... ..`.rdata..v...........................@..@.data...H...........................@....pdata...I.......J...d..............@..@.rsrc....0.......2..................@..@.reloc.......@......................@..B................................................................................................................................................................................................

C:\Program Files\ExplorerPatcher\StartUI\Assets\Fonts\BitMDL2.ttf

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	TrueType Font data, 15 tables, 1st "OS/2", 37 names, Microsoft, language 0x403, type 2 string, Normaloby
Category:	dropped
Size (bytes):	4860
Entropy (8bit):	4.810458524638355
Encrypted:	false
SSDEEP:	96:Szb3zrXjrLaiL94z8C6ktlOEknTJOOY8NIBKYzzsnxiZbxS/:SzrHzrOB8C1IdxiNxY
MD5:	47EDFB34AA1D759AA24AB417F1723725
SHA1:	460DED5841C518D900F690B4222BFE0C3D48BFAC
SHA-256:	54C6D49B8F5B28ABB78B35C21E39F3C40997450D462246599BDDE44782AC754E
SHA-512:	10A167AA25376F04EA600B61AD374AD84641205EA381CB1372800E593680135E9BBC1C0A773EDA06AC68148C5D969E62AF6816A77302C52746F715A67B31CDBC
Malicious:	false
Preview:	...........pOS/2JZr........`VDMX.^.q...\....cmap.Q.!...<...Dcvt ...........fpgm..........Ygasp............glyf=P.7.......Nhead..86...d...6hhea...........$hmtx.[..........loca............maxp.y.c....... name.L.........post.Q.w....... prepx......(.................3.......3.....f..............................MS .@............................. ................................................................................................................................................................... . ...!.!..."."...#.#...$.$...%.%...&.&...'.'...(.(...).)....*...+.+...,.,...-.-........././...0.0...1.1...2.2...3.3...4.4...5.5...6.6...7.7...8.8...9.9...:.:...;.;...<.<...=.=...>.>...?.?...@.@...A.A...B.B...C.C...D.D...E.E...F.F...G.G...H.H...I.I...J.J...K.K...L.L...M.M...N.N...O.O...P.P...Q.Q...R.R...S.S...T.T...U.U...V.V...W.W...X.X...Y.Y...Z.Z...[.[...\.\...].]...^.^..._._...`.`...a.a...b.b...c.c...d.d...e.e...f.f...g.g...h.h...i.i...j.j...k.k...l.l...m.m...n.n...o.o...p.p...q.q..

C:\Program Files\ExplorerPatcher\StartUI\Assets\Fonts\SkypeUISymbol-Regular.ttf

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	TrueType Font data, 15 tables, 1st "OS/2", 37 names, Microsoft, language 0x403, type 2 string, Normaloby
Category:	dropped
Size (bytes):	7492
Entropy (8bit):	5.707445677539256
Encrypted:	false
SSDEEP:	192:szrHzrkB8aoRIkPRPfPHS5oX8G7/xqNxY:arnkB8fImRHKOsq/xqo
MD5:	7DBD65D015C1085F472D9408C4CD560A
SHA1:	3712986F8B7EEDD4BA875DB4FCBA9B4DE149D22A
SHA-256:	991B0F2E9C2CDE7E2F78E79CE31EBF5BD7BCFF085FC7CA120B787556A6ABD30D
SHA-512:	2A6EB6CFF77085FB5DEEB2A9E3EACA3E817E11FA466F4A83D72E782760B941A7E495BC6EBC10EEB3C6C431A61AADC7BC5EAB284840DA031EDD58C6E50B732F5D
Malicious:	false
Preview:	...........pOS/2JZz........`VDMX.^.q...\....cmap.......<...\|cvt ...........fpgm..........Ygasp.......@....glyft<....L...Phead..J .......6hhea...........$hmtx...f.......$loca............maxp.......8... name.Bh....X....post.Q.w...P... prepx......p.......6.........3.......3.....f..............................MS .@............................. ................................................................................................................................................................... . ...!.!..."."...#.#...$.$...%.%...&.&...'.'...(.(...).).......+.+...,.,...-.-........././...0.0...1.1...2.2...3.3...4.4...5.5...6.6...7.7...8.8...9.9...:.:...;.;...<.<...=.=...>.>...?.?...@.@...A.A...B.B...C.C...D.D...E.E...F.F...G.G...H.H...I.I...J.J...K.K...L.L...M.M...N.N...O.O...P.P...Q.Q...R.R...S.S...T.T...U.U...V.V...W.W...X.X...Y.Y...Z.Z...[.[...\.\...].]...^.^..._._...`.`...a.a...b.b...c.c...d.d...e.e...f.f...g.g...h.h...i.i...j.j...k.k...l.l...m.m...n.n...o.o...p.p...q.q..

C:\Program Files\ExplorerPatcher\StartUI\Assets\officehub150x150.png

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7723
Entropy (8bit):	7.82866767742915
Encrypted:	false
SSDEEP:	96:y9O6OFOhjDn7dga5zMwatQ6QW57bUvbIYWikhF12EQuG9wmmnsvlVoliWTKAHOOK:yTDdga5AwaVLbUjRDEQuCmRliWvi
MD5:	4801FD82293A7B77B553635E733AD81C
SHA1:	F1BBBFF5A1618CA5851A8CB6DD7B79118C95097C
SHA-256:	B0134C30F2F35B00E050262005FF4EE0663498688572EDED15433C8A8CBABB5E
SHA-512:	072C3224EB764A652228B1DE032F25C89A7CBD0D44F988C21E56DFF941E6925BC20C245031524FBE6CE94614DC93A172F40A2F825934B52D02C099263225283E
Malicious:	false
Preview:	.PNG........IHDR...,...,.....y}.u....IDATx....\U...U...,Dv...Q@.Q....Q.\..a@....a.4&.DH@x ..F....e..Y .{d.$f1..Nz..NU..U.n.s.w.}.9Sk7.......O............#........a.....@X............@X...................... ,.........a.. ,.........a.. ,.@X......a.....@X...x...a.. ,.@X......a.....@X............@X...................... ,.........a.. ,.........a.. ,.@X............@X...................... ,.........a.. ,.........a.. ,.@X......a.....@X........bY.h]}a.....`.{W.......0.2A`...O..MR.[.....J.2.H....y!,.P..D!.g.V.c....M....;...2..H.m.H..<..~.!0@X...J..&.YP...FTQ..... .PQ..e^.ExnP...a.....c&e.,!...=..x....WTy......T.UT1..ez.L#..A.R..Q....F..t%.J@.U.[......d..y.^..q!,.%..!.A..J.......Q'....`..T..a......7...,}....v.QGSq......T%.d.k..D.KM..\.?.t./;@^AM{+......q....(M.....g~Xa.....nn}'n.{b.:..u.FX...U.I\...I.2I...`..?.Set......5.....W.VM.Y..h[gO.......g.fY......\a=}.q....'\|.019D\.!e.i.+&.S..A.BZ...0U...t..1Er.'.Y&U..QU..'U......X...s...e.,b./........OX..?[,.z..

C:\Program Files\ExplorerPatcher\StartUI\Assets\officehub71x71.png

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	PNG image data, 142 x 142, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4827
Entropy (8bit):	7.927350997586525
Encrypted:	false
SSDEEP:	96:RtM05MPLNlyr6x0zh99tQ7h8Zdi1vHzamUyNcdnA2Pm:RtMF+rK0zhg8ZMp4dnPm
MD5:	61F8C73839E9E20A3F3F817884E0050A
SHA1:	79F0FE04F097025821F9F00C492DA1B86BD036E8
SHA-256:	50D38CC6013B17CA7EAAACE84EB9DF59652AEA1E7B9B8CF6F8AC1F0274B261B8
SHA-512:	2F01D2B946B019D80CB5CAC5F100DFBC24E7ABC5EFD689ED01F1762A57859F10F6B26FEB8F51AB6C3399192BCA3B115861FA9FA079AE632855322D74992AA9C2
Malicious:	false
Preview:	.PNG........IHDR...............0.....IDATx..}....{..g...K`0Y.HBX#(..0...Y6....{8q..9.C..79... .h@\..(.5.FT..\|..(l..DQ.....'3=....u....u....nR3}.s.S.EOS3...y.[..R..t..7)t..Ehpthpthpthpthpt...........................C..C..C..C..C..C..G..GG..C..k...:v.8............`X...d .%.Lo...4.Z.h..#..zH../..(.h....E..U#.N?.F<.F/.. .K.h....4".&.5...4.4....~...".......).%.. 1..E".k/.N..Q.SY.U@..2(..O.O>... ....c.K.#.....N.......^!"......P`.I.M...(.y.I..n.^.m.\>. ....).`...UI...@...Z}h?.&.0D.&u.d....@.?......6H._`..}.`._..S.zC..........?..E..`...T..p.5.Q}48.P.H.........\|...bPp.T..<..Y.....$$y..A...C{p..]d.;.....t.~._v=&q......Q...m.C.)02[R.cj.r..(.wSyp.PB....<...$..B..$.......3O..20.k.p......k....t....................xx..r..?.(........I..J....0.MB........j...?..X.dR..U..f..X..:li\.........<(.?&..\|...G...q.........Z~..a.+...5.....p.$.).... MO..o."`1Hs....j(..`2.j_.w./....._._......E..:TwU}.FV......f.i.\|..._V.~0.S..P......&...d.B.. !8....#gR..........[.

C:\Program Files\ExplorerPatcher\StartUI\Assets\onenote150x150.png

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5446
Entropy (8bit):	7.7182554234602225
Encrypted:	false
SSDEEP:	96:a3NOGqOlOUqJAksxzEKZ6bDQEwLEf17HZkyYXMUEjPtSPa43hTe2IG2ohXtFx1oc:saBozjSrn7JVQPBRHZ5LxF
MD5:	834B785D846929658BE3754439B93661
SHA1:	B7AC15FF63E5DE7021BABFD8E5E53E3D5FD43BA6
SHA-256:	EE0F4170B7841A3BE39C0B3BEE0D51384A98A1CAF3C825132EDA43030784E84C
SHA-512:	9E45A7C8A67D25B34C4E7C49B7025524249B77FAA7516531E9DF40FCA6520990E07D9B92FB163092DE4D27B047C4BB55FF8D4486B2AAF66DE964C45D120648AB
Malicious:	false
Preview:	.PNG........IHDR...,...,.....y}.u....IDATx..{.$.}...3;.....wg.C....Kd.-.#%2r8#..!.CJ.9.%E..H.,....".D.H.E.,YI..<l+..l'...`....}:.B.;...Jw..nMMUW....v..c..L.c.{.?\|.5..]....4...................... ,.........a.. ,.........a.. ,.@X......a.....@X............@X...................a.. ,.........a.. ,.@X......a.....@X............@X...................... ,.........a.. ,.........a.....@X............@X...................... ,.........a.. ,.........a.. ,.@X......a.....@X...................... ,...Tk6....>.?Pk.....i&.].. .F.#..a.j......y!,.$.Rs.?t..#....XV..cM....S5......#..Z...#...LS.-..3..ORR\m...........H[..f$+.....Y.e.I{d..rBZ..6(...T..6.Y.No.5:b...).T....LIV...<?.dlZ.h..%).X'......l@`........\.......r...FP...Tr...xn..M...}.J..+u.,T."1..5.V%'.2V\M..P5...R.RY.\...L..be.j.q[...f...[2\*KP.c1.Bb..j..'..u<.}.+.#~3...HUy...R.DiK.t..`....W....K^1....Wl.r......lRk?h.... B..R.c..c?..v.?.M.{.".....y.....1 .T.{...YU...R.h....[..\|.G....&.l....[..7...[..HrJ....`.T.-.a.?.....

C:\Program Files\ExplorerPatcher\StartUI\Assets\onenote71x71.png

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	PNG image data, 142 x 142, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3550
Entropy (8bit):	7.897867714150185
Encrypted:	false
SSDEEP:	96:zjztgfNxDuMeu66kwqBmGSJj2ddfO5yRKg4MsgpH2T9T1:nmUaC5ddwyiCH25x
MD5:	3E9B58E469D2564FE06417E5B083D409
SHA1:	6379ED82C12C5D11E67C637DF38FC605BF5B7804
SHA-256:	0D90405D6F77EDE77D6875FC635EA061AEC5599AF5D6B99C48413C84F8B6464E
SHA-512:	88682E4B76FE9CA986C33F58261641F2B0E6A02687E55571CD818FBA296EF9F97541976C92963913FAD0C9FAE53A63C86A7EBC53820ED58FA46C81DF09F5D7EA
Malicious:	false
Preview:	.PNG........IHDR...............0.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..]..V...=.....R./.QU$..I#A"x(....R.g.J.@\|.x..(.....!/....Q.T...RE.TP.JSh...!4D.M.l..c...{...sm...........x......V..bb.5ON...#&...8b.....#&...8b....#&&...8b....#&....8b....#&...8bb....#&...8b.....#.A....Ru...k3...;....G...".gu.LPX.{P.Y_hT.:5.. s..@A..Q..kj.%....8.P.Y=4..U......'......Z..&..E`..(.6..+..2...T.<......Y.+..(G`).$..Vx..Q.....{..8...DX.......^G..f.p. q.."..vQ.4.Y......i...6..ks.Yo....l1M.Laz\|.v..rD..Z\...E...r2o.."x.q.....n<....2.W.UU.8h2X.......}.w.h.....v...o..K....S.,..i..:j=.....s%.j..dS......L0.nh.-.\..]?.}8^\NU(......78.FN.!.Q..9...j7...f[[.w..y......@?p..(...t....S...H3.Uw-.sXaT..i5......G....S...=y..8..jS.8eu.........jT.,.0S..T.....BJ...MY.6.6.4..T...;..)...n.=&...M.I\UQlS.4..TI.d...p.......6...:...m..<&....+N...u..l.\|C%.AMiS.c...E..G..x...o.....d.a...V..V.t.,.k..8.E..cl...ie.t....N....eOy1@^o9iws..Q:.O$8E...........?.D.....E\|H^g......_.m.......

C:\Program Files\ExplorerPatcher\WebView2Loader.dll

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	165336
Entropy (8bit):	6.238659206665009
Encrypted:	false
SSDEEP:	3072:7evoTTlTRTyiuPThTNTKm81SbbMYSPLNsknZiZ2HZ5AaliiT88FEtJ57dXSvlCW:HTlTRTyiuPThTNTKmFQdhsknZiMHfEti
MD5:	C5F0C46E91F354C58ECEC864614157D7
SHA1:	CB6F85C0B716B4FC3810DEB3EB9053BEB07E803C
SHA-256:	465A7DDFB3A0DA4C3965DAF2AD6AC7548513F42329B58AEBC337311C10EA0A6F
SHA-512:	287756078AA08130907BD8601B957E9E006CEF9F5C6765DF25CFAA64DDD0FFF7D92FFA11F10A00A4028687F3220EFDA8C64008DBCF205BEDAE5DA296E3896E91
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Win64.Meterpreter.11595.2675.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....sgf.........." .....\..........@F....................................................`A........................................Y...0.......(............P.......^...'..............T...................P...(....q..@...........h...........`....................text...][.......\.................. ..`.rdata..\|....p.......`..............@..@.data...D....0......................@....pdata.......P......."..............@..@.gxfg...p....p.......8..............@..@.retplne.............J...................tls.................L..............@..._RDATA...............N..............@..@.rsrc................P..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

C:\Program Files\ExplorerPatcher\Windows.UI.ShellCommon.pri

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	data
Category:	dropped
Size (bytes):	2967344
Entropy (8bit):	5.1369255772687055
Encrypted:	false
SSDEEP:	24576:sQIx3Fyi5T+bi/Lkhai/LkhdxQe/khY+iNO+WPqsGu4udw8Y8QUVQxK3itG4BWO6:sQIx3F+gW1u+QEitG4mfy+v1R
MD5:	B5EDF00A3AD977E6587CFEAD07D22726
SHA1:	BEB46626C5B8AD2A8426B8482A0C68F9DC09298D
SHA-256:	BD15C1C4F88EEDFC86DEA1E1692F84AC37638694858D11C02B22705945D1330E
SHA-512:	48FE5DF7932A0A10C21D69571BB5C6423ED052635FBDD6A640C73E032B84BB06A8C1321D539A8ADBE0FD56DBC4145F550DA9840D57BBDCBDE6784A6C2F3D0B2D
Malicious:	false
Preview:	mrm_pri2....0G-. ...............[mrm_decn_info].................[mrm_pridescex].............h...[mrm_hschemaex] ........8.......[mrm_res_map2_].............8...[mrm_dataitem] .............X.*.[mrm_dataitem] .........`.+..(..[mrm_dataitem] .........x.,.@...[mrm_dataitem] ...........,.XW..[mrm_dataitem] ..........1-.....[mrm_dataitem] ..........2-.....[mrm_dataitem] .........`4-.p...[mrm_dataitem] ..........5-.....[mrm_dataitem] .........x7-.p...[mrm_dataitem] ..........8-.....[mrm_dataitem] ..........:-.....[mrm_dataitem] .........8<-.....[mrm_dataitem] ..........=-.....[mrm_dataitem] ..........?-.....[mrm_dataitem] .........0A-.....[mrm_dataitem] ..........B-.....[mrm_decn_info].........................1.!.................,...............................................................................................................k...........................................................................................................................................................

C:\Program Files\ExplorerPatcher\ep_dwm.exe

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	118272
Entropy (8bit):	5.883424207863698
Encrypted:	false
SSDEEP:	3072:TmxpiUI+RrEAqTZLO1bLB1bmRYOalQIO:T+iD+TqTZyXvlQ
MD5:	6563C5338177FF66050EADFE3960C567
SHA1:	20E6E7C7778861756549062C5C0715090CAD0E52
SHA-256:	315AF6DF079B31BAC26156C9DDA8CC415C76408A39972346C238888AAFF79921
SHA-512:	724B9823E36B99490CD9B86A9B6EF33C35C5F92761ABF7D6B2D00C0398B14679DFD07189519025E89F8DCEF2409B0FDFAA48EDF77B07764A4ED6CF6C683B330C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m.^k..^k..^k......[k.......k......Tk..N...Wk..N...Nk..N...vk......Uk..^k..&k......_k......_k..^k.._k......_k..Rich^k..........PE..d...?,&g.........."....).............'.........@..........................................`....................................................x...............................h...0...p...............................@...............`............................text...`........................... ..`.rdata..Z...........................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................................

C:\Program Files\ExplorerPatcher\ep_gui.dll

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	752128
Entropy (8bit):	5.474681591921442
Encrypted:	false
SSDEEP:	6144:izq5NAtIjhy7rsdQiwHg4aG0Y/ist23ed3TqxkOyBGO:cqPA2jhyPASV
MD5:	81CD6D96F81B1E54AA327A4AF6BCBE85
SHA1:	B786C4BDE03D1566B1B040EB8970B82F7B80A007
SHA-256:	B23BAB1F5DC85C9E10145EEB32214D6CFE02FB5ABCF956A37A3C9DD7E09FEE67
SHA-512:	A1360B71BA11B529BD21F8C93C6CEEC01C4FAA9D33CA5E5FA62ACB118CEBF1E9E1D38EA17D236D1F8BD0D790F6B743329D41598D5A62C794B4786C14975782BE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.................................".....=...............................................................................Q.......9.............Rich....................PE..d...M,&g.........." ...)............x.....................................................`.................................................<...,....P...m...0.........................p...............................@............................................text... ........................... ..`.rdata..,...........................@..@.data...0#..........................@....pdata.......0......................@..@.rsrc....m...P...n..................@..@.reloc...............r..............@..B................................................................................................................................................................................................................

C:\Program Files\ExplorerPatcher\ep_setup.exe

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11143168
Entropy (8bit):	7.989614560554252
Encrypted:	false
SSDEEP:	196608:Yobw/inDWIRviYy06kRUEsyiFo2ItCC2bO+WxNtTYnepC5YbM/rN2kGBlSrnU:dw/2Bvc06kiEviXTCIKNtUnqYYA/A
MD5:	F164888A6FBC646B093F6AF6663F4E63
SHA1:	3C0BB9F9A4AD9B1C521AD9FC30EC03668577C97C
SHA-256:	8C5A3597666F418B5C857E68C9A13B7B6D037EA08A988204B572F053450ADD67
SHA-512:	F1B2173962561D3051EC6B5AA2FC0260809E37E829255D95C8A085F990C18B724DAFF4372F646D505DABE3CC3013364D4316C2340527C75D140DBC6B5EBDEEE1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!22622.4317.67.1.8bfca71add96d3deS mode....$........ uO.A...A...A...9...A...9...A.......A.......A.......A.......A...9...A...9...A...9...A...A..NA.......A.......A...A...A.......A..Rich.A..................PE..d...v,&g.........."....).P....................@.............................@............`..................................................K...............................0.......(..p...........................p'..@............`...............................text...pO.......P.................. ..`.rdata.. ....`.......T..............@..@.data...T....`.......R..............@....pdata...............^..............@..@.rsrc................z..............@..@.reloc.......0......................@..B........................................................................................................................................................................................................................

C:\Program Files\ExplorerPatcher\ep_setup.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\ExplorerPatcher\ep_taskbar.2.dll

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2309632
Entropy (8bit):	5.9603372344097245
Encrypted:	false
SSDEEP:	49152:V9X7GWGVgWGwN78HKBJfJNrkrhcxaPs/P5+/Dd:VMiQkFcxaEGDd
MD5:	DCE36294E4AB8F9F85357698ED5A8CEA
SHA1:	5511F09C022693E5A8644B59C46CF8AC9C4D0256
SHA-256:	696938E9820976C632F42A39A6B74A04C3262C4217F6B0F27D1B0E8C3280A02E
SHA-512:	99FA0E6DFB8A5BA8D38B0EA7398C131F99D2F7D83D134FD5BB03F8E7D5E4141A7BFCFD005E61D208B1FB33149D8274CC164211A453FE5833F13DDF6696902210
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........P[...[...[.......S..........K...R...K...K...R.A.....K...f.......B.......Z.......F...[..................Z.....-.Z...[.E.\.......Z...Rich[...........................PE..d...Ex%g.........." ...)......................................................#...........`.........................................`....,..8...D....p.......................`#.L0......p.......................(......@...............@.......@....................text...t........................... ..`.rdata...Y.......Z..................@..@.data....9...P.......:..............@....pdata...............P..............@..@.rsrc........p......."..............@..@.reloc..L0...`#..2....#.............@..B........................................................................................................................................................................................................

C:\Program Files\ExplorerPatcher\ep_weather_host.dll

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	244224
Entropy (8bit):	5.982317924874446
Encrypted:	false
SSDEEP:	3072:xjW86bHWeRLwF/ov4P3dUXqu/FYu9L33+C+TS9eEXB9aospWoU6P:xEbHWK0gv4GXZ/rpEWoh
MD5:	AAC2857727CFF3CD7B291F9500196F73
SHA1:	C86EEDFF45B672DF58885F12E7A7AEE3398C618B
SHA-256:	78ED3E3676D97C337FEF071B522805F4CF742587A40F96AF4AA4D74FEE0AF88A
SHA-512:	A4C54B4221B1745FE1DE6D53FCD7A528B4BACDA6B2C66E02D55BD5867D118E042A35490E45B64C2D24398A9AC06E356BF10A2822F83663D52C1A28E10F0A52E5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6v..X%..X%..X%.[$..X%.]$..X%.y[$..X%.y\$..X%.y]$..X%.\$..X%.Y$..X%..X%..X%..Y%'.X%.xP$..X%.xX$..X%.x.%..X%...%..X%.xZ$..X%Rich..X%................PE..d...D,&g.........." ...).............e....................................................`..........................................~......,.......................................@^..p............................]..@...............@............................text...0........................... ..`.rdata.............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	111616
Entropy (8bit):	5.926529844260868
Encrypted:	false
SSDEEP:	1536:uw+B6bvTxS8Si7ixJSHQ8YmpqvA9uf+UfKzwzsW7dJ9dlPXdremU:/3TxMpxJuQ8bpwouf+f07hJ9emU
MD5:	E477912C435DB101603781DCC44289E1
SHA1:	7B2EDA1B6055E8874F37FB9B48BCC933BF69C1C3
SHA-256:	0930D2E71353A411D96DC4DFDD473DACE98D1B7B9546AC4C185F8984F8B9C18B
SHA-512:	9F8089742099A789387381980EC5B493DEEC46BD73F39CF8FA9919BE4DD772B20C70246E5E90D625011F052D5C3B2000B42C50843956D74FB85FF1B1D18EACE9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z.R...R...R.......W..............X...B...[...B...\...B...r.......U...R...'.......Q.......S......S.......S...RichR...........PE..d...A,&g.........." ...)............p.....................................................`.................................................X...P...............................x.......p...........................P...@...............8............................text... ........................... ..`.orpc...,........................... ..`.rdata.............................@..@.data...h...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..x...........................@..B........................................................................................................................................................................................................

C:\Program Files\ExplorerPatcher\pris\Windows.UI.ShellCommon.en-US.pri

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	data
Category:	dropped
Size (bytes):	187808
Entropy (8bit):	5.898309599415517
Encrypted:	false
SSDEEP:	3072:M+Hus1m6HLzoyVgyAIYlXilvkp+qhEUmkqCZB1+5vGFk:M+TmqIy4IWhEUmkrSvGFk
MD5:	18AF812E01A575418952ACEFBE232F0B
SHA1:	6672685B3EB8FAF7DCEEF22A0C0866F66850EAEF
SHA-256:	48DE9376E52993C66956EDD30A58EC1F8ED58F4E9AE21AD2D1A739AD952AE1FC
SHA-512:	8E4F736EDE86C5B108EC9B9C693EE82AC8C2BBEB005E15B39A1777C67C81A7A6AA0CF633BA6A21FBD8E0BB566420EFF23117A0AC6114020913BE03FBD9D776A9
Malicious:	false
Preview:	mrm_pri2........ ...............[mrm_decn_info].................[mrm_pridescex].............H...[mrm_hschemaex] ................[mrm_res_map2_].........h... P..[mrm_dataitem] .............H...[mrm_decn_info].................................................................................................E.N.-.U.S..............[mrm_pridescex].........H...........................................H...[mrm_hschemaex] ..................".....[def_hnamesx] ..........B......2...m.s.-.a.p.p.x.:././.W.i.n.d.o.w.s...U.I...S.h.e.l.l.C.o.m.m.o.n./...W.i.n.d.o.w.s...U.I...S.h.e.l.l.C.o.m.m.o.n.........1.......2...............................A..0.P......C..0.P......D..0,E[.....F..0DC,.....J..0$B......M..0.X......M..0^A......N..0n2......P..0l1......Q..0.',.....R..0.'+.....S..0..m.....S..0..>.....S..0%.....#.W.#0......+.A..!..0...).A..!../.....A..!......4.A.'!}.-...".A..!g.,.....A.!!E.+...5.A.(!..*...4.A.'!..)...3.A.&!..(...0.A.#!..'...B.A.5!s.&.....A.!!Q.%...1.A.$!,.$...0.A.#!..#.../.A."!..".....A.!!

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ExplorerPatcher\Properties (ExplorerPatcher).lnk

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=39, Archive, ctime=Fri Sep 6 01:27:57 2024, mtime=Thu Dec 19 17:43:12 2024, atime=Fri Sep 6 01:27:57 2024, length=90112, window=hide
Category:	dropped
Size (bytes):	1960
Entropy (8bit):	3.321199116325212
Encrypted:	false
SSDEEP:	24:8eSkGrpt7fSulTyApeiUHh+/Clo+sd/UW+fwT4o02s/Ykvsm:8pFptf3ltYiAlo7d/9fMo8YkU
MD5:	92C5553DB196D478E13D40A8A7BF8526
SHA1:	908E91C50B67F5ACF32D3EA92B1687659936D1BC
SHA-256:	07BC017D1970A3567D05D0B8CFD8279AE3238433DB4B58D614A58B15D5C8B3D9
SHA-512:	46591D925281B0A1D6818DA8091AAC7EFC3B365996456C7CACFA314517AFE9097C5248C01B3B633153E47C99D002BF106C1D98E4B2429F268827447281451F43
Malicious:	false
Preview:	L..................F.@.. ....l.b.....Zi.ER.....b.....`..'...................E....P.O. .:i.....+00.../C:\...................V.1......Y/...Windows.@......T,.Ye.....P......................B.W.i.n.d.o.w.s.....Z.1......Ya...System32..B......T,.Ye.....?.........................S.y.s.t.e.m.3.2.....f.2..`..&Y}. .rundll32.exe..J......&Y}..Yg.....9...........(...........3.r.u.n.d.l.l.3.2...e.x.e.......O...............-.......N...........&.JM.....C:\Windows\System32\rundll32.exe....E.x.p.l.o.r.e.r.P.a.t.c.h.e.r./.....\.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.\.r.u.n.d.l.l.3.2...e.x.e...C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.3.".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.E.x.p.l.o.r.e.r.P.a.t.c.h.e.r.\.e.p._.g.u.i...d.l.l.".,.Z.Z.G.U.I...C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.........%SystemRoot%\system32\shell32.dll.............................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000022.db

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	104880
Entropy (8bit):	3.9857191071573217
Encrypted:	false
SSDEEP:	1536:sPTkYS/mgsjzPih1ri5GhnyGMVUUxx14t:srkYS/mgsjzqhpi7G7Ux7U
MD5:	74ED0F9F6B0C741FD476DFB8F9A523EA
SHA1:	BAF7D7F257438F99B129DAB5D2B0CD5603A35898
SHA-256:	BF3B5F73734398D36C9C9788608C49331E28335EE473C71189550EEA240E94D4
SHA-512:	87272A987774782E7D179C2A8BE0005F67AF39F71948A38EBF769A8DD3077174DFEE3FA052674A96A248506A34196FE0BA119962D1AB01E2FDC5B518DEE68E5B
Malicious:	false
Preview:	....h...$..............P..............Q.......X...(...............p...Q.......e.n.-.C.H.;.e.n.-.U.S...............H..............P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................M.a.o.g.a.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u.................. ..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................M.a.o.g.a

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2OIDBQCM\73C9C0571D55C7E8C1DB49D54FB957CD01BB4A564F9CFA46E57CD5F5E9D0B36800[1].blob

Download File

Process:	C:\Windows\explorer.exe
File Type:	MSVC program database ver 7.00, 4096*4923 bytes
Category:	dropped
Size (bytes):	20164608
Entropy (8bit):	5.681845584845048
Encrypted:	false
SSDEEP:	49152:B0n570xvYDTvox3Q353w3j3W3y+ZNufjNY6UbY/YILCGg59dIaEx0URA9L6+cxK4:B0nJsc42R0B1
MD5:	00B6C341356F914D5E7C46C80D930220
SHA1:	60C19DEA704D295177013582F423DE1D0BB263B5
SHA-256:	5E933C99E652FDBF28165E2B0301297FAC9B01FE00FC59660EA43AD8A4772514
SHA-512:	FD351C8F5C3CCE0B89D2FC1664E8C16E3F35363BB0A09FF1AEFE6832F06790F5AEAE7AB2CFAC90424E95B2DE6663F266CCA5F303986778621B99486D5A710A68
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........;....O......:...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4TJ1LROY\5BE1B1FD8C4CD469077AFBBA0798AFC8A16E31C59DCD0A1A38B2906EB5B053E500[1].blob

Download File

Process:	C:\Windows\explorer.exe
File Type:	MSVC program database ver 7.00, 4096*7685 bytes
Category:	dropped
Size (bytes):	31477760
Entropy (8bit):	5.623601438277038
Encrypted:	false
SSDEEP:	49152:FF/1V1oiaOrjDgVTub8O8/1l4Lf/45EFRiUz3Cv+gkHEpctXi7lcOT7uH6qTpLN4:7NV1vnH+1WzqgaftyWnh9RT
MD5:	F6B1F244316498EFB599C57615D0B27A
SHA1:	3463AB821F1083DE718A7330E0E266D51B62978F
SHA-256:	7191526BCEEF78B8ABF7C2A298BA3CCD7893D4D5882F995877059665415D2E60
SHA-512:	60C662E1B2FFA20268E917DCEA94186205726C672D0254C355F015FC033C53BBCBF7DC9C31B0F5C16A1C0B5E1128F88BB87A63B9B3D4F4E473FF282C279F10F5
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KA259YPD\212EE6F6E5D8968D8EF5025E80B96D0A21B02CF1C46C2B343900F72F34A45D3800[1].blob

Download File

Process:	C:\Windows\explorer.exe
File Type:	MSVC program database ver 7.00, 4096*1499 bytes
Category:	dropped
Size (bytes):	6139904
Entropy (8bit):	5.371192355576708
Encrypted:	false
SSDEEP:	49152:rYNFBy5AXoKJyBGF8PLn/gau9oIClD08/zORIW1hvuY+N6ND9QM3UEXHxm0dnDNN:roGYqsZ5RZQ
MD5:	6FBAD49B7063AABD0549B49A477CAAE5
SHA1:	E84776C7AB4D66BDCEB9B6BD91EE15FE23499AAC
SHA-256:	0E6B01BD708F0164329560D14EE390E3B14DB00D0776F41A330157C949DA9EE9
SHA-512:	25AC3A32503177B96559D2C03520A29A0CB9801687036DAF0A955E911546ECF1027B40588210B2E5BC709948A395C11CD990CA0DCC818EE0259C95601526AFF7
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...............,...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\V4I0JG8P\2EBF3E9967431ACD9E1D4A46150BB2A32579CF535A44455C32BE3B2ECE47FBDE00[1].blob

Download File

Process:	C:\Windows\explorer.exe
File Type:	MSVC program database ver 7.00, 4096*8699 bytes
Category:	dropped
Size (bytes):	34115584
Entropy (8bit):	5.732874486135257
Encrypted:	false
SSDEEP:	196608:vPcF1Vbv8dJ6EPigdurTKKR68aMfUDCaN4QlkqYGxR2rlP9rKoyEXv/uIqvLzfHM:006
MD5:	34769E2564CAF36AB3795D3B0A469ECB
SHA1:	3313693643E1B071C782BEE26BBAC64F22395EE8
SHA-256:	E99821661B1EF3D9AF3BA7C2E0548A02F9B0529936F51B03EB2AF50D8B35F446
SHA-512:	2444FEC40E1ED1DA4C2B7AE14B42F15A35DF636593EC1D6451926AE9EBE9960A18A799B84853BAF7680C5CE346753EED2DF6569F1FA7E3B6CD8D2E1589C2C207
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS............!..H........!..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ExplorerPatcher\StartDocked.pdb

Download File

Process:	C:\Windows\explorer.exe
File Type:	MSVC program database ver 7.00, 4096*4923 bytes
Category:	dropped
Size (bytes):	20164608
Entropy (8bit):	5.681845584845048
Encrypted:	false
SSDEEP:	49152:B0n570xvYDTvox3Q353w3j3W3y+ZNufjNY6UbY/YILCGg59dIaEx0URA9L6+cxK4:B0nJsc42R0B1
MD5:	00B6C341356F914D5E7C46C80D930220
SHA1:	60C19DEA704D295177013582F423DE1D0BB263B5
SHA-256:	5E933C99E652FDBF28165E2B0301297FAC9B01FE00FC59660EA43AD8A4772514
SHA-512:	FD351C8F5C3CCE0B89D2FC1664E8C16E3F35363BB0A09FF1AEFE6832F06790F5AEAE7AB2CFAC90424E95B2DE6663F266CCA5F303986778621B99486D5A710A68
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........;....O......:...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ExplorerPatcher\StartUI.pdb

Download File

Process:	C:\Windows\explorer.exe
File Type:	MSVC program database ver 7.00, 4096*8699 bytes
Category:	dropped
Size (bytes):	34115584
Entropy (8bit):	5.732874486135257
Encrypted:	false
SSDEEP:	196608:vPcF1Vbv8dJ6EPigdurTKKR68aMfUDCaN4QlkqYGxR2rlP9rKoyEXv/uIqvLzfHM:006
MD5:	34769E2564CAF36AB3795D3B0A469ECB
SHA1:	3313693643E1B071C782BEE26BBAC64F22395EE8
SHA-256:	E99821661B1EF3D9AF3BA7C2E0548A02F9B0529936F51B03EB2AF50D8B35F446
SHA-512:	2444FEC40E1ED1DA4C2B7AE14B42F15A35DF636593EC1D6451926AE9EBE9960A18A799B84853BAF7680C5CE346753EED2DF6569F1FA7E3B6CD8D2E1589C2C207
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS............!..H........!..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ExplorerPatcher\explorer.pdb

Download File

Process:	C:\Windows\explorer.exe
File Type:	MSVC program database ver 7.00, 4096*1499 bytes
Category:	dropped
Size (bytes):	6139904
Entropy (8bit):	5.371192355576708
Encrypted:	false
SSDEEP:	49152:rYNFBy5AXoKJyBGF8PLn/gau9oIClD08/zORIW1hvuY+N6ND9QM3UEXHxm0dnDNN:roGYqsZ5RZQ
MD5:	6FBAD49B7063AABD0549B49A477CAAE5
SHA1:	E84776C7AB4D66BDCEB9B6BD91EE15FE23499AAC
SHA-256:	0E6B01BD708F0164329560D14EE390E3B14DB00D0776F41A330157C949DA9EE9
SHA-512:	25AC3A32503177B96559D2C03520A29A0CB9801687036DAF0A955E911546ECF1027B40588210B2E5BC709948A395C11CD990CA0DCC818EE0259C95601526AFF7
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...............,...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ExplorerPatcher\twinui.pcshell.pdb

Download File

Process:	C:\Windows\explorer.exe
File Type:	MSVC program database ver 7.00, 4096*7685 bytes
Category:	dropped
Size (bytes):	31477760
Entropy (8bit):	5.623601438277038
Encrypted:	false
SSDEEP:	49152:FF/1V1oiaOrjDgVTub8O8/1l4Lf/45EFRiUz3Cv+gkHEpctXi7lcOT7uH6qTpLN4:7NV1vnH+1WzqgaftyWnh9RT
MD5:	F6B1F244316498EFB599C57615D0B27A
SHA1:	3463AB821F1083DE718A7330E0E266D51B62978F
SHA-256:	7191526BCEEF78B8ABF7C2A298BA3CCD7893D4D5882F995877059665415D2E60
SHA-512:	60C662E1B2FFA20268E917DCEA94186205726C672D0254C355F015FC033C53BBCBF7DC9C31B0F5C16A1C0B5E1128F88BB87A63B9B3D4F4E473FF282C279F10F5
Malicious:	false
Preview:	Microsoft C/C++ MSF 7.00...DS...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg

Download File

Process:	C:\Windows\explorer.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	151729
Entropy (8bit):	7.945756681484684
Encrypted:	false
SSDEEP:	3072:Jv9V0wuYm4qafQx/DHf7klXxenjkZbzSqfSnIKoZntIS:Jv9Qa+7k9GkZbzNSnSZnSS
MD5:	973B719A7B7C62DDFB1D55ED5AF3C2A0
SHA1:	6461F387ADBC02FEFC72A9778155A07CB1880FBC
SHA-256:	61D9CDC2D78B94C6C9893F71107B7B0F3377DFC6D5DC314A0DE17231EB72D87F
SHA-512:	62F1DC4493D5AD3062BD7467738C99535C7DD2D0B6F1516F2C4BCF22F33609BCECB3B6B9CB6FFE1CFBD5402C0C68EAA83A342CEA18E0B4DE3D004CA498DA60D8
Malicious:	false
Preview:	......JFIF.............C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..u.........R..-....--......r.L..QEH.....j....u...QE:..J>..P.E...t....B.:... %..@.!.N......R.(...ih.h..h.)..P;...N.CV.E..QJ.-....E:.....KEH..-..@.E>..j....)OZ......u....m(Z.`..--.a.S..,3...N.......i.i.bQK.....v.6..h..@....6..h..F.@.E..F.@.jmI..o..6.u...h.Q@..N.j.Jku.Q@..%>...m5.......QO...E9.=..q@...A...F.m...b.}.....F...J.a.S.(....~)(....)...QN.j.Jm:...5%I.!.P.(.jJ

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\JumpViewUI_.dll

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1458176
Entropy (8bit):	6.529653043779224
Encrypted:	false
SSDEEP:	24576:MOWQVo+MVJRgjgfRCZhnNa/a63jGr64rzAiGzJ6eNUVyJppR3:M+a+u34ZJNY3k98zJ7NUgJP
MD5:	0E65A0A661148077BC24602067AC3FF7
SHA1:	3916FA695AC13A61E60EDFD39F2F8504A99FEB62
SHA-256:	3E81CECF171D697DBF08E97CDC0ED60158D6FB405E9897D54890CF20E35EF856
SHA-512:	780AECC25942FC32D5454DBC139CF02D738E474DE2B66E47D1F92F2549E01B4F79A03480A0F16D407AE398B1F2B8F25854997384E59B4B98A8F7BF6400E475BD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2A..v .@v .@v .@=X.Ar .@=X.AR .@.X1@? .@=X.Ar .@=X.A} .@v .@f%.@=X_@u .@=X.A; .@=X.Aw .@=X]@w .@=X.Aw .@Richv .@........PE..d...Bf............" .....f...........................................................P....`Q............................................t...4........@.......P...............P..lF......p.......................(.......@.......................`....................text....e.......f.................. ..`.rdata...............j..............@..@.data...P,... ......................@....pdata.......P....... ..............@..@.didat.. ....0......................@....rsrc........@......................@..@.reloc..lF...P...H..................@..B................................................................................................................................................................................................................

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8694272
Entropy (8bit):	6.576367943733818
Encrypted:	false
SSDEEP:	49152:mcvhib+lfmq53jlhFdDRqzVUW+qn47Y1sqjQ7y9GVshaTBLHiNLbEr1zIcmQn9aD:mCjdCQ1zIWx5KDegEgHnrQV
MD5:	20B55D5C6DCE22F8011906281E4E6999
SHA1:	27735EAD648E104D3715DABFCFFF410CDCFC706C
SHA-256:	715B75B289DD2EFC34FB0FFD924FCD38A34FEE9FC5E93A207FCADA7CB38F6508
SHA-512:	87CE3569C9803380F31638C181F5C9D3BD1BBA497D162405EF0D0271ABEF1FC91BADAAEB8D79C30F8EE0F5313BF8DDA161BEC7DE0A57E1F4BF10FCABB3D28DB2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%Du.a%..a%..a%..]..e%..]..D%..]..q%..h].._%..]..j%..a%... ..]..b%..]..j$..]..`%..]..`%..*]..`%..Richa%..........................PE..d...D............" ......^...%......l....................................... ............`Q........................................ {w.p....{w.............. }.\y..............._.. .c.p....................=d.(....c.@.............^......uw......................text.....^.......^................. ..`.rdata........^.......^.............@..@.data...4Q....w..,....w.............@....pdata..\y... }..z....\|.............@..@.didat...............D..............@....rsrc................F..............@..@.reloc..._.......`...J..............@..B................................................................................................................................................................................................

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	716288
Entropy (8bit):	6.218933147794801
Encrypted:	false
SSDEEP:	12288:tAZZrKVjXMzFheHhMwJXOI8mw03edresazpaek4Yc9edrtvL9suuuuuuaW5q77gt:6ZBsjXMzFhySwJXOIpOSsgpapXcqrNO7
MD5:	8BFCA71ADD96D3DE75173D464792E2B9
SHA1:	FE6BC3C30C26D6CE1C149B173B5D79C80102D5B9
SHA-256:	5AAA6BAB20B7116B32BDDBA1DF216F7476557BB48397E1968A49EDE14E6C377D
SHA-512:	B560415727D15CEEB09E5D9E39EA2B4043848BF4239FBF5068AAAC86F64B3D05D4E21EB197416DB0FB4172C68F782C05AEAE18AC70C27F80566040B6BA79159A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........%.^.D...D...D...<...D...<..uD.......D.......D...<4..D....Z..D.......D.......D.......D...<...D...<...D...D...F.......D.......D....X..D...D0..D.......D..Rich.D..................PE..d...m,&g.........." ...).....N......l........................................P............`..........................................U......DZ...........0.......I...........@......`\|..p...............................@...............h............................text............................... ..`.rdata..v...........................@..@.data...H...........................@....pdata...I.......J...d..............@..@.rsrc....0.......2..................@..@.reloc.......@......................@..B................................................................................................................................................................................................

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib.dll

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	168448
Entropy (8bit):	6.180419967116705
Encrypted:	false
SSDEEP:	3072:dRH0518Qus3amg8D/O6tF+eie3cBHqveM:v0f8Q/xDmoiWcB
MD5:	B80816EE9FCDB1D9076B73FD929FC96B
SHA1:	FF9A5A12DCA164652419F5DEE082AF4A49B8A03B
SHA-256:	D63B9FC13C99000CF77D02EE6E5E84C825D02A92D87B728CB601681B5EB21671
SHA-512:	21CEBCA787A0FA0976B44315BF05B6EB4719306653DDBBFCE41231244219BCD288CD8045980BACF21481DDABCF464C82795147DB755148CC0E23167BBB874FD7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............e...e...e...f...e...`. .e...a...e...f...e...a...e...`...e.......e...d...e...d...e...m...e...e...e.......e.....e...g...e.Rich..e.................PE..d...G,&g.........." ...)..................................................................`.................................................>..x........0...p..................T.......p...............................@............ ...............................text...P........................... ..`.rdata...(... ...*..................@..@.data........P.......:..............@....pdata.......p.......F..............@..@.rsrc....0.......2...X..............@..@.reloc..T...........................@..B........................................................................................................................................................................................................................

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\dxgi.dll

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	716288
Entropy (8bit):	6.218933147794801
Encrypted:	false
SSDEEP:	12288:tAZZrKVjXMzFheHhMwJXOI8mw03edresazpaek4Yc9edrtvL9suuuuuuaW5q77gt:6ZBsjXMzFhySwJXOIpOSsgpapXcqrNO7
MD5:	8BFCA71ADD96D3DE75173D464792E2B9
SHA1:	FE6BC3C30C26D6CE1C149B173B5D79C80102D5B9
SHA-256:	5AAA6BAB20B7116B32BDDBA1DF216F7476557BB48397E1968A49EDE14E6C377D
SHA-512:	B560415727D15CEEB09E5D9E39EA2B4043848BF4239FBF5068AAAC86F64B3D05D4E21EB197416DB0FB4172C68F782C05AEAE18AC70C27F80566040B6BA79159A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........%.^.D...D...D...<...D...<..uD.......D.......D...<4..D....Z..D.......D.......D.......D...<...D...<...D...D...F.......D.......D....X..D...D0..D.......D..Rich.D..................PE..d...m,&g.........." ...).....N......l........................................P............`..........................................U......DZ...........0.......I...........@......`\|..p...............................@...............h............................text............................... ..`.rdata..v...........................@..@.data...H...........................@....pdata...I.......J...d..............@..@.rsrc....0.......2..................@..@.reloc.......@......................@..B................................................................................................................................................................................................

C:\Windows\dxgi.dll

Download File

Process:	C:\Users\user\Desktop\ep_setup.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	716288
Entropy (8bit):	6.2189942777653355
Encrypted:	false
SSDEEP:	12288:NAZZrKVjXMzFheHhMwJXOI8mw03edresazpaek4Yc9edrtvL9suuuuuuaW5q77gt:aZBsjXMzFhySwJXOIpOSsgpapXcqrNO7
MD5:	047B192A9C703FC5A2C2764DB869FF5C
SHA1:	8C1494ACC3119FBF8332AE3B6A4F854E5B4D37CB
SHA-256:	1971C57F88849B4069BE06D3784E0968755C916FA1564A3F8F05610D3B02CDCC
SHA-512:	C7F80703DB23611D56618A8B1B4FFFF814A9264135E3846DF99120C0FFC16DA9D5B37C6465AC25D61D4F6E386D36B3DE640C57C460098F06778C658CC19454CC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!22622.4317.67.1.8bfca71add96d3deS mode....$........%.^.D...D...D...<...D...<..uD.......D.......D...<4..D....Z..D.......D.......D.......D...<...D...<...D...D...F.......D.......D....X..D...D0..D.......D..Rich.D..................PE..d...m,&g.........." ...).....N......l........................................P............`..........................................U......DZ...........0.......I...........@......`\|..p...............................@...............h............................text............................... ..`.rdata..v...........................@..@.data...H...........................@....pdata...I.......J...d..............@..@.rsrc....0.......2..................@..@.reloc.......@......................@..B................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.989614560554252
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ep_setup.exe
File size:	11'143'168 bytes
MD5:	f164888a6fbc646b093f6af6663f4e63
SHA1:	3c0bb9f9a4ad9b1c521ad9fc30ec03668577c97c
SHA256:	8c5a3597666f418b5c857e68c9a13b7b6d037ea08a988204b572f053450add67
SHA512:	f1b2173962561d3051ec6b5aa2fc0260809e37e829255d95c8a085f990c18b724daff4372f646d505dabe3cc3013364d4316c2340527c75d140dbc6b5ebdeee1
SSDEEP:	196608:Yobw/inDWIRviYy06kRUEsyiFo2ItCC2bO+WxNtTYnepC5YbM/rN2kGBlSrnU:dw/2Bvc06kiEviXTCIKNtUnqYYA/A
TLSH:	E3B6332A77E505CAF97BC378A4B71586A1AABD072334D93E8660058E8D337F18C38775
File Content Preview:	MZ......................@...............................................!..L.!22622.4317.67.1.8bfca71add96d3deS mode....$........ uO.A...A...A...9...A...9...A.......A.......A.......A.......A...9...A...9...A...9...A...A..NA.......A.......A...A...A.......A.

File Icon


Icon Hash:	2086969696969600

Static PE Info

General

Entrypoint:	0x140008c18
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67262C76 [Sat Nov 2 13:43:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	f1499aa854493f33c80eb31e0ab8ae92

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F4EB4B86A00h
dec eax
add esp, 28h
jmp 00007F4EB4B8662Fh
int3
int3
dec eax
sub esp, 28h
call 00007F4EB4B87098h
test eax, eax
je 00007F4EB4B867D3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F4EB4B867B7h
dec eax
cmp ecx, eax
je 00007F4EB4B867C6h
xor eax, eax
dec eax
cmpxchg dword ptr [0002E420h], ecx
jne 00007F4EB4B867A0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F4EB4B867A9h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F4EB4B867B9h
mov byte ptr [0002E409h], 00000001h
call 00007F4EB4B86D85h
call 00007F4EB4B8A410h
test al, al
jne 00007F4EB4B867B6h
xor al, al
jmp 00007F4EB4B867C6h
call 00007F4EB4B95BEFh
test al, al
jne 00007F4EB4B867BBh
xor ecx, ecx
call 00007F4EB4B8A420h
jmp 00007F4EB4B8679Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0002E3D0h], 00000000h
mov ebx, ecx
jne 00007F4EB4B86819h
cmp ecx, 01h
jnbe 00007F4EB4B8681Ch
call 00007F4EB4B8700Eh
test eax, eax
je 00007F4EB4B867DAh
test ebx, ebx
jne 00007F4EB4B867D6h
dec eax
lea ecx, dword ptr [0002E3BAh]
call 00007F4EB4B95A0Eh
test eax, eax
jne 00007F4EB4B867C2h
dec eax
lea ecx, dword ptr [0002E3C2h]
call 00007F4EB4B867FEh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x34bfc	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3a000	0xa68508	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x38000	0x1aac	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xaa3000	0x6a4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x328b0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x32770	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x26000	0x508	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x24f70	0x25000	1f4fc22d148d6d3135755eea43c697e1	False	0.5402172191722973	data	6.471346143888643	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x26000	0xfd20	0xfe00	aa96a95a51639aa280d1a0d77a982305	False	0.48357529527559057	data	5.3687460432728695	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x36000	0x1f54	0xc00	70729d2ec4f7f720830ce88e7a8defb2	False	0.138671875	data	1.9570761316523926	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x38000	0x1aac	0x1c00	bd20803e644778b5c525e4bcf2d8d029	False	0.46861049107142855	PEX Binary Archive	5.289454763459752	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x3a000	0xa68508	0xa68600	b66e28f0c9dd840431c3f09702e7e354	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xaa3000	0x6a4	0x800	5ea92cc594f6f022327f422ccdb67dfd	False	0.51025390625	data	5.001664792945668	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_STRING	0xaa1ed0	0x13e	data	Chinese	Taiwan	0.7327044025157232
RT_STRING	0xa9a140	0x2ae	data	German	Germany	0.43731778425655976
RT_STRING	0xa998c0	0x2a2	data	English	United States	0.4169139465875371
RT_STRING	0xa9abb0	0x2b8	data	French	France	0.43103448275862066
RT_STRING	0xa9b540	0x280	data	Hungarian	Hungary	0.46875
RT_STRING	0xa9c740	0x1b2	data	Japanese	Japan	0.6428571428571429
RT_STRING	0xa9cc98	0x170	data	Korean	North Korea	0.7010869565217391
RT_STRING	0xa9cc98	0x170	data	Korean	South Korea	0.7010869565217391
RT_STRING	0xa9da88	0x294	data	Dutch	Netherlands	0.4393939393939394
RT_STRING	0xa9e3c0	0x2ac	data	Polish	Poland	0.4473684210526316
RT_STRING	0xa9ed48	0x2a2	data	Portuguese	Brazil	0.4287833827893175
RT_STRING	0xa9f590	0x294	data	Romanian	Romania	0.4348484848484849
RT_STRING	0xa9ff20	0x2ac	data	Russian	Russia	0.4780701754385965
RT_STRING	0xaa0800	0x2c4	data	Turkish	Turkey	0.4477401129943503
RT_STRING	0xa9be68	0x292	data	Indonesian	Indonesia	0.4133738601823708
RT_STRING	0xaa11c8	0x2fe	data	Ukrainian	Ukrain	0.4804177545691906
RT_STRING	0xa9d178	0x2c8	data	Lithuanian	Lithuania	0.45365168539325845
RT_STRING	0xaa1b40	0x132	data	Chinese	China	0.7320261437908496
RT_STRING	0xaa2010	0x272	data	Chinese	Taiwan	0.6597444089456869
RT_STRING	0xa9a3f0	0x7bc	data	German	Germany	0.33636363636363636
RT_STRING	0xa99b68	0x5d4	data	English	United States	0.36126005361930297
RT_STRING	0xa9ae68	0x6d2	data	French	France	0.35051546391752575
RT_STRING	0xa9b7c0	0x6a2	data	Hungarian	Hungary	0.37809187279151946
RT_STRING	0xa9c8f8	0x39c	data	Japanese	Japan	0.5703463203463204
RT_STRING	0xa9ce08	0x36c	data	Korean	North Korea	0.5753424657534246
RT_STRING	0xa9ce08	0x36c	data	Korean	South Korea	0.5753424657534246
RT_STRING	0xa9dd20	0x69a	data	Dutch	Netherlands	0.3502958579881657
RT_STRING	0xa9e670	0x6d2	data	Polish	Poland	0.3722794959908362
RT_STRING	0xa9eff0	0x59e	data	Portuguese	Brazil	0.3588317107093185
RT_STRING	0xa9f828	0x6f8	data	Romanian	Romania	0.34697309417040356
RT_STRING	0xaa01d0	0x62e	data	Russian	Russia	0.3950695322376738
RT_STRING	0xaa0ac8	0x700	data	Turkish	Turkey	0.34933035714285715
RT_STRING	0xa9c100	0x63c	data	Indonesian	Indonesia	0.3533834586466165
RT_STRING	0xaa14c8	0x678	data	Ukrainian	Ukrain	0.39492753623188404
RT_STRING	0xa9d440	0x648	data	Lithuanian	Lithuania	0.36691542288557216
RT_STRING	0xaa1c78	0x258	data	Chinese	China	0.66
RT_RCDATA	0x3a7e0	0xa5f0d9	Zip archive data, at least v2.0 to extract, compression method=deflate	English	United States	0.9992485046386719
RT_VERSION	0x3a460	0x380	data	English	United States	0.4341517857142857
RT_MANIFEST	0xaa2288	0x27e	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5517241379310345

Imports

DLL	Import
KERNEL32.dll	TerminateProcess, RemoveDirectoryW, GetModuleFileNameW, FindClose, K32GetProcessImageFileNameW, GetUserPreferredUILanguages, OpenProcess, MultiByteToWideChar, CreateThread, K32EnumProcesses, GetCurrentDirectoryW, GetProcAddress, GetCurrentProcessId, GetModuleHandleW, FreeLibrary, CopyFileW, CreateSymbolicLinkW, lstrcmpW, MoveFileW, GetProcessTimes, LoadLibraryExW, WriteConsoleW, SetEndOfFile, WriteFile, HeapSize, FlushFileBuffers, GetProcessHeap, GetStringTypeW, SetStdHandle, FreeEnvironmentStringsW, GetEnvironmentStringsW, WideCharToMultiByte, GetCommandLineW, GetCommandLineA, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, FindFirstFileExW, ReadConsoleW, SetFilePointerEx, GetConsoleMode, GetConsoleOutputCP, FindNextFileW, SetLastError, FindFirstFileW, GetExitCodeProcess, MapViewOfFile, CreateFileMappingW, LocalFree, GetWindowsDirectoryW, FindResourceW, LoadResource, CloseHandle, DeleteFileW, LockResource, GetLastError, Sleep, CreateEventW, FreeResource, UnmapViewOfFile, GetSystemDirectoryW, CreateFileW, LocalAlloc, WaitForSingleObject, GetCurrentProcess, GetFileSizeEx, SizeofResource, ReadFile, HeapReAlloc, CreateDirectoryW, LCMapStringW, FlsFree, FlsSetValue, FlsGetValue, FlsAlloc, GetFileType, HeapFree, HeapAlloc, GetStdHandle, GetModuleHandleExW, ExitProcess, RtlPcToFileHeader, RaiseException, EncodePointer, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, RtlUnwindEx, GetStartupInfoW, IsDebuggerPresent, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead
USER32.dll	ExitWindowsEx, GetWindowThreadProcessId, SetProcessDpiAwarenessContext, SendMessageTimeoutW, MessageBoxW, SendMessageW, LoadStringW, FindWindowW
ADVAPI32.dll	RevertToSelf, EqualSid, RegDeleteKeyW, AllocateAndInitializeSid, RegDeleteKeyValueW, RegCreateKeyExW, CreateProcessWithTokenW, ImpersonateLoggedOnUser, RegDeleteTreeW, RegSetValueExW, FreeSid, CheckTokenMembership, DuplicateTokenEx, RegOpenKeyW, RegQueryValueExW, GetTokenInformation, LookupPrivilegeValueW, AdjustTokenPrivileges, RegCloseKey, OpenProcessToken, RegOpenKeyExW, RegGetValueW
SHELL32.dll	SHGetFolderPathW, ShellExecuteW, SHFileOperationW, CommandLineToArgvW, ShellExecuteExW
ole32.dll	CoInitialize, CoUninitialize, CoCreateInstance
RstrtMgr.DLL	RmRegisterResources, RmGetList, RmStartSession, RmShutdown
VERSION.dll	VerQueryValueW
SHLWAPI.dll	PathRemoveExtensionW, PathRemoveFileSpecW, PathStripPathW, PathFileExistsW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan
German	Germany
English	United States
French	France
Hungarian	Hungary
Japanese	Japan
Korean	North Korea
Korean	South Korea
Dutch	Netherlands
Polish	Poland
Portuguese	Brazil
Romanian	Romania
Russian	Russia
Turkish	Turkey
Indonesian	Indonesia
Ukrainian	Ukrain
Lithuanian	Lithuania
Chinese	China

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T19:43:29.659700+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.24	49790	20.233.83.145	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 19:43:27.352884054 CET	49790	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:27.352917910 CET	443	49790	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:27.353005886 CET	49790	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:27.374886036 CET	49790	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:27.374907017 CET	443	49790	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:28.960077047 CET	443	49790	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:28.961157084 CET	49790	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:28.962199926 CET	49790	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:28.962229967 CET	443	49790	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:28.963490963 CET	443	49790	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:28.963567972 CET	49790	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:28.965950012 CET	49790	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:28.966026068 CET	443	49790	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:28.966095924 CET	49790	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:28.966113091 CET	443	49790	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:28.967360020 CET	49790	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:29.010523081 CET	49790	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:29.051330090 CET	443	49790	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:29.659673929 CET	443	49790	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:29.659833908 CET	443	49790	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:29.659920931 CET	49790	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:29.659982920 CET	443	49790	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:29.660043955 CET	443	49790	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:29.660054922 CET	49790	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:29.660111904 CET	49790	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:29.660727024 CET	49790	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:29.660757065 CET	443	49790	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:29.661313057 CET	49792	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:29.661355972 CET	443	49792	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:29.664129019 CET	49792	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:29.665093899 CET	49792	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:29.665107965 CET	443	49792	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:31.294559002 CET	443	49792	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:31.294641018 CET	49792	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:31.296132088 CET	49792	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:31.296140909 CET	443	49792	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:31.296509981 CET	443	49792	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:31.296559095 CET	49792	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:31.297295094 CET	49792	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:31.297363997 CET	443	49792	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:31.297419071 CET	49792	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:31.297451973 CET	49792	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:31.343324900 CET	443	49792	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:31.975927114 CET	443	49792	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:31.975980043 CET	49792	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:31.976448059 CET	443	49792	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:31.976502895 CET	443	49792	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:31.976541996 CET	49792	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:31.976567030 CET	49792	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:32.808464050 CET	49792	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:32.808489084 CET	443	49792	20.233.83.145	192.168.2.24
Dec 19, 2024 19:43:32.808501959 CET	49792	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:32.808686972 CET	49792	443	192.168.2.24	20.233.83.145
Dec 19, 2024 19:43:32.947065115 CET	49794	443	192.168.2.24	185.199.110.133
Dec 19, 2024 19:43:32.947096109 CET	443	49794	185.199.110.133	192.168.2.24
Dec 19, 2024 19:43:32.948184013 CET	49794	443	192.168.2.24	185.199.110.133
Dec 19, 2024 19:43:32.949090958 CET	49794	443	192.168.2.24	185.199.110.133
Dec 19, 2024 19:43:32.949111938 CET	443	49794	185.199.110.133	192.168.2.24
Dec 19, 2024 19:43:34.306478024 CET	443	49794	185.199.110.133	192.168.2.24
Dec 19, 2024 19:43:34.309084892 CET	49794	443	192.168.2.24	185.199.110.133
Dec 19, 2024 19:43:34.310456038 CET	49794	443	192.168.2.24	185.199.110.133
Dec 19, 2024 19:43:34.310465097 CET	443	49794	185.199.110.133	192.168.2.24
Dec 19, 2024 19:43:34.312072992 CET	443	49794	185.199.110.133	192.168.2.24
Dec 19, 2024 19:43:34.312146902 CET	49794	443	192.168.2.24	185.199.110.133
Dec 19, 2024 19:43:36.061237097 CET	49794	443	192.168.2.24	185.199.110.133
Dec 19, 2024 19:43:36.061451912 CET	443	49794	185.199.110.133	192.168.2.24
Dec 19, 2024 19:43:36.071146011 CET	49794	443	192.168.2.24	185.199.110.133
Dec 19, 2024 19:43:36.083266020 CET	49794	443	192.168.2.24	185.199.110.133
Dec 19, 2024 19:43:36.083276987 CET	443	49794	185.199.110.133	192.168.2.24
Dec 19, 2024 19:43:36.084228992 CET	49794	443	192.168.2.24	185.199.110.133
Dec 19, 2024 19:43:36.422583103 CET	443	49794	185.199.110.133	192.168.2.24
Dec 19, 2024 19:43:36.422640085 CET	443	49794	185.199.110.133	192.168.2.24
Dec 19, 2024 19:43:36.422960043 CET	443	49794	185.199.110.133	192.168.2.24
Dec 19, 2024 19:43:36.423306942 CET	443	49794	185.199.110.133	192.168.2.24
Dec 19, 2024 19:43:36.429371119 CET	49794	443	192.168.2.24	185.199.110.133
Dec 19, 2024 19:43:36.429388046 CET	443	49794	185.199.110.133	192.168.2.24
Dec 19, 2024 19:43:36.429801941 CET	49794	443	192.168.2.24	185.199.110.133
Dec 19, 2024 19:43:36.429979086 CET	443	49794	185.199.110.133	192.168.2.24
Dec 19, 2024 19:43:36.430605888 CET	49794	443	192.168.2.24	185.199.110.133
Dec 19, 2024 19:43:36.430625916 CET	49794	443	192.168.2.24	185.199.110.133

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 19:43:07.142431021 CET	61088	53	192.168.2.24	1.1.1.1
Dec 19, 2024 19:43:09.754640102 CET	61088	53	192.168.2.24	1.1.1.1
Dec 19, 2024 19:43:27.196014881 CET	55045	53	192.168.2.24	1.1.1.1
Dec 19, 2024 19:43:27.336653948 CET	53	55045	1.1.1.1	192.168.2.24
Dec 19, 2024 19:43:32.808953047 CET	55045	53	192.168.2.24	1.1.1.1
Dec 19, 2024 19:43:32.946100950 CET	53	55045	1.1.1.1	192.168.2.24

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 19:43:07.142431021 CET	192.168.2.24	1.1.1.1	0x7d38	Standard query (0)	srtb.msn.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 19:43:09.754640102 CET	192.168.2.24	1.1.1.1	0xe9eb	Standard query (0)	tse1.mm.bing.net	A (IP address)	IN (0x0001)	false
Dec 19, 2024 19:43:27.196014881 CET	192.168.2.24	1.1.1.1	0x1261	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 19:43:32.808953047 CET	192.168.2.24	1.1.1.1	0xdb76	Standard query (0)	objects.githubusercontent.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 19:43:07.279350996 CET	1.1.1.1	192.168.2.24	0x7d38	No error (0)	srtb.msn.com	www.msn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 19:43:07.279350996 CET	1.1.1.1	192.168.2.24	0x7d38	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 19:43:09.892512083 CET	1.1.1.1	192.168.2.24	0xe9eb	No error (0)	tse1.mm.bing.net	mm-mm.bing.net.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 19:43:09.892512083 CET	1.1.1.1	192.168.2.24	0xe9eb	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Dec 19, 2024 19:43:09.892512083 CET	1.1.1.1	192.168.2.24	0xe9eb	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Dec 19, 2024 19:43:27.336653948 CET	1.1.1.1	192.168.2.24	0x1261	No error (0)	github.com		20.233.83.145	A (IP address)	IN (0x0001)	false
Dec 19, 2024 19:43:32.946100950 CET	1.1.1.1	192.168.2.24	0xdb76	No error (0)	objects.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Dec 19, 2024 19:43:32.946100950 CET	1.1.1.1	192.168.2.24	0xdb76	No error (0)	objects.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Dec 19, 2024 19:43:32.946100950 CET	1.1.1.1	192.168.2.24	0xdb76	No error (0)	objects.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Dec 19, 2024 19:43:32.946100950 CET	1.1.1.1	192.168.2.24	0xdb76	No error (0)	objects.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

github.com

objects.githubusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.24	49790	20.233.83.145	443	9012	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 18:43:29 UTC	126	OUT	GET /valinet/ExplorerPatcher/releases/latest/download/ep_setup.exe HTTP/1.1 User-Agent: ExplorerPatcher Host: github.com
2024-12-19 18:43:29 UTC	547	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Thu, 19 Dec 2024 18:42:08 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Location: https://github.com/valinet/ExplorerPatcher/releases/download/22621.4317.67.1_b93337a/ep_setup.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-12-19 18:43:29 UTC	3283	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co
2024-12-19 18:43:29 UTC	777	IN	Data Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 67 68 5f 73 65 73 73 3d 78 43 75 59 6f 62 73 6d 77 79 49 67 53 76 4a 39 36 44 62 4f 31 33 66 6f 6d 4a 73 35 74 5a 55 53 45 56 68 6d 41 6b 79 6f 68 6a 59 41 25 32 42 6b 25 32 46 72 42 58 36 25 32 46 59 43 62 74 68 78 74 78 6b 51 70 52 4d 77 73 62 41 6c 50 68 38 54 4b 39 4c 43 51 4c 75 7a 46 73 4c 64 73 75 68 50 5a 25 32 46 69 58 64 50 71 56 25 32 42 25 32 42 61 47 54 78 49 25 32 46 4f 71 6c 53 74 68 50 50 68 6d 41 78 79 53 34 37 39 33 72 4b 57 39 77 6c 51 36 57 66 4c 25 32 42 4f 39 36 35 34 63 51 78 44 37 4f 76 33 38 53 50 57 6d 64 30 53 59 38 62 63 33 71 49 68 4c 39 35 6b 6d 58 50 62 61 6b 68 43 6b 58 4e 6c 4d 7a 6f 6c 77 79 4d 44 42 59 59 74 32 55 6e 72 65 50 66 55 49 4f 54 25 32 42 72 48 4f 4c 66 52 70 6e 43 4a 66 Data Ascii: Set-Cookie: _gh_sess=xCuYobsmwyIgSvJ96DbO13fomJs5tZUSEVhmAkyohjYA%2Bk%2FrBX6%2FYCbthxtxkQpRMwsbAlPh8TK9LCQLuzFsLdsuhPZ%2FiXdPqV%2B%2BaGTxI%2FOqlSthPPhmAxyS4793rKW9wlQ6WfL%2BO9654cQxD7Ov38SPWmd0SY8bc3qIhL95kmXPbakhCkXNlMzolwyMDBYYt2UnrePfUIOT%2BrHOLfRpnCJf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.24	49792	20.233.83.145	443	9012	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 18:43:31 UTC	167	OUT	GET /valinet/ExplorerPatcher/releases/download/22621.4317.67.1_b93337a/ep_setup.exe HTTP/1.1 User-Agent: ExplorerPatcher Host: github.com Connection: Keep-Alive
2024-12-19 18:43:31 UTC	959	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Thu, 19 Dec 2024 18:42:09 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/394318710/5e5bb508-cbdc-44fb-9830-5b535df6ab52?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241219%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241219T184209Z&X-Amz-Expires=300&X-Amz-Signature=6d698d818240e4899e410aa379d337e10eebc51c67064cb29ff3b029bc673213&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dep_setup.exe&response-content-type=application%2Foctet-stream Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-12-19 18:43:31 UTC	3380	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.24	49794	185.199.110.133	443	9012	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 18:43:36 UTC	579	OUT	GET /github-production-release-asset-2e65be/394318710/5e5bb508-cbdc-44fb-9830-5b535df6ab52?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241219%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241219T184209Z&X-Amz-Expires=300&X-Amz-Signature=6d698d818240e4899e410aa379d337e10eebc51c67064cb29ff3b029bc673213&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dep_setup.exe&response-content-type=application%2Foctet-stream HTTP/1.1 User-Agent: ExplorerPatcher Connection: Keep-Alive Host: objects.githubusercontent.com
2024-12-19 18:43:36 UTC	802	IN	HTTP/1.1 200 OK Connection: close Content-Length: 11143168 Content-Type: application/octet-stream Last-Modified: Sat, 02 Nov 2024 13:44:53 GMT ETag: "0x8DCFB44880C75E8" Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 8f07ddc9-a01e-000c-442d-2d765d000000 x-ms-version: 2024-08-04 x-ms-creation-time: Sat, 02 Nov 2024 13:44:53 GMT x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob Content-Disposition: attachment; filename=ep_setup.exe x-ms-server-encrypted: true Via: 1.1 varnish, 1.1 varnish Fastly-Restarts: 1 Accept-Ranges: bytes Age: 6416 Date: Thu, 19 Dec 2024 18:43:36 GMT X-Served-By: cache-iad-kiad7000060-IAD, cache-nyc-kteb1890022-NYC X-Cache: HIT, HIT X-Cache-Hits: 111411, 0 X-Timer: S1734633816.233070,VS0,VE1
2024-12-19 18:43:36 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 32 32 36 32 32 2e 34 33 31 37 2e 36 37 2e 31 2e 38 62 66 63 61 37 31 61 64 64 39 36 64 33 64 65 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c7 20 75 4f 83 41 1b 1c 83 41 1b 1c 83 41 1b 1c c8 39 18 1d 86 41 1b 1c c8 39 1e 1d 14 41 1b 1c c8 c4 1f 1d 85 41 1b 1c 93 c5 18 1d 8a 41 1b 1c 93 c5 1f 1d 93 41 1b 1c 93 c5 1e 1d ab 41 1b 1c c8 39 1f 1d 8c 41 1b 1c c8 39 1d 1d 82 41 1b 1c c8 39 1a 1d 96 41 1b 1c 83 41 1a 1c 4e 41 1b 1c c8 c4 13 1d 87 41 1b 1c c8 c4 e4 1c 82 41 1b 1c 83 41 8c 1c 91 41 1b 1c c8 c4 19 1d 82 41 1b Data Ascii: MZ@!L!22622.4317.67.1.8bfca71add96d3deS mode.$ uOAAA9A9AAAAA9A9A9AANAAAAAA
2024-12-19 18:43:36 UTC	1378	IN	Data Raw: 20 ba 26 00 00 00 33 c9 ff 15 c8 52 02 00 4c 8d 05 a9 f7 02 00 ba 04 01 00 00 48 8d 8d e0 01 00 00 e8 24 3f 01 00 4c 8d 05 b9 f7 02 00 ba 04 01 00 00 48 8d 8d e0 01 00 00 e8 0c 3f 01 00 ba 04 01 00 00 48 8d 8d 00 06 00 00 ff 15 96 50 02 00 4c 8d 05 a7 f7 02 00 ba 04 01 00 00 48 8d 8d 00 06 00 00 e8 e2 3e 01 00 ba 04 01 00 00 48 8d 8d 10 08 00 00 ff 15 c4 50 02 00 4c 8d 05 95 f7 02 00 ba 04 01 00 00 48 8d 8d 10 08 00 00 e8 b8 3e 01 00 48 8d 0d 9d f7 02 00 83 fb 03 48 8d 05 a3 f7 02 00 ba 28 0a 00 00 48 0f 44 c1 4c 8d 4d d0 48 89 44 24 40 4c 8d 05 72 f8 02 00 48 8d 45 d0 48 89 44 24 38 48 8d 8d 20 0a 00 00 48 8d 45 d0 48 89 44 24 30 48 8d 05 82 f7 02 00 48 89 44 24 28 48 8d 85 e0 01 00 00 48 89 44 24 20 e8 1c fe ff ff 48 8d 45 d0 ba 28 0a 00 00 4c 8d 4d d0 Data Ascii: &3RLH$?LH?HPLH>HPLH>HH(HDLMHD$@LrHEHD$8H HEHD$0HHD$(HHD$ HE(LM
2024-12-19 18:43:36 UTC	1378	IN	Data Raw: 8b 0d aa 53 03 00 48 8d 44 24 54 4c 8d 4c 24 70 48 89 44 24 20 4c 8d 44 24 50 c7 44 24 50 10 00 00 00 48 8d 54 24 58 ff 15 27 4d 02 00 83 7c 24 54 00 75 14 8b 0d 76 53 03 00 45 33 c0 ba 01 00 00 00 ff 15 1c 4d 02 00 33 c0 48 8b 8c 24 30 2a 00 00 48 33 cc e8 e2 6f 00 00 48 81 c4 48 2a 00 00 c3 cc cc cc cc cc cc cc cc cc cc 40 55 56 57 41 56 41 57 48 8d ac 24 40 fa ff ff 48 81 ec c0 06 00 00 48 8b 05 b2 48 03 00 48 33 c4 48 89 85 b0 05 00 00 4d 8b f0 48 8b f2 8b f9 33 d2 41 b8 04 01 00 00 48 8d 8d a0 03 00 00 e8 ac 38 02 00 33 d2 48 8d 8d 90 01 00 00 41 b8 04 01 00 00 e8 98 38 02 00 ba 04 01 00 00 48 8d 8d 90 01 00 00 ff 15 06 4b 02 00 4c 8d 05 b7 f8 02 00 ba 04 01 00 00 48 8d 8d 90 01 00 00 e8 fa 38 01 00 45 33 ff 85 ff 74 7f 33 d2 48 8d 8d 90 01 00 00 41 Data Ascii: SHD$TLL$pHD$ LD$PD$PHT$X'M\|$TuvSE3M3H$0H3oHH@UVWAVAWH$@HHHH3HMH3AH83HA8HKLH8E3t3HA
2024-12-19 18:43:36 UTC	1378	IN	Data Raw: 41 b9 01 00 00 00 48 89 44 24 20 45 33 c0 ff 15 0e 44 02 00 8b d8 85 c0 0f 85 b6 02 00 00 48 8b 4d cf 48 8d 45 df c7 44 24 28 04 00 00 00 48 8d 15 dd f5 02 00 41 b9 04 00 00 00 48 89 44 24 20 45 33 c0 c7 45 df 01 00 00 00 ff 15 d2 43 02 00 8b d8 85 c0 0f 85 7a 02 00 00 48 8b 4d cf 48 8d 45 df c7 44 24 28 04 00 00 00 48 8d 15 b9 f5 02 00 41 b9 04 00 00 00 48 89 44 24 20 45 33 c0 c7 45 df 01 00 00 00 ff 15 96 43 02 00 8b d8 85 c0 0f 85 3e 02 00 00 49 8d 4d 02 ff 15 aa 47 02 00 4c 8d 05 9b f5 02 00 ba 02 01 00 00 49 8d 4d 02 e8 d1 33 01 00 33 d2 49 8d 4d 02 41 b8 02 00 00 00 ff 15 6b 44 02 00 48 89 45 c7 48 8b f8 48 85 c0 0f 84 a2 01 00 00 48 89 b4 24 f0 00 00 00 ba 01 00 00 00 41 b8 10 00 00 00 4c 89 b4 24 08 01 00 00 48 8b c8 ff 15 2f 45 02 00 48 8b d0 48 Data Ascii: AHD$ E3DHMHED$(HAHD$ E3ECzHMHED$(HAHD$ E3EC>IMGLIM33IMAkDHEHHH$AL$H/EHH

Target ID:	1
Start time:	13:43:11
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\ep_setup.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\ep_setup.exe"
Imagebase:	0x7ff611e90000
File size:	11'143'168 bytes
MD5 hash:	F164888A6FBC646B093F6AF6663F4E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:43:12
Start date:	19/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\taskkill.exe" /f /im explorer.exe
Imagebase:	0x7ff7026a0000
File size:	114'688 bytes
MD5 hash:	050ED22BB515A81ED6FC73D042CE5DB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:43:12
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6038b0000
File size:	1'040'384 bytes
MD5 hash:	9698384842DA735D80D278A427A229AB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:43:13
Start date:	19/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
Imagebase:	0x7ff719cb0000
File size:	98'304 bytes
MD5 hash:	FF2A4319FA5531F0D7B98DBBA9ABBD4A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:43:13
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6038b0000
File size:	1'040'384 bytes
MD5 hash:	9698384842DA735D80D278A427A229AB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:43:16
Start date:	19/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
Imagebase:	0x7ff719cb0000
File size:	98'304 bytes
MD5 hash:	FF2A4319FA5531F0D7B98DBBA9ABBD4A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:43:16
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6038b0000
File size:	1'040'384 bytes
MD5 hash:	9698384842DA735D80D278A427A229AB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:43:16
Start date:	19/12/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"
Imagebase:	0x7ff7fc750000
File size:	45'056 bytes
MD5 hash:	AF0CDEF5F6ECB9B8EBEF4E480EBAAA5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:43:16
Start date:	19/12/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"
Imagebase:	0x7ff7fc750000
File size:	45'056 bytes
MD5 hash:	AF0CDEF5F6ECB9B8EBEF4E480EBAAA5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:43:17
Start date:	19/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\explorer.exe"
Imagebase:	0x7ff63b640000
File size:	5'583'864 bytes
MD5 hash:	E2D1F700066D39814081317462A0FD74
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:43:19
Start date:	19/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\explorer.exe" /NoUACCheck
Imagebase:	0x7ff63b640000
File size:	5'583'864 bytes
MD5 hash:	E2D1F700066D39814081317462A0FD74
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	13:43:25
Start date:	19/12/2024
Path:	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.30502.30.0_x64__cw5n1h2txyewy\WidgetBoard.exe" -RegisterProcessAsComServer -ServerName:Microsoft.Windows.WidgetBoardServer
Imagebase:	0x7ff7ca420000
File size:	60'336 bytes
MD5 hash:	FE1C0C15EF5C6C2B0A1508BF23EAD6CE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FF611E98E6C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF611E98E98
GetCurrentThreadId.KERNEL32 ref: 00007FF611E98EA6
GetCurrentProcessId.KERNEL32 ref: 00007FF611E98EB2
QueryPerformanceCounter.KERNEL32 ref: 00007FF611E98EC2

Memory Dump Source

Source File: 00000001.00000002.11856337533.00007FF611E91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611E90000, based on PE: true

Associated: 00000001.00000002.11856318874.00007FF611E90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.11856370316.00007FF611EB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.11856400426.00007FF611EC6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.11856426487.00007FF611EC8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.11856426487.00007FF6128C8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff611e90000_ep_setup.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 68e3125686cfe63efa0959c9405ff9fad71e5682ea60b199cc3bad7d618fc792
Instruction ID: bd8ed1ef6361adba409fbe224b39bfa415f4eeb410fc96b89719b70ba92813fc
Opcode Fuzzy Hash: 68e3125686cfe63efa0959c9405ff9fad71e5682ea60b199cc3bad7d618fc792
Instruction Fuzzy Hash: 44117322B14F0589EB00CFA0E8552BA33B8F75DB68F040D31DA6D82764DF3CD1548740

Analysis Process: explorer.exePID: 8892, Parent PID: 8320COMMON

Executed Functions

Function 00007FFD6566D980 Relevance: 358.4, APIs: 83, Strings: 121, Instructions: 1429libraryloaderthreadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FFD6566D9C5

Part of subcall function 00007FFD656A7CA8: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7CCE

CreateEventW.KERNEL32 ref: 00007FFD6566DA26
CreateEventW.KERNEL32 ref: 00007FFD6566DA3D
CreateEventW.KERNEL32 ref: 00007FFD6566DA8C
CreateThread.KERNELBASE ref: 00007FFD6566DE47
CloseHandle.KERNEL32 ref: 00007FFD6566DE5F
SHGetFolderPathW.SHELL32 ref: 00007FFD6566DF53
PathFileExistsW.KERNELBASE ref: 00007FFD6566DF78
CreateDirectoryW.KERNELBASE ref: 00007FFD6566DF8B
CreateMutexExW.KERNELBASE ref: 00007FFD6566E07A
CreateEventW.KERNEL32 ref: 00007FFD6566E08A
CreateEventW.KERNEL32 ref: 00007FFD6566E0A1
CreateThread.KERNELBASE ref: 00007FFD6566E0C6
CreateThread.KERNELBASE ref: 00007FFD6566E161
LoadLibraryW.KERNEL32 ref: 00007FFD6566E16E
GetProcAddress.KERNEL32 ref: 00007FFD6566E181
GetProcAddress.KERNEL32 ref: 00007FFD6566E198
GetProcAddress.KERNEL32 ref: 00007FFD6566E1A8
GetProcAddress.KERNEL32 ref: 00007FFD6566E1B8
GetModuleHandleW.KERNEL32 ref: 00007FFD6566E217
GetCurrentProcess.KERNEL32 ref: 00007FFD6566E220
K32GetModuleInformation.KERNEL32 ref: 00007FFD6566E237
GetModuleHandleW.KERNEL32 ref: 00007FFD6566E2B5
GetProcAddress.KERNEL32 ref: 00007FFD6566E2C3
IsOS.SHLWAPI ref: 00007FFD6566E403
GetCurrentProcess.KERNEL32 ref: 00007FFD6566E505
K32GetModuleInformation.KERNEL32 ref: 00007FFD6566E51C
LoadLibraryExW.KERNELBASE ref: 00007FFD6566E60B
LoadLibraryW.KERNEL32 ref: 00007FFD6566E864
GetProcAddress.KERNEL32 ref: 00007FFD6566E872
FreeLibraryAndExitThread.KERNEL32 ref: 00007FFD6566E8C0
FreeLibraryAndExitThread.KERNEL32 ref: 00007FFD6566E8FC
LoadLibraryW.KERNEL32 ref: 00007FFD6566E90A
GetProcAddress.KERNEL32 ref: 00007FFD6566E91B
GetProcAddress.KERNEL32 ref: 00007FFD6566E929
GetProcAddress.KERNEL32 ref: 00007FFD6566E937
GetProcAddress.KERNEL32 ref: 00007FFD6566E945
GetProcAddress.KERNEL32 ref: 00007FFD6566E95A
GetProcAddress.KERNEL32 ref: 00007FFD6566E96F
GetProcAddress.KERNEL32 ref: 00007FFD6566E984
GetProcAddress.KERNEL32 ref: 00007FFD6566E999
GetProcAddress.KERNEL32 ref: 00007FFD6566E9A7
GetProcAddress.KERNEL32 ref: 00007FFD6566E9B5
LoadLibraryW.KERNEL32 ref: 00007FFD6566EAAC
LoadLibraryExW.KERNELBASE ref: 00007FFD6566EB80
LoadLibraryExW.KERNELBASE ref: 00007FFD6566EC06
LoadLibraryExW.KERNELBASE ref: 00007FFD6566ECFE
LoadLibraryExW.KERNELBASE ref: 00007FFD6566ED40
GetModuleHandleW.KERNEL32 ref: 00007FFD6566ED6B
GetProcAddress.KERNEL32 ref: 00007FFD6566ED89
SHELL32_Create_IEnumUICommand.SHELL32 ref: 00007FFD6566EDC5
VirtualProtect.KERNELBASE ref: 00007FFD6566EE49
VirtualProtect.KERNELBASE ref: 00007FFD6566EE88
VirtualProtect.KERNELBASE ref: 00007FFD6566EEF2
VirtualProtect.KERNELBASE ref: 00007FFD6566EF24
LoadLibraryW.KERNEL32 ref: 00007FFD6566F01C
GetProcAddress.KERNEL32 ref: 00007FFD6566F033
LoadLibraryExW.KERNELBASE ref: 00007FFD6566F0A0
GetModuleHandleExW.KERNEL32 ref: 00007FFD6566F0C9
GetCurrentProcess.KERNEL32 ref: 00007FFD6566F0DB
K32GetModuleInformation.KERNEL32 ref: 00007FFD6566F0F4
VirtualProtect.KERNELBASE ref: 00007FFD6566F13B
VirtualProtect.KERNELBASE ref: 00007FFD6566F15F
GetCurrentProcess.KERNEL32 ref: 00007FFD6566F1A3
K32GetModuleInformation.KERNEL32 ref: 00007FFD6566F1BA
LoadLibraryExW.KERNELBASE ref: 00007FFD6566F215
LoadLibraryExW.KERNELBASE ref: 00007FFD6566F22A
GetProcAddress.KERNEL32 ref: 00007FFD6566F23F
LoadLibraryExW.KERNELBASE ref: 00007FFD6566F275
IsOS.SHLWAPI ref: 00007FFD6566F288
FreeLibraryAndExitThread.KERNEL32 ref: 00007FFD6566F2F2
GetProcAddress.KERNEL32 ref: 00007FFD6566EEA7

Part of subcall function 00007FFD65652890: GetModuleHandleW.KERNEL32 ref: 00007FFD656528AF
Part of subcall function 00007FFD65652890: GetProcAddress.KERNEL32 ref: 00007FFD656528C8
Part of subcall function 00007FFD65652890: RegOpenKeyExW.KERNELBASE ref: 00007FFD6565293F
Part of subcall function 00007FFD65652890: RegQueryValueExW.KERNELBASE ref: 00007FFD6565296F

CreateThread.KERNELBASE ref: 00007FFD6566F354
CreateThread.KERNELBASE ref: 00007FFD6566F372
CreateThread.KERNELBASE ref: 00007FFD6566F39C

Part of subcall function 00007FFD6565D290: GetModuleHandleExW.KERNEL32 ref: 00007FFD6565D2C6
Part of subcall function 00007FFD6565D290: ImageDirectoryEntryToDataEx.DBGHELP ref: 00007FFD6565D2F9
Part of subcall function 00007FFD6565D290: FreeLibrary.KERNEL32 ref: 00007FFD6565D32F

Part of subcall function 00007FFD6565D290: FreeLibrary.KERNEL32 ref: 00007FFD6565D3B9
Part of subcall function 00007FFD6565D290: VirtualQuery.KERNEL32 ref: 00007FFD6565D3F8
Part of subcall function 00007FFD6565D290: VirtualProtect.KERNELBASE ref: 00007FFD6565D413
Part of subcall function 00007FFD6565D290: VirtualProtect.KERNEL32 ref: 00007FFD6565D43B
Part of subcall function 00007FFD6565D290: FreeLibrary.KERNEL32 ref: 00007FFD6565D446

CreateThread.KERNEL32 ref: 00007FFD6566F422
CreateThread.KERNELBASE ref: 00007FFD6566F443
GetWindowsDirectoryW.KERNEL32 ref: 00007FFD6566F455
FindFirstFileW.KERNELBASE ref: 00007FFD6566F486
FindClose.KERNEL32 ref: 00007FFD6566F495
LoadLibraryW.KERNEL32 ref: 00007FFD6566F4A2
GetProcAddress.KERNEL32 ref: 00007FFD6566F4C9
GetLastError.KERNEL32 ref: 00007FFD6566F4F3

Strings

GetThemeMetric, xrefs: 00007FFD6566E678
ITrayUIHost = %llX, xrefs: 00007FFD6566E7F4
bthprops.cpl, xrefs: 00007FFD6566ECF7
Setup twinui functions done, xrefs: 00007FFD6566EBF3
API-MS-WIN-NTUSER-RECTANGLE-L1-1-0.DLL, xrefs: 00007FFD6566E6E3
ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll, xrefs: 00007FFD6566E307, 00007FFD6566E45F, 00007FFD6566F515
Attempting to download symbol data; for now, the program may have limited functionality., xrefs: 00007FFD6566E122
RegisterHotKey, xrefs: 00007FFD6566EBDD, 00007FFD6566F3BC
Setup windows.storage functions done, xrefs: 00007FFD6566F062
[Extra] Found library: %p., xrefs: 00007FFD6566F4B3
Loaded symbols, xrefs: 00007FFD6566E10B
SetRect, xrefs: 00007FFD6566E6DC, 00007FFD6566EA72
Failed to install hooks. rv = %d, xrefs: 00007FFD6566DE99
api-ms-win-core-largeinteger-l1-1-0.dll, xrefs: 00007FFD6566F2BC
[Extra] Finished running entry point., xrefs: 00007FFD6566F4E5
Setup stobject functions done, xrefs: 00007FFD6566ECEB
SendMessageW, xrefs: 00007FFD6566E300, 00007FFD6566EA55
GetThemeMargins, xrefs: 00007FFD6566E65B
MulDiv, xrefs: 00007FFD6566F2B5
SLGetWindowsInformationDWORD, xrefs: 00007FFD6566F235, 00007FFD6566F258
DwmUpdateThumbnailProperties, xrefs: 00007FFD6566E722
[IME] Context menu patch status: %d, xrefs: 00007FFD6566F16A
api-ms-win-core-com-l1-1-0.dll, xrefs: 00007FFD6566E6C6, 00007FFD6566EC3A
api-ms-win-shcore-sysinfo-l1-1-0.dll, xrefs: 00007FFD6566E41B
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer, xrefs: 00007FFD6566DD5F, 00007FFD6566DDF6
SOFTWARE\Microsoft\Windows\CurrentVersion\Search, xrefs: 00007FFD6566DC79
TrackPopupMenuEx, xrefs: 00007FFD6566E4E8, 00007FFD6566EA8F, 00007FFD6566EC94, 00007FFD6566ECB8, 00007FFD6566ED0B, 00007FFD6566F186
Open Start on monitor thread, xrefs: 00007FFD6566F378
StartTileData.dll, xrefs: 00007FFD6566E604
DrawThemeTextEx, xrefs: 00007FFD6566E63E
dwmapi.dll, xrefs: 00007FFD6566E729
explorer.exe!TrayUI_CreateInstance() = %llX, xrefs: 00007FFD6566E80F
[Extra] LoadLibraryW failed with 0x%x., xrefs: 00007FFD6566F4FB
GetClientRect, xrefs: 00007FFD6566F50E, 00007FFD6566F530
Setup bthprops functions done, xrefs: 00007FFD6566ED21
SOFTWARE\Microsoft\TabletTip\1.7, xrefs: 00007FFD6566DD09
ep_extra_EntryPoint, xrefs: 00007FFD6566F4BF
\ExplorerPatcher, xrefs: 00007FFD6566DF59
RegGetValueW, xrefs: 00007FFD6566E357, 00007FFD6566EC16
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FFD6566DC2D, 00007FFD6566DDB2
ext-ms-win-security-slc-l1-1-0.dll, xrefs: 00007FFD6566F25F
PeopleBand.dll, xrefs: 00007FFD6566F26E
CoCreateInstance, xrefs: 00007FFD6566E6BF, 00007FFD6566EC33
LoadMenuW, xrefs: 00007FFD6566E3CB, 00007FFD6566EA38
Setup inputswitch functions done, xrefs: 00007FFD6566F202
shcore.dll, xrefs: 00007FFD6566E85D
xx??x??xxx????xx, xrefs: 00007FFD6566F102
RegSetValueExW, xrefs: 00007FFD6566E374, 00007FFD6566EF7F
Setup combase functions done, xrefs: 00007FFD6566EB6D
CloseThemeData, xrefs: 00007FFD6566E5A5
Setup uxtheme functions done, xrefs: 00007FFD6566E9E7
ext-ms-win-shell-exports-internal-l1-1-0.dll, xrefs: 00007FFD6566F053
[Extra] Running entry point..., xrefs: 00007FFD6566F4D7
SHLWAPI.dll, xrefs: 00007FFD6566F29F
CreateWindowInBand, xrefs: 00007FFD6566E177
USER32.DLL, xrefs: 00007FFD6566E700
windowsudk.shellcommon.dll, xrefs: 00007FFD6566F20E
QISearch, xrefs: 00007FFD6566E3E8
combase.dll, xrefs: 00007FFD6566EAA5
TileWindows, xrefs: 00007FFD6566E475
api-ms-win-core-winrt-l1-1-0.dll, xrefs: 00007FFD6566E61F
CascadeWindows, xrefs: 00007FFD6566E492
api-ms-win-core-registry-l1-1-0.dll, xrefs: 00007FFD6566EC1D
GetSystemMetrics, xrefs: 00007FFD6566E5E9, 00007FFD6566EFEF
stobject.dll, xrefs: 00007FFD6566EBFF
API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL, xrefs: 00007FFD6566E35E, 00007FFD6566E37B, 00007FFD6566E398, 00007FFD6566E4B6, 00007FFD6566EF65, 00007FFD6566EF86
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage, xrefs: 00007FFD6566DB2E
GetWindowBand, xrefs: 00007FFD6566E18E
DllGetClassObject, xrefs: 00007FFD6566EE99
SHGetValueW, xrefs: 00007FFD6566E3AE
LoadLibraryExW, xrefs: 00007FFD6566EB0A, 00007FFD6566EB57
RegCreateKeyExW, xrefs: 00007FFD6566E391, 00007FFD6566EF5E
EP Service Window thread, xrefs: 00007FFD6566F3A9
CreateWindowExW, xrefs: 00007FFD6566E458
api-ms-win-core-shlwapi-obsolete-l1-1-0.dll, xrefs: 00007FFD6566E3EF
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MultitaskingView\AltTabViewHost, xrefs: 00007FFD6566DBDA
Running on Windows %d, OS Build %d.%d.%d.%d., xrefs: 00007FFD6566DF2E
shell32.dll, xrefs: 00007FFD6566ED64
[TB] Unsupported build, xrefs: 00007FFD6566E282
RoGetActivationFactory, xrefs: 00007FFD6566E618
Software\ExplorerPatcher, xrefs: 00007FFD6566DAE6
xxx????xxx????x????xx, xrefs: 00007FFD6566E77D
pnidui.dll, xrefs: 00007FFD6566ED39
USER32.dll, xrefs: 00007FFD6566F537
uxtheme.dll, xrefs: 00007FFD6566E903
Installed hooks., xrefs: 00007FFD6566F2F9
uxtheme.dll, xrefs: 00007FFD6566E572, 00007FFD6566E58F, 00007FFD6566E5AC, 00007FFD6566E645, 00007FFD6566E662, 00007FFD6566E67F, 00007FFD6566E9D8
SHELL32_CanDisplayWin8CopyDialog, xrefs: 00007FFD6566F025, 00007FFD6566F04C
Setup shell32 functions done, xrefs: 00007FFD6566F009
InputSwitch.dll, xrefs: 00007FFD6566F099, 00007FFD6566F0C0
\ep_extra.dll, xrefs: 00007FFD6566F463
ShellExecuteW, xrefs: 00007FFD6566E31D
Global\EP_Weather_Killswitch_{A6EA9C2D-4982-4827-9204-0AC532959F6D}, xrefs: 00007FFD6566E034
xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xxx????xxx, xrefs: 00007FFD6566E52A, 00007FFD6566F1C8
OpenThemeDataForDpi, xrefs: 00007FFD6566E56B
windows.storage.dll, xrefs: 00007FFD6566F015
shell32.dll, xrefs: 00007FFD6566E324, 00007FFD6566E341, 00007FFD6566E4D2
Initialized taskbar centering module., xrefs: 00007FFD6566F562
SHCORE.dll, xrefs: 00007FFD6566F553
IsOS, xrefs: 00007FFD6566E414
Setup peopleband functions done, xrefs: 00007FFD6566F2CB
api-ms-win-ntuser-sysparams-l1-1-0.dll, xrefs: 00007FFD6566E5F0
user32.dll, xrefs: 00007FFD6566E2EA, 00007FFD6566E3D2, 00007FFD6566E47C, 00007FFD6566E499, 00007FFD6566E4EF, 00007FFD6566E69C, 00007FFD6566E74F, 00007FFD6566EA22, 00007FFD6566EA3F, 00007FFD6566EA5C, 00007FFD6566EA79, 00007FFD6566EA96, 00007FFD6566EBBE, 00007FFD6566EBE4, 00007FFD6566EC72, 00007FFD6566EC9B, 00007FFD6566ECBF, 00007FFD6566ED12, 00007FFD6566EFA7, 00007FFD6566EFF6, 00007FFD6566F18D, 00007FFD6566F3C3
slc.dll, xrefs: 00007FFD6566F223
Software\ExplorerPatcher\sws, xrefs: 00007FFD6566DB84
DeleteMenu, xrefs: 00007FFD6566E6F9, 00007FFD6566EA1B, 00007FFD6566EFA0
win32u.dll, xrefs: 00007FFD6566E1FA
TrackPopupMenu, xrefs: 00007FFD6566EBB7, 00007FFD6566EC6B
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\People, xrefs: 00007FFD6566DCC1
DrawThemeBackground, xrefs: 00007FFD6566E588
user32.dll, xrefs: 00007FFD6566E167, 00007FFD6566E2AE
Setup explorer functions done, xrefs: 00007FFD6566E87F
SetWindowBand, xrefs: 00007FFD6566E19E
RegOpenKeyExW, xrefs: 00007FFD6566E4AF
twinui.dll, xrefs: 00007FFD6566EB79
API-MS-WIN-SHCORE-REGISTRY-L1-1-0.DLL, xrefs: 00007FFD6566E3B5
api-ms-win-core-libraryloader-l1-2-0.dll, xrefs: 00007FFD6566EB11, 00007FFD6566EB5E
NtUserFindWindowEx, xrefs: 00007FFD6566E1F3
Setup user32 functions done, xrefs: 00007FFD6566E209
ShellExecuteExW, xrefs: 00007FFD6566E33A
SetWindowCompositionAttribute, xrefs: 00007FFD6566E1AE, 00007FFD6566E695, 00007FFD6566E748

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: AddressProc$Library$CreateLoad$Thread$Module$Virtual$Protect$Handle$Free$Event$CurrentInformationProcess$DirectoryExit$CloseFileFindPathQuery$CommandCreate_CriticalDataEntryEnumErrorExistsFirstFolderImageInitializeL32_LastMutexOpenSectionValueWindows_invalid_parameter_noinfo
String ID: API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL$API-MS-WIN-NTUSER-RECTANGLE-L1-1-0.DLL$API-MS-WIN-SHCORE-REGISTRY-L1-1-0.DLL$Attempting to download symbol data; for now, the program may have limited functionality.$CascadeWindows$CloseThemeData$CoCreateInstance$CreateWindowExW$CreateWindowInBand$DeleteMenu$DllGetClassObject$DrawThemeBackground$DrawThemeTextEx$DwmUpdateThumbnailProperties$EP Service Window thread$Failed to install hooks. rv = %d$GetClientRect$GetSystemMetrics$GetThemeMargins$GetThemeMetric$GetWindowBand$Global\EP_Weather_Killswitch_{A6EA9C2D-4982-4827-9204-0AC532959F6D}$ITrayUIHost = %llX$Initialized taskbar centering module.$InputSwitch.dll$Installed hooks.$IsOS$LoadLibraryExW$LoadMenuW$Loaded symbols$MulDiv$NtUserFindWindowEx$Open Start on monitor thread$OpenThemeDataForDpi$PeopleBand.dll$QISearch$RegCreateKeyExW$RegGetValueW$RegOpenKeyExW$RegSetValueExW$RegisterHotKey$RoGetActivationFactory$Running on Windows %d, OS Build %d.%d.%d.%d.$SHCORE.dll$SHELL32_CanDisplayWin8CopyDialog$SHGetValueW$SHLWAPI.dll$SLGetWindowsInformationDWORD$SOFTWARE\Microsoft\TabletTip\1.7$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\People$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MultitaskingView\AltTabViewHost$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage$SOFTWARE\Microsoft\Windows\CurrentVersion\Search$SendMessageW$SetRect$SetWindowBand$SetWindowCompositionAttribute$Setup bthprops functions done$Setup combase functions done$Setup explorer functions done$Setup inputswitch functions done$Setup peopleband functions done$Setup shell32 functions done$Setup stobject functions done$Setup twinui functions done$Setup user32 functions done$Setup uxtheme functions done$Setup windows.storage functions done$ShellExecuteExW$ShellExecuteW$Software\ExplorerPatcher$Software\ExplorerPatcher\sws$StartTileData.dll$TileWindows$TrackPopupMenu$TrackPopupMenuEx$USER32.DLL$USER32.dll$[Extra] Finished running entry point.$[Extra] Found library: %p.$[Extra] LoadLibraryW failed with 0x%x.$[Extra] Running entry point...$[IME] Context menu patch status: %d$[TB] Unsupported build$\ExplorerPatcher$\ep_extra.dll$api-ms-win-core-com-l1-1-0.dll$api-ms-win-core-largeinteger-l1-1-0.dll$api-ms-win-core-libraryloader-l1-2-0.dll$api-ms-win-core-registry-l1-1-0.dll$api-ms-win-core-shlwapi-obsolete-l1-1-0.dll$api-ms-win-core-winrt-l1-1-0.dll$api-ms-win-ntuser-sysparams-l1-1-0.dll$api-ms-win-shcore-sysinfo-l1-1-0.dll$bthprops.cpl$combase.dll$dwmapi.dll$ep_extra_EntryPoint$explorer.exe!TrayUI_CreateInstance() = %llX$ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll$ext-ms-win-security-slc-l1-1-0.dll$ext-ms-win-shell-exports-internal-l1-1-0.dll$pnidui.dll$shcore.dll$shell32.dll$shell32.dll$slc.dll$stobject.dll$twinui.dll$user32.dll$user32.dll$uxtheme.dll$uxtheme.dll$win32u.dll$windows.storage.dll$windowsudk.shellcommon.dll$xx??x??xxx????xx$xxx????xxx????x????xx$xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xxx????xxx
API String ID: 1749953344-3583755957
Opcode ID: f966dac2161472eb5d1d209419e812a0b817192dcca597b15d9087055d0dd350
Instruction ID: 6ed268299b5a726d4eacbe571cd8e8a1f9131ca88d8f6f0288ab5eeb60e1c692
Opcode Fuzzy Hash: f966dac2161472eb5d1d209419e812a0b817192dcca597b15d9087055d0dd350
Instruction Fuzzy Hash: 3D03F275B58E4BD1EB50DFA1E8603B923A1AF84F48F804636D90E066A5EF3CE5C9C741

Function 00007FFD65666BA0 Relevance: 354.9, APIs: 115, Strings: 87, Instructions: 1387registrywindowCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE ref: 00007FFD65666C14
RegQueryValueExW.KERNELBASE ref: 00007FFD65666C59
RegOpenKeyExW.KERNELBASE ref: 00007FFD65666C8C
RegSetValueExW.KERNELBASE ref: 00007FFD65666DC2
RegQueryValueExW.KERNELBASE ref: 00007FFD65666DF5
RegQueryValueExW.KERNELBASE ref: 00007FFD65666E29
RegSetValueExW.ADVAPI32 ref: 00007FFD65666E5D
RegQueryValueExW.KERNELBASE ref: 00007FFD65666E91
RegQueryValueExW.KERNELBASE ref: 00007FFD65666EDB
RegCreateKeyExW.KERNELBASE ref: 00007FFD6566810D
RegQueryValueExW.KERNELBASE ref: 00007FFD65668152
RegCloseKey.ADVAPI32 ref: 00007FFD6566815C
RegCreateKeyExW.KERNELBASE ref: 00007FFD65668196
RegQueryValueExW.KERNELBASE ref: 00007FFD656681DB
RegQueryValueExW.KERNELBASE ref: 00007FFD6566820E
RegCloseKey.ADVAPI32 ref: 00007FFD65668218
RegCreateKeyExW.KERNELBASE ref: 00007FFD65668252
RegCloseKey.ADVAPI32 ref: 00007FFD6566826E
RegCreateKeyExW.KERNELBASE ref: 00007FFD656682A8
RegCloseKey.ADVAPI32 ref: 00007FFD656682C4
RegCreateKeyExW.KERNELBASE ref: 00007FFD656682FE
RegCloseKey.ADVAPI32 ref: 00007FFD6566831A
RegCreateKeyExW.KERNELBASE ref: 00007FFD65668354
RegCloseKey.ADVAPI32 ref: 00007FFD65668370
RegCreateKeyExW.KERNELBASE ref: 00007FFD656683AA
RegCloseKey.ADVAPI32 ref: 00007FFD656683C6
RegCreateKeyExW.KERNELBASE ref: 00007FFD65668400
RegCloseKey.ADVAPI32 ref: 00007FFD6566841C
SendNotifyMessageW.USER32 ref: 00007FFD6566845B
FindWindowW.USER32 ref: 00007FFD65668470
InvalidateRect.USER32 ref: 00007FFD6566847E
InvalidateRect.USER32 ref: 00007FFD65668499
RegGetValueW.ADVAPI32 ref: 00007FFD656684F1
RegSetKeyValueW.ADVAPI32 ref: 00007FFD65668542
SHFlushSFCache.SHELL32 ref: 00007FFD65668548
SHChangeNotify.SHELL32 ref: 00007FFD6566855B

Strings

WeatherTheme, xrefs: 00007FFD65667DCC
FileExplorerCommandUI, xrefs: 00007FFD65666F9D, 00007FFD65667037
AllocConsole, xrefs: 00007FFD65666DD5
Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher, xrefs: 00007FFD65666C7E
TraySettings, xrefs: 00007FFD65668447
UseClassicDriveGrouping, xrefs: 00007FFD65666F6A
Attributes, xrefs: 00007FFD656684C1, 00007FFD656684FB
HideIconAndTitleInExplorer, xrefs: 00007FFD6566728F
SpotlightDesktopMenuMask, xrefs: 00007FFD65667926
CenterMenus, xrefs: 00007FFD65667398
IMEStyle, xrefs: 00007FFD6566758F
MMOldTaskbarAl, xrefs: 00007FFD65666EBA
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage, xrefs: 00007FFD65668170
UndeadStartCorner, xrefs: 00007FFD65667A76
ToolbarSeparators, xrefs: 00007FFD65667671
WeatherContentsMode, xrefs: 00007FFD65668010
WeatherToLeft, xrefs: 00007FFD65667FC3
SOFTWARE\Classes\CLSID\{d93ed569-3b3e-4bff-8355-3c44f6a52bb5}\InProcServer32, xrefs: 00007FFD6566700B
PropertiesInWinX, xrefs: 00007FFD656674F6
MicaEffectOnTitlebar, xrefs: 00007FFD65667212
NoMenuAccelerator, xrefs: 00007FFD6566755C
ArchiveMenu, xrefs: 00007FFD65667431
EnableSymbolDownload, xrefs: 00007FFD65667728
OpenPropertiesAtNextStart, xrefs: 00007FFD65666CB7, 00007FFD65666D36, 00007FFD6566775B
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MultitaskingView\AltTabViewHost, xrefs: 00007FFD65668282
Memcheck, xrefs: 00007FFD65666E08, 00007FFD65666E44
WeatherLanguage, xrefs: 00007FFD65667C66
LegacyFileTransferDialog, xrefs: 00007FFD6566707F
Software\ExplorerPatcher, xrefs: 00007FFD65666BD0
RemoveExtraGapAroundPinnedItems, xrefs: 00007FFD65667A2E
DisableWinFHotkey, xrefs: 00007FFD656678A2
DisableImmersiveContextMenu, xrefs: 00007FFD656670CB, 00007FFD65667497
SpotlightUpdateSchedule, xrefs: 00007FFD65667959
ClassicThemeMitigations, xrefs: 00007FFD656670E5
DoNotRedirectNotificationIconsToSettingsApp, xrefs: 00007FFD6566783C
WeatherTemperatureUnit, xrefs: 00007FFD65667AB7
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer, xrefs: 00007FFD656680E7
SOFTWARE\Microsoft\Windows\CurrentVersion\Search, xrefs: 00007FFD6566832E
ExplorerPatcher_GUI_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FFD65668469
uxtheme.dll, xrefs: 00007FFD65667244
NoPropertiesInContextMenu, xrefs: 00007FFD65667529
SkinMenus, xrefs: 00007FFD65667135
WeatherDevMode, xrefs: 00007FFD65667EF5
WeatherContentUpdateMode, xrefs: 00007FFD65667B8C
UpdatePolicy, xrefs: 00007FFD6566760B
IsUpdatePending, xrefs: 00007FFD65666CEB, 00007FFD65666D61, 00007FFD6566763E
dwmapi.dll, xrefs: 00007FFD65667276
OpenAtLogon, xrefs: 00007FFD656681EE
en-US, xrefs: 00007FFD65667D31
OldTaskbar, xrefs: 00007FFD656672DA
WeatherFixedSize, xrefs: 00007FFD65667D7F
DoNotRedirectProgramsAndFeaturesToSettingsApp, xrefs: 00007FFD656671DF
Software\ExplorerPatcher\sws, xrefs: 00007FFD6566822C
SOFTWARE\Microsoft\TabletTip\1.7, xrefs: 00007FFD656683DA
HideExplorerSearchBar, xrefs: 00007FFD65666F04
HookStartMenu, xrefs: 00007FFD656674C5
CONOUT$, xrefs: 00007FFD65667187
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\People, xrefs: 00007FFD65668384
WeatherViewMode, xrefs: 00007FFD65667B3F
MigratedFromOldSettings, xrefs: 00007FFD65666C43, 00007FFD65666DA6
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FFD656682D8
Software\Classes\CLSID\{2cc5ca98-6485-489a-920e-b3e88a6ccce3}\ShellFolder, xrefs: 00007FFD656684D8, 00007FFD65668511
DisableAeroSnapQuadrants, xrefs: 00007FFD656677A3
WeatherLocation, xrefs: 00007FFD65667BEA
PinnedItemsActAsQuickLaunch, xrefs: 00007FFD656679DE
WeatherWindowCornerPreference, xrefs: 00007FFD65667E94
DwmExtendFrameIntoClientArea, xrefs: 00007FFD6566726F
DoNotRedirectDateAndTimeToSettingsApp, xrefs: 00007FFD65667809
HideControlCenterButton, xrefs: 00007FFD65667332
SpotlightDisableIcon, xrefs: 00007FFD656678D5
OldTaskbarAl, xrefs: 00007FFD65666E70
StartDocked, xrefs: 00007FFD65666D80
WeatherLocationType, xrefs: 00007FFD65667E33
ReplaceNetwork, xrefs: 00007FFD656673FE
WeatherZoomFactor, xrefs: 00007FFD6566805D
FlyoutMenus, xrefs: 00007FFD65667365
ShrinkExplorerAddressBar, xrefs: 00007FFD65666F37
SnapAssistSettings, xrefs: 00007FFD656677D6
MonitorOverride, xrefs: 00007FFD656681C2
ClockFlyoutOnWinC, xrefs: 00007FFD65667464
DisableOfficeHotkeys, xrefs: 00007FFD6566786F
TaskbarAutohideOnDoubleClick, xrefs: 00007FFD656676A4
AltTabSettings, xrefs: 00007FFD65668139
DoNotRedirectSystemToSettingsApp, xrefs: 00007FFD656671AC
OrbStyle, xrefs: 00007FFD656676D7
WeatherIconPack, xrefs: 00007FFD65667F5C
SkinIcons, xrefs: 00007FFD656673CB

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Value$Create$CloseQuery$InvalidateNotifyRect$CacheChangeFindFlushMessageOpenSendWindow
String ID: AllocConsole$AltTabSettings$ArchiveMenu$Attributes$CONOUT$$CenterMenus$ClassicThemeMitigations$ClockFlyoutOnWinC$DisableAeroSnapQuadrants$DisableImmersiveContextMenu$DisableOfficeHotkeys$DisableWinFHotkey$DoNotRedirectDateAndTimeToSettingsApp$DoNotRedirectNotificationIconsToSettingsApp$DoNotRedirectProgramsAndFeaturesToSettingsApp$DoNotRedirectSystemToSettingsApp$DwmExtendFrameIntoClientArea$EnableSymbolDownload$ExplorerPatcher_GUI_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}$FileExplorerCommandUI$FlyoutMenus$HideControlCenterButton$HideExplorerSearchBar$HideIconAndTitleInExplorer$HookStartMenu$IMEStyle$IsUpdatePending$LegacyFileTransferDialog$MMOldTaskbarAl$Memcheck$MicaEffectOnTitlebar$MigratedFromOldSettings$MonitorOverride$NoMenuAccelerator$NoPropertiesInContextMenu$OldTaskbar$OldTaskbarAl$OpenAtLogon$OpenPropertiesAtNextStart$OrbStyle$PinnedItemsActAsQuickLaunch$PropertiesInWinX$RemoveExtraGapAroundPinnedItems$ReplaceNetwork$SOFTWARE\Classes\CLSID\{d93ed569-3b3e-4bff-8355-3c44f6a52bb5}\InProcServer32$SOFTWARE\Microsoft\TabletTip\1.7$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\People$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MultitaskingView\AltTabViewHost$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage$SOFTWARE\Microsoft\Windows\CurrentVersion\Search$ShrinkExplorerAddressBar$SkinIcons$SkinMenus$SnapAssistSettings$Software\Classes\CLSID\{2cc5ca98-6485-489a-920e-b3e88a6ccce3}\ShellFolder$Software\ExplorerPatcher$Software\ExplorerPatcher\sws$Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher$SpotlightDesktopMenuMask$SpotlightDisableIcon$SpotlightUpdateSchedule$StartDocked$TaskbarAutohideOnDoubleClick$ToolbarSeparators$TraySettings$UndeadStartCorner$UpdatePolicy$UseClassicDriveGrouping$WeatherContentUpdateMode$WeatherContentsMode$WeatherDevMode$WeatherFixedSize$WeatherIconPack$WeatherLanguage$WeatherLocation$WeatherLocationType$WeatherTemperatureUnit$WeatherTheme$WeatherToLeft$WeatherViewMode$WeatherWindowCornerPreference$WeatherZoomFactor$dwmapi.dll$en-US$uxtheme.dll
API String ID: 1717770317-57872525
Opcode ID: 55c726c40a494e38a333f58c2c14f683caa3c9481228028a8ad33e5f4c4941bd
Instruction ID: c1686c71c75561b64d481d1c9c2cb25b2f14ff1d796f3d5383110217b7166d8f
Opcode Fuzzy Hash: 55c726c40a494e38a333f58c2c14f683caa3c9481228028a8ad33e5f4c4941bd
Instruction Fuzzy Hash: CDF2FA76B18E5ACAEB209FA4E8607A933B5FB48B48F405135DA4D13B68DF3CD195CB04

Function 00007FFD65685AC0 Relevance: 159.8, APIs: 52, Strings: 39, Instructions: 591
registryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFD65652890: GetModuleHandleW.KERNEL32 ref: 00007FFD656528AF
Part of subcall function 00007FFD65652890: GetProcAddress.KERNEL32 ref: 00007FFD656528C8
Part of subcall function 00007FFD65652890: RegOpenKeyExW.KERNELBASE ref: 00007FFD6565293F
Part of subcall function 00007FFD65652890: RegQueryValueExW.KERNELBASE ref: 00007FFD6565296F

RegCreateKeyExW.KERNELBASE ref: 00007FFD65685BA0
GetWindowsDirectoryW.KERNEL32 ref: 00007FFD65685BC4
RegQueryValueExA.KERNELBASE ref: 00007FFD65685C2D
RegQueryValueExW.ADVAPI32 ref: 00007FFD65685C89
RegQueryValueExW.ADVAPI32 ref: 00007FFD65685CD3
RegQueryValueExW.ADVAPI32 ref: 00007FFD65685CFE
RegQueryValueExW.ADVAPI32 ref: 00007FFD65685D29
RegQueryValueExW.ADVAPI32 ref: 00007FFD65685D54
RegQueryValueExW.ADVAPI32 ref: 00007FFD65685D7F
RegQueryValueExW.ADVAPI32 ref: 00007FFD65685DAA
RegCloseKey.ADVAPI32 ref: 00007FFD65685DD9
RegDeleteTreeW.KERNELBASE ref: 00007FFD65685DF1
RegCreateKeyExW.KERNELBASE ref: 00007FFD65685E31
GetSystemDirectoryW.KERNEL32 ref: 00007FFD65685E55
RegQueryValueExA.KERNELBASE ref: 00007FFD65685EC5
RegQueryValueExW.ADVAPI32 ref: 00007FFD65685F21
RegQueryValueExW.ADVAPI32 ref: 00007FFD65685F6F
RegQueryValueExW.ADVAPI32 ref: 00007FFD65685F9A
RegQueryValueExW.ADVAPI32 ref: 00007FFD65685FC5
RegQueryValueExW.ADVAPI32 ref: 00007FFD65685FF0
RegQueryValueExW.ADVAPI32 ref: 00007FFD6568601B
RegQueryValueExW.ADVAPI32 ref: 00007FFD65686046
RegQueryValueExW.ADVAPI32 ref: 00007FFD65686071
RegQueryValueExW.ADVAPI32 ref: 00007FFD6568609C
RegQueryValueExW.ADVAPI32 ref: 00007FFD656860C7
RegCloseKey.ADVAPI32 ref: 00007FFD656860D2
RegCreateKeyExW.KERNELBASE ref: 00007FFD65686187
GetWindowsDirectoryW.KERNEL32 ref: 00007FFD65686199
RegQueryValueExA.KERNELBASE ref: 00007FFD65686209
RegQueryValueExW.ADVAPI32 ref: 00007FFD65686265
RegQueryValueExW.ADVAPI32 ref: 00007FFD656862B3
RegQueryValueExW.ADVAPI32 ref: 00007FFD656862DE
RegQueryValueExW.ADVAPI32 ref: 00007FFD65686309
RegQueryValueExW.ADVAPI32 ref: 00007FFD65686334
RegQueryValueExW.ADVAPI32 ref: 00007FFD6568635F
RegCloseKey.ADVAPI32 ref: 00007FFD6568638D
RegDeleteTreeW.KERNELBASE ref: 00007FFD656863AE
RegCreateKeyExW.KERNELBASE ref: 00007FFD656863FF
GetWindowsDirectoryW.KERNEL32 ref: 00007FFD65686411
FindFirstFileW.KERNELBASE ref: 00007FFD6568643D
FindClose.KERNEL32 ref: 00007FFD6568644C
GetWindowsDirectoryW.KERNEL32 ref: 00007FFD65686460

Part of subcall function 00007FFD656A7C0C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7C35

RegQueryValueExA.KERNELBASE ref: 00007FFD656864D0
RegQueryValueExW.ADVAPI32 ref: 00007FFD6568652C
RegQueryValueExW.ADVAPI32 ref: 00007FFD65686572
RegCloseKey.ADVAPI32 ref: 00007FFD6568659F
RegDeleteTreeW.KERNELBASE ref: 00007FFD656865B7
RegCreateKeyExW.KERNELBASE ref: 00007FFD656865F7
RegDeleteValueW.KERNELBASE ref: 00007FFD65686613
RegCloseKey.ADVAPI32 ref: 00007FFD6568661E

Strings

CLauncherTipContextMenu::_ExecuteCommand, xrefs: 00007FFD65686037
\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartDocked.dll, xrefs: 00007FFD6568619F
OSBuild, xrefs: 00007FFD6568660C
ImmersiveTray::RaiseWindow, xrefs: 00007FFD65685CEF
Hash, xrefs: 00007FFD65685C0C, 00007FFD65685EA4, 00007FFD656861E1, 00007FFD656864A8
ImmersiveTray::AttachWindowToTray, xrefs: 00007FFD65685CB9
StartDocked::SystemListPolicyProvider::GetMaximumFrequentApps, xrefs: 00007FFD65686325
CImmersiveContextMenuOwnerDrawHelper::s_ContextMenuWndProc, xrefs: 00007FFD65685F5D
Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher\StartDocked, xrefs: 00007FFD65686154, 00007FFD656863A0
StartDocked::LauncherFrame::OnVisibilityChanged, xrefs: 00007FFD656862FA
CMultitaskingViewManager::_CreateXamlMTVHost, xrefs: 00007FFD6568608D
Version, xrefs: 00007FFD65685C65, 00007FFD65685EFD, 00007FFD65686241, 00007FFD65686508
!, xrefs: 00007FFD656864C8
\twinui.pcshell.dll, xrefs: 00007FFD65685E5B
ImmersiveContextMenuHelper::RemoveOwnerDrawFromMenu, xrefs: 00007FFD65685FE1
Software\ExplorerPatcher\twinui.pcshell, xrefs: 00007FFD65685E04, 00007FFD65686103
CTaskBand_CreateInstance, xrefs: 00007FFD65685D1A
\explorer.exe, xrefs: 00007FFD65685BCA
Software\ExplorerPatcher\explorer, xrefs: 00007FFD65685B70, 00007FFD65685DE3
[Symbols] Symbols for "%s" are not available., xrefs: 00007FFD65685DBE, 00007FFD656860E9, 00007FFD65686374, 00007FFD65686586
explorer, xrefs: 00007FFD65685DB7
StartUI, xrefs: 00007FFD6568657F
HandleFirstTimeLegacy, xrefs: 00007FFD65685D45
SetColorPreferenceForLogonUI, xrefs: 00007FFD65685D70
Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher\StartUI, xrefs: 00007FFD656863CF, 00007FFD656865A9
CLauncherTipContextMenu::ShowLauncherTipContextMenu, xrefs: 00007FFD65686062
CLauncherTipContextMenu::GetMenuItemsAsync, xrefs: 00007FFD65685F8B
Software\ExplorerPatcher, xrefs: 00007FFD656865CA
TrayUI::_UpdatePearlSize, xrefs: 00007FFD65685D9B
\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI.dll, xrefs: 00007FFD65686417
ImmersiveContextMenuHelper::ApplyOwnerDrawToMenu, xrefs: 00007FFD65685FB6
\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll, xrefs: 00007FFD65686466
CLauncherTipContextMenu::_ExecuteShutdownCommand, xrefs: 00007FFD6568600C
twinui.pcshell, xrefs: 00007FFD656860E2
CMultitaskingViewManager::_CreateDCompMTVHost, xrefs: 00007FFD656860B8
StartDocked::StartSizingFrame::StartSizingFrame, xrefs: 00007FFD65686350
StartDocked, xrefs: 00007FFD6568636D
StartDocked::LauncherFrame::ShowAllApps, xrefs: 00007FFD656862A1, 00007FFD656862CF
StartUI::SystemListPolicyProvider::GetMaximumFrequentApps, xrefs: 00007FFD65686560

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Value$Query$Close$CreateDirectory$DeleteWindows$Tree$Find$AddressFileFirstHandleModuleOpenProcSystem_invalid_parameter_noinfo
String ID: !$CImmersiveContextMenuOwnerDrawHelper::s_ContextMenuWndProc$CLauncherTipContextMenu::GetMenuItemsAsync$CLauncherTipContextMenu::ShowLauncherTipContextMenu$CLauncherTipContextMenu::_ExecuteCommand$CLauncherTipContextMenu::_ExecuteShutdownCommand$CMultitaskingViewManager::_CreateDCompMTVHost$CMultitaskingViewManager::_CreateXamlMTVHost$CTaskBand_CreateInstance$HandleFirstTimeLegacy$Hash$ImmersiveContextMenuHelper::ApplyOwnerDrawToMenu$ImmersiveContextMenuHelper::RemoveOwnerDrawFromMenu$ImmersiveTray::AttachWindowToTray$ImmersiveTray::RaiseWindow$OSBuild$SetColorPreferenceForLogonUI$Software\ExplorerPatcher$Software\ExplorerPatcher\explorer$Software\ExplorerPatcher\twinui.pcshell$Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher\StartDocked$Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher\StartUI$StartDocked$StartDocked::LauncherFrame::OnVisibilityChanged$StartDocked::LauncherFrame::ShowAllApps$StartDocked::StartSizingFrame::StartSizingFrame$StartDocked::SystemListPolicyProvider::GetMaximumFrequentApps$StartUI$StartUI::SystemListPolicyProvider::GetMaximumFrequentApps$TrayUI::_UpdatePearlSize$Version$[Symbols] Symbols for "%s" are not available.$\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartDocked.dll$\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI.dll$\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll$\explorer.exe$\twinui.pcshell.dll$explorer$twinui.pcshell
API String ID: 3716114926-1751072635
Opcode ID: 412fde013c702e0a086e37fe233cfb6a70287127694cd269689f66558ae1ac9f
Instruction ID: 55a6dc45de537f95f47d6040d61207d243eb07fe7334374502d10aca26a5e085
Opcode Fuzzy Hash: 412fde013c702e0a086e37fe233cfb6a70287127694cd269689f66558ae1ac9f
Instruction Fuzzy Hash: 53622672718E86D6EB20CF90F4607AA7764FB94B58F801231D68D47A68DFBCD199CB00

Function 00007FFD65671640 Relevance: 152.7, APIs: 49, Strings: 38, Instructions: 444
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFD65652890: GetModuleHandleW.KERNEL32 ref: 00007FFD656528AF
Part of subcall function 00007FFD65652890: GetProcAddress.KERNEL32 ref: 00007FFD656528C8
Part of subcall function 00007FFD65652890: RegOpenKeyExW.KERNELBASE ref: 00007FFD6565293F
Part of subcall function 00007FFD65652890: RegQueryValueExW.KERNELBASE ref: 00007FFD6565296F

GetModuleFileNameW.KERNEL32 ref: 00007FFD656716AD
PathStripPathW.SHLWAPI ref: 00007FFD656716BA

Part of subcall function 00007FFD656A7DF4: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7E11

GetCurrentProcessId.KERNEL32 ref: 00007FFD656716DF
OpenProcess.KERNEL32 ref: 00007FFD656716EF
QueryFullProcessImageNameW.KERNELBASE ref: 00007FFD65671718
CloseHandle.KERNELBASE ref: 00007FFD65671721
GetSystemDirectoryW.KERNEL32 ref: 00007FFD65671733
GetWindowsDirectoryW.KERNEL32 ref: 00007FFD65671776
GetWindowsDirectoryW.KERNEL32 ref: 00007FFD656717BF
GetWindowsDirectoryW.KERNEL32 ref: 00007FFD656717FD
GetSystemDirectoryW.KERNEL32 ref: 00007FFD65671855
LoadLibraryExW.KERNELBASE ref: 00007FFD6567187A
GetProcAddress.KERNEL32 ref: 00007FFD6567188D
GetProcAddress.KERNEL32 ref: 00007FFD656718A4
GetProcAddress.KERNEL32 ref: 00007FFD656718BB
GetProcAddress.KERNEL32 ref: 00007FFD656718D2
GetProcAddress.KERNEL32 ref: 00007FFD656718E9
GetProcAddress.KERNEL32 ref: 00007FFD65671900
GetProcAddress.KERNEL32 ref: 00007FFD65671917
GetProcAddress.KERNEL32 ref: 00007FFD6567192E
GetProcAddress.KERNEL32 ref: 00007FFD65671945
GetProcAddress.KERNEL32 ref: 00007FFD6567195C
GetProcAddress.KERNEL32 ref: 00007FFD65671973
GetProcAddress.KERNEL32 ref: 00007FFD6567198A
GetProcAddress.KERNEL32 ref: 00007FFD656719A1
GetProcAddress.KERNEL32 ref: 00007FFD656719B8
GetProcAddress.KERNEL32 ref: 00007FFD656719CF
GetProcAddress.KERNEL32 ref: 00007FFD656719E6
GetProcAddress.KERNEL32 ref: 00007FFD656719FD
GetProcAddress.KERNEL32 ref: 00007FFD65671A14
GetProcAddress.KERNEL32 ref: 00007FFD65671A2B
GetSystemMetrics.USER32 ref: 00007FFD65671A4D
RegGetValueW.KERNELBASE ref: 00007FFD65671AA0
RegGetValueW.KERNELBASE ref: 00007FFD65671B54
FindWindowExW.USER32 ref: 00007FFD65671BA1
FindWindowExW.USER32 ref: 00007FFD65671BBE
GetAsyncKeyState.USER32 ref: 00007FFD65671BE6
GetAsyncKeyState.USER32 ref: 00007FFD65671BF6
GetAsyncKeyState.USER32 ref: 00007FFD65671C06
RegSetKeyValueW.KERNELBASE ref: 00007FFD65671C59
SHCreateThread.SHLWAPI ref: 00007FFD65671C71
RegSetKeyValueW.ADVAPI32 ref: 00007FFD65671CAC
SHCreateThread.SHLWAPI ref: 00007FFD65671CC1
LoadLibraryW.KERNEL32 ref: 00007FFD65671D0B
RegOpenKeyW.ADVAPI32 ref: 00007FFD65671DAE
RegCloseKey.ADVAPI32 ref: 00007FFD65671DBD
LoadLibraryW.KERNEL32 ref: 00007FFD65671DCA
LoadLibraryW.KERNEL32 ref: 00007FFD65671E2C
GetModuleHandleExW.KERNEL32 ref: 00007FFD65671E59

Strings

SetAppCompatStringPointer, xrefs: 00007FFD65671A03
DXGID3D10RegisterLayers, xrefs: 00007FFD6567194B
dxgi.dll, xrefs: 00007FFD656716C0
PIXEndCapture, xrefs: 00007FFD656719D5
LaunchUserOOBE, xrefs: 00007FFD65671A69
Control Panel\Quick Actions\Control Center\QuickActionsStateCapture\ExplorerPatcher, xrefs: 00007FFD65671DA7
UpdateHMDEmulationStatus, xrefs: 00007FFD65671A1A
CompatValue, xrefs: 00007FFD656718AA
DXGIDeclareAdapterRemovalSupport, xrefs: 00007FFD65671962
ApplyCompatResolutionQuirking, xrefs: 00007FFD65671883
Windows.UI.Xaml.dll, xrefs: 00007FFD65671D04, 00007FFD65671E25
CreateDXGIFactory, xrefs: 00007FFD656718C1
CompatString, xrefs: 00007FFD65671893
DXGIDumpJournal, xrefs: 00007FFD65671979
Windows.UI.QuickActions.dll, xrefs: 00007FFD65671DC3
\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe, xrefs: 00007FFD656717C5
\explorer.exe, xrefs: 00007FFD6567177C
\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe, xrefs: 00007FFD65671803
CreateDXGIFactory2, xrefs: 00007FFD656718EF
Progman, xrefs: 00007FFD65671B96
Software\ExplorerPatcher, xrefs: 00007FFD65671C46, 00007FFD65671C9E
GetProductInfo, xrefs: 00007FFD65671DDF
api-ms-win-core-sysinfo-l1-2-0.dll, xrefs: 00007FFD65671DE6
DXGID3D10CreateLayeredDevice, xrefs: 00007FFD6567191D
PIXGetCaptureState, xrefs: 00007FFD656719EC
CreateDXGIFactory1, xrefs: 00007FFD656718D8
SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData, xrefs: 00007FFD65671B36
LaunchCflScenario, xrefs: 00007FFD65671B1D
DXGIGetDebugInterface1, xrefs: 00007FFD65671990
DXGID3D10CreateDevice, xrefs: 00007FFD65671906
CrashCounter, xrefs: 00007FFD65671C34, 00007FFD65671C93
SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE, xrefs: 00007FFD65671A82
Proxy Desktop, xrefs: 00007FFD65671BB3
\dxgi.dll, xrefs: 00007FFD6567185B
DXGID3D10GetLayeredDeviceSize, xrefs: 00007FFD65671934
\SearchIndexer.exe, xrefs: 00007FFD65671739
PIXBeginCapture, xrefs: 00007FFD656719BE
DXGIReportAdapterConfiguration, xrefs: 00007FFD656719A7

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: AddressProc$DirectoryValue$LibraryLoad$AsyncHandleModuleOpenProcessStateSystemWindows$CloseCreateFindNamePathQueryThreadWindow$CurrentFileFullImageMetricsStrip_invalid_parameter_noinfo
String ID: ApplyCompatResolutionQuirking$CompatString$CompatValue$Control Panel\Quick Actions\Control Center\QuickActionsStateCapture\ExplorerPatcher$CrashCounter$CreateDXGIFactory$CreateDXGIFactory1$CreateDXGIFactory2$DXGID3D10CreateDevice$DXGID3D10CreateLayeredDevice$DXGID3D10GetLayeredDeviceSize$DXGID3D10RegisterLayers$DXGIDeclareAdapterRemovalSupport$DXGIDumpJournal$DXGIGetDebugInterface1$DXGIReportAdapterConfiguration$GetProductInfo$LaunchCflScenario$LaunchUserOOBE$PIXBeginCapture$PIXEndCapture$PIXGetCaptureState$Progman$Proxy Desktop$SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData$SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE$SetAppCompatStringPointer$Software\ExplorerPatcher$UpdateHMDEmulationStatus$Windows.UI.QuickActions.dll$Windows.UI.Xaml.dll$\SearchIndexer.exe$\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe$\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe$\dxgi.dll$\explorer.exe$api-ms-win-core-sysinfo-l1-2-0.dll$dxgi.dll
API String ID: 425412005-3433049922
Opcode ID: f7214b213aa9b7ce686bef311924f7d5d21b0d92d4cd4f49cb39c126f453a435
Instruction ID: 0ecf55676951bcee1201541b956e3ea1aa417f8e1f9fb26463f620bd06d33bdd
Opcode Fuzzy Hash: f7214b213aa9b7ce686bef311924f7d5d21b0d92d4cd4f49cb39c126f453a435
Instruction Fuzzy Hash: C532E075B08E4BD6EB149BA1E8743B923A5FF84B48F800136D94E466A4EF7CE5C9C740

Function 00007FFD6566BFE0 Relevance: 75.5, APIs: 17, Strings: 26, Instructions: 277
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 00007FFD6566C00B
GetCurrentProcess.KERNEL32 ref: 00007FFD6566C31C
K32GetModuleInformation.KERNEL32 ref: 00007FFD6566C333
LoadLibraryExW.KERNELBASE ref: 00007FFD6566C3B6
RegGetValueW.KERNELBASE ref: 00007FFD6566C4A2
GetModuleHandleW.KERNEL32 ref: 00007FFD6566C4DB
GetProcAddress.KERNEL32 ref: 00007FFD6566C4EB
LoadLibraryW.KERNEL32 ref: 00007FFD6566C542
GetProcAddress.KERNEL32 ref: 00007FFD6566C020

Part of subcall function 00007FFD6565D290: GetModuleHandleExW.KERNEL32 ref: 00007FFD6565D2C6
Part of subcall function 00007FFD6565D290: ImageDirectoryEntryToDataEx.DBGHELP ref: 00007FFD6565D2F9
Part of subcall function 00007FFD6565D290: FreeLibrary.KERNEL32 ref: 00007FFD6565D32F

Part of subcall function 00007FFD6565D290: FreeLibrary.KERNEL32 ref: 00007FFD6565D3B9
Part of subcall function 00007FFD6565D290: VirtualQuery.KERNEL32 ref: 00007FFD6565D3F8
Part of subcall function 00007FFD6565D290: VirtualProtect.KERNELBASE ref: 00007FFD6565D413
Part of subcall function 00007FFD6565D290: VirtualProtect.KERNEL32 ref: 00007FFD6565D43B
Part of subcall function 00007FFD6565D290: FreeLibrary.KERNEL32 ref: 00007FFD6565D446

LoadLibraryW.KERNEL32 ref: 00007FFD6566C03C
GetCurrentProcess.KERNEL32 ref: 00007FFD6566C0B1
K32GetModuleInformation.KERNEL32 ref: 00007FFD6566C0C8
LoadLibraryW.KERNEL32 ref: 00007FFD6566C18E
GetProcAddress.KERNEL32 ref: 00007FFD6566C1A1
LoadLibraryExW.KERNELBASE ref: 00007FFD6566C1B5
GetCurrentProcess.KERNEL32 ref: 00007FFD6566C1F0
K32GetModuleInformation.KERNEL32 ref: 00007FFD6566C207

Strings

shcore.dll, xrefs: 00007FFD6566C279
xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xxx????xxx, xrefs: 00007FFD6566C0D2, 00007FFD6566C211
SHRegGetValueFromHKCUHKLM, xrefs: 00007FFD6566C016
combase.dll, xrefs: 00007FFD6566C53B
user32.dll, xrefs: 00007FFD6566C095, 00007FFD6566C121, 00007FFD6566C14D, 00007FFD6566C178, 00007FFD6566C1D1, 00007FFD6566C260, 00007FFD6566C2A8, 00007FFD6566C2D3, 00007FFD6566C310, 00007FFD6566C3DA, 00007FFD6566C3FA, 00007FFD6566C426, 00007FFD6566C451
TrackPopupMenu, xrefs: 00007FFD6566C087, 00007FFD6566C1CA, 00007FFD6566C3D3
LoadLibraryExW, xrefs: 00007FFD6566C552
SetWindowLongPtrW, xrefs: 00007FFD6566C16A, 00007FFD6566C2C5, 00007FFD6566C443
CoCreateInstance, xrefs: 00007FFD6566C39C
CompareStringOrdinal, xrefs: 00007FFD6566C2EC
CreateWindowExW, xrefs: 00007FFD6566C13F, 00007FFD6566C29A, 00007FFD6566C418
Shlwapi.dll, xrefs: 00007FFD6566C000
RtlQueryFeatureConfiguration, xrefs: 00007FFD6566C4E4
shell32.dll, xrefs: 00007FFD6566C02D
SystemParametersInfoW, xrefs: 00007FFD6566C11A, 00007FFD6566C259, 00007FFD6566C3F3
API-MS-WIN-CORE-STRING-L1-1-0.DLL, xrefs: 00007FFD6566C2F3
api-ms-win-core-libraryloader-l1-2-0.dll, xrefs: 00007FFD6566C559
shcore.dll, xrefs: 00007FFD6566C187
ExplorerFrame.dll, xrefs: 00007FFD6566C1AE
api-ms-win-core-com-l1-1-0.dll, xrefs: 00007FFD6566C3A3
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FFD6566C48B
Start_ShowClassicMode, xrefs: 00007FFD6566C472
ntdll.dll, xrefs: 00007FFD6566C4D4
GetSystemMetricsForDpi, xrefs: 00007FFD6566C309
Windows.UI.FileExplorer.dll, xrefs: 00007FFD6566C3AF
Failed to hook RtlQueryFeatureConfiguration(). rv = %d, xrefs: 00007FFD6566C522

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Library$Load$Module$AddressCurrentFreeInformationProcProcessVirtual$HandleProtect$DataDirectoryEntryImageQueryValue
String ID: API-MS-WIN-CORE-STRING-L1-1-0.DLL$CoCreateInstance$CompareStringOrdinal$CreateWindowExW$ExplorerFrame.dll$Failed to hook RtlQueryFeatureConfiguration(). rv = %d$GetSystemMetricsForDpi$LoadLibraryExW$RtlQueryFeatureConfiguration$SHRegGetValueFromHKCUHKLM$SetWindowLongPtrW$Shlwapi.dll$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced$Start_ShowClassicMode$SystemParametersInfoW$TrackPopupMenu$Windows.UI.FileExplorer.dll$api-ms-win-core-com-l1-1-0.dll$api-ms-win-core-libraryloader-l1-2-0.dll$combase.dll$ntdll.dll$shcore.dll$shcore.dll$shell32.dll$user32.dll$xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xxx????xxx
API String ID: 404060323-2645642614
Opcode ID: 9ffdb2377e7a2418f43bd02c71607476b66d4ca44b31f3885eb055b5a4fd8a7b
Instruction ID: b4a57ad51d25912e35f646a5c1f78aefb4f4527c9674386fe902a7cfc4a7ae37
Opcode Fuzzy Hash: 9ffdb2377e7a2418f43bd02c71607476b66d4ca44b31f3885eb055b5a4fd8a7b
Instruction Fuzzy Hash: ACF1DF64B49E4FD1FB10AF95E8603E523A1AF45F84F844132D90E462A5EF7CE6C9C381

Function 00007FFD656853F0 Relevance: 58.1, APIs: 18, Strings: 15, Instructions: 354
registrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNELBASE ref: 00007FFD65685436

Part of subcall function 00007FFD65674E90: RegCreateKeyExW.ADVAPI32 ref: 00007FFD65674EEC
Part of subcall function 00007FFD65674E90: RegQueryValueExW.ADVAPI32 ref: 00007FFD65674F41
Part of subcall function 00007FFD65674E90: GetLocaleInfoW.KERNEL32 ref: 00007FFD65674F8A
Part of subcall function 00007FFD65674E90: GetLocaleInfoW.KERNEL32 ref: 00007FFD65674FA5
Part of subcall function 00007FFD65674E90: SetThreadPreferredUILanguages.KERNEL32 ref: 00007FFD6567505B
Part of subcall function 00007FFD65674E90: RegCloseKey.ADVAPI32 ref: 00007FFD6567506B

SHGetFolderPathW.SHELL32 ref: 00007FFD6568547A

Part of subcall function 00007FFD656A7C0C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7C35

LoadLibraryExW.KERNEL32 ref: 00007FFD656854A7

Part of subcall function 00007FFD65652890: GetModuleHandleW.KERNEL32 ref: 00007FFD656528AF
Part of subcall function 00007FFD65652890: GetProcAddress.KERNEL32 ref: 00007FFD656528C8
Part of subcall function 00007FFD65652890: RegOpenKeyExW.KERNELBASE ref: 00007FFD6565293F
Part of subcall function 00007FFD65652890: RegQueryValueExW.KERNELBASE ref: 00007FFD6565296F

RegCreateKeyExW.ADVAPI32 ref: 00007FFD65685549
RegQueryValueExW.ADVAPI32 ref: 00007FFD65685587
LoadStringW.USER32 ref: 00007FFD656855EF
LoadStringW.USER32 ref: 00007FFD6568562D
RegSetValueExW.ADVAPI32 ref: 00007FFD656856DE
RegCloseKey.ADVAPI32 ref: 00007FFD656856E9
SHGetFolderPathA.SHELL32 ref: 00007FFD6568572F
CreateDirectoryA.KERNEL32 ref: 00007FFD65685756
LoadStringW.USER32 ref: 00007FFD656858A6
LoadStringW.USER32 ref: 00007FFD656858E4
LoadStringW.USER32 ref: 00007FFD6568591D
LoadStringW.USER32 ref: 00007FFD6568595B
LoadStringW.USER32 ref: 00007FFD656859AE
LoadStringW.USER32 ref: 00007FFD656859EC
FreeLibrary.KERNEL32 ref: 00007FFD65685A71

Strings

<toast scenario="reminder" activationType="protocol" launch="%s" duration="%s"><visual><binding template="ToastGeneric">, xrefs: 00007FFD65685657, 00007FFD65685991, 00007FFD65685A16
@, xrefs: 00007FFD6568557F
short, xrefs: 00007FFD656855BE, 00007FFD65685979, 00007FFD65685A1D
Software\ExplorerPatcher, xrefs: 00007FFD656854F4
[Symbols] Downloading to "%s"., xrefs: 00007FFD6568577B
[Symbols] Attempting to download symbols for OS version %s., xrefs: 00007FFD656856F6
SymbolsLastNotifiedOSBuild, xrefs: 00007FFD6568555E, 00007FFD656856BF
[Symbols] Started "Download symbols" thread., xrefs: 00007FFD6568543C
[Symbols] Finished "Download symbols" thread., xrefs: 00007FFD65685A77
%d.%d.%d.%d, xrefs: 00007FFD656854BC
[Symbols] Finished gathering symbol data., xrefs: 00007FFD65685871
https://github.com/valinet/ExplorerPatcher/wiki/Symbols, xrefs: 00007FFD65685644, 00007FFD65685985, 00007FFD65685A03
\ExplorerPatcher\ep_gui.dll, xrefs: 00007FFD65685480
\ExplorerPatcher, xrefs: 00007FFD65685735
long, xrefs: 00007FFD656858F6

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Load$String$Value$CreateQuery$CloseFolderInfoLibraryLocalePath$AddressDirectoryFreeHandleLanguagesModuleOpenPreferredProcSleepThread_invalid_parameter_noinfo
String ID: %d.%d.%d.%d$<toast scenario="reminder" activationType="protocol" launch="%s" duration="%s"><visual><binding template="ToastGeneric">$@$Software\ExplorerPatcher$SymbolsLastNotifiedOSBuild$[Symbols] Attempting to download symbols for OS version %s.$[Symbols] Downloading to "%s".$[Symbols] Finished "Download symbols" thread.$[Symbols] Finished gathering symbol data.$[Symbols] Started "Download symbols" thread.$\ExplorerPatcher$\ExplorerPatcher\ep_gui.dll$https://github.com/valinet/ExplorerPatcher/wiki/Symbols$long$short
API String ID: 3080592855-3895060210
Opcode ID: b7bc02cd05561e9a69f72141270c9ff48f8b812540baf4c52e4dacd06bddb68a
Instruction ID: 022c7d20e0f00399f57801d9a596186ee396bb5f680bb48f0c4089bcd37c1ffd
Opcode Fuzzy Hash: b7bc02cd05561e9a69f72141270c9ff48f8b812540baf4c52e4dacd06bddb68a
Instruction Fuzzy Hash: B7026536B18F8AD5EB60DFA0D8603EA2365FB54B48F805132D94D47A99EF3CD689C740

Function 00007FFD6568F040 Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 315
registrysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RoInitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD6568F076
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6568F0A5
RoGetActivationFactory.COMBASE ref: 00007FFD6568F0C2
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6568F0F2
RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD6568F10F
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6568F159
FindWindowExW.USER32 ref: 00007FFD6568F1AA
SleepEx.KERNELBASE ref: 00007FFD6568F1BA
FindWindowExW.USER32 ref: 00007FFD6568F1CE
Sleep.KERNEL32 ref: 00007FFD6568F1DC
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6568F219
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6568F25A
RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD6568F277
CreateEventW.KERNEL32 ref: 00007FFD6568F28F
CreateEventW.KERNEL32 ref: 00007FFD6568F2A7
CreateEventW.KERNEL32 ref: 00007FFD6568F2BF
RegCreateKeyExW.ADVAPI32 ref: 00007FFD6568F3B1
RegSetValueExW.ADVAPI32 ref: 00007FFD6568F3F0
RegCloseKey.ADVAPI32 ref: 00007FFD6568F3FA
WaitForMultipleObjects.KERNEL32 ref: 00007FFD6568F442

Strings

EP_Ev_InstallUpdates_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FFD6568F299
IsUpdatePending, xrefs: 00007FFD6568F3E9
EP_Ev_CheckForUpdates_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FFD6568F281
Software\ExplorerPatcher, xrefs: 00007FFD6568F3A3
ep_updates, xrefs: 00007FFD6568F152
[Updates] Starting daemon., xrefs: 00007FFD6568F1E2
Windows.UI.Notifications.ToastNotification, xrefs: 00007FFD6568F253
EP_Ev_InstallUpdatesNoConfirm_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FFD6568F2B1
Windows.UI.Notifications.ToastNotificationManager, xrefs: 00007FFD6568F09E, 00007FFD6568F0EB
Shell_TrayWnd, xrefs: 00007FFD6568F19F, 00007FFD6568F1C3
Microsoft.Windows.Explorer, xrefs: 00007FFD6568F212

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Create$ReferenceStringWindows$ActivationEventFactory$FindSleepWindow$CloseInitializeMultipleObjectsValueWait
String ID: EP_Ev_CheckForUpdates_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}$EP_Ev_InstallUpdatesNoConfirm_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}$EP_Ev_InstallUpdates_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}$IsUpdatePending$Microsoft.Windows.Explorer$Shell_TrayWnd$Software\ExplorerPatcher$Windows.UI.Notifications.ToastNotification$Windows.UI.Notifications.ToastNotificationManager$[Updates] Starting daemon.$ep_updates
API String ID: 515347756-3464217809
Opcode ID: 71dd782de2b3c3f84313dd3887abf7a5c32c28c1e968113a04e02553a65a6502
Instruction ID: 69d86a6ba96d75d40d9281f60ed8799cec832522bb336b27c4b85a808e1ac346
Opcode Fuzzy Hash: 71dd782de2b3c3f84313dd3887abf7a5c32c28c1e968113a04e02553a65a6502
Instruction Fuzzy Hash: 13E12336B18E4ADAEB14DFA0E8607A973A1EB48F48F404536DA0D57BA4DF3CE595C310

Function 00007FFD65668690 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 190
registrywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD65668441), ref: 00007FFD65668707
RegQueryValueExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD65668441), ref: 00007FFD65668745
RegQueryValueExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD65668441), ref: 00007FFD6566878E
RegQueryValueExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD65668441), ref: 00007FFD656687D8
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD65668441), ref: 00007FFD656687F9
RegCreateKeyExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD65668441), ref: 00007FFD65668846
RegQueryValueExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD65668441), ref: 00007FFD65668883
SendNotifyMessageW.USER32 ref: 00007FFD656688D0
FindWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD65668441), ref: 00007FFD656688E4
FindWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD65668441), ref: 00007FFD656688FE
FindWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD65668441), ref: 00007FFD65668918
GetWindowLongPtrW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD65668441), ref: 00007FFD6566892B
InvalidateRect.USER32 ref: 00007FFD65668954
FindWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD65668441), ref: 00007FFD6566896F

Strings

TaskbarDa, xrefs: 00007FFD656687B8
TrayNotifyWnd, xrefs: 00007FFD656688F2
ClockButton, xrefs: 00007FFD6566897D
SearchboxTaskbarMode, xrefs: 00007FFD65668866
SOFTWARE\Microsoft\Windows\CurrentVersion\Search, xrefs: 00007FFD65668821
TraySettings, xrefs: 00007FFD656688B4
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FFD656686E2
ShowTaskViewButton, xrefs: 00007FFD6566876E
Shell_TrayWnd, xrefs: 00007FFD656688D9
Shell_SecondaryTrayWnd, xrefs: 00007FFD65668963
TaskbarSmallIcons, xrefs: 00007FFD6566872F
TrayClockWClass, xrefs: 00007FFD65668909

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Window$FindQueryValue$Create$CloseInvalidateLongMessageNotifyRectSend
String ID: ClockButton$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$SOFTWARE\Microsoft\Windows\CurrentVersion\Search$SearchboxTaskbarMode$Shell_SecondaryTrayWnd$Shell_TrayWnd$ShowTaskViewButton$TaskbarDa$TaskbarSmallIcons$TrayClockWClass$TrayNotifyWnd$TraySettings
API String ID: 3959271719-3714636963
Opcode ID: c3af02eb9a0f9d0028d15f10a385c4bd2d7ad293acaf007663b4e5da45b8078f
Instruction ID: 4e0c22c33949db5bcc2b6642dff86ea339c5cf98d18382f91d88b378dd2cfec7
Opcode Fuzzy Hash: c3af02eb9a0f9d0028d15f10a385c4bd2d7ad293acaf007663b4e5da45b8078f
Instruction Fuzzy Hash: 2E915676B08E4ACAEB60CFA4E4607A977B0BB49B58F444635CA4D13AA4DF3CE584C741

Function 00007FFD6568FC70 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 172
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FFD6568FCEB
GetLastError.KERNEL32 ref: 00007FFD6568FCFA
GetFileSizeEx.KERNEL32 ref: 00007FFD6568FD14
GetLastError.KERNEL32 ref: 00007FFD6568FD22
CloseHandle.KERNEL32 ref: 00007FFD6568FD2D
CryptGetHashParam.ADVAPI32 ref: 00007FFD6568FE9D
GetLastError.KERNEL32 ref: 00007FFD6568FEEF
CryptDestroyHash.ADVAPI32 ref: 00007FFD6568FEFC
CryptReleaseContext.ADVAPI32 ref: 00007FFD6568FF08
CloseHandle.KERNELBASE ref: 00007FFD6568FF11

Strings

%c%c, xrefs: 00007FFD6568FEB2

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CryptErrorLast$CloseFileHandleHash$ContextCreateDestroyParamReleaseSize
String ID: %c%c
API String ID: 1362656601-3228636524
Opcode ID: fa4dfc019011472dd1d35effd25235bccfc63980376a3b457180014528bbe418
Instruction ID: f2087786dcf07027c0a7034bd0167439e15c51b76f47ad8f06b48f1ccde4d793
Opcode Fuzzy Hash: fa4dfc019011472dd1d35effd25235bccfc63980376a3b457180014528bbe418
Instruction Fuzzy Hash: FB716C22B08E8AD6EB248FB1E8647BD63A0FB49F98F405135DE4D1AA58DF3CD195C710

Function 00007FFD6565E500 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 122
windowregistrytimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStockObject.GDI32 ref: 00007FFD6565E547
GetModuleHandleW.KERNEL32 ref: 00007FFD6565E557
LoadCursorW.USER32 ref: 00007FFD6565E578
RegisterClassW.USER32 ref: 00007FFD6565E58B
GetModuleHandleW.KERNEL32 ref: 00007FFD6565E593
CreateWindowExW.USER32 ref: 00007FFD6565E5CB
SetEvent.KERNEL32 ref: 00007FFD6565E735

Part of subcall function 00007FFD656907D0: RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,00007FFD6565E4B6), ref: 00007FFD6569080D
Part of subcall function 00007FFD656907D0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00007FFD6565E4B6), ref: 00007FFD65690821

SetTimer.USER32 ref: 00007FFD6565E60A
RegisterHotKey.USER32 ref: 00007FFD6565E630
RegisterHotKey.USER32 ref: 00007FFD6565E64E
GetMessageW.USER32 ref: 00007FFD6565E664
EnterCriticalSection.KERNEL32 ref: 00007FFD6565E699
InvalidateRect.USER32 ref: 00007FFD6565E6D2
LeaveCriticalSection.KERNEL32 ref: 00007FFD6565E6DF
TranslateMessage.USER32 ref: 00007FFD6565E6EF
DispatchMessageW.USER32 ref: 00007FFD6565E6FD
GetMessageW.USER32 ref: 00007FFD6565E713
DestroyWindow.USER32 ref: 00007FFD6565E728

Strings

EP_Service_Window_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FFD6565E55D

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Message$Register$CriticalHandleModuleSectionWindow$ClassCloseCreateCursorDestroyDispatchEnterEventInvalidateLeaveLoadObjectOpenRectStockTimerTranslate
String ID: EP_Service_Window_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}
API String ID: 124686274-1881722731
Opcode ID: a1be8459bcfd7c7e29579554fa6886f80e0ea524c161cc7a1dc958779796ac26
Instruction ID: 23b7051e076c35748e372086acba8224ab39a464deaee4a55372417f146dc6af
Opcode Fuzzy Hash: a1be8459bcfd7c7e29579554fa6886f80e0ea524c161cc7a1dc958779796ac26
Instruction Fuzzy Hash: 8551F735B08E4AC1EB249FA5F86476A73A5FF94F94F500035CA4E46AA4DF3DE495CB00

Function 00007FFD6565E860 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 173
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FFD6565E8A0
OpenProcessToken.ADVAPI32 ref: 00007FFD6565E8B2
GetTokenInformation.KERNELBASE ref: 00007FFD6565E8D8
GetLastError.KERNEL32 ref: 00007FFD6565E8E6
GetTokenInformation.KERNELBASE ref: 00007FFD6565E923
GetLengthSid.ADVAPI32 ref: 00007FFD6565E936
CopySid.ADVAPI32 ref: 00007FFD6565E95D
DeriveAppContainerSidFromAppContainerName.USERENV ref: 00007FFD6565E986
SetEntriesInAclW.ADVAPI32 ref: 00007FFD6565EA19
InitializeSecurityDescriptor.ADVAPI32 ref: 00007FFD6565EA42
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FFD6565EA5B
LocalFree.KERNEL32 ref: 00007FFD6565EA7D
CreateMutexExW.KERNELBASE ref: 00007FFD6565EAB2
FreeSid.ADVAPI32 ref: 00007FFD6565EAE7

Strings

Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy, xrefs: 00007FFD6565E97F
[SMA] Advertising successful animations patching., xrefs: 00007FFD6565EABD
EPStart10_AnimationsPatched_{A6EA9C2D-4982-4827-9204-0AC532959F6D}, xrefs: 00007FFD6565EA95

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Token$ContainerDescriptorFreeInformationProcessSecurity$CopyCreateCurrentDaclDeriveEntriesErrorFromInitializeLastLengthLocalMutexNameOpen
String ID: EPStart10_AnimationsPatched_{A6EA9C2D-4982-4827-9204-0AC532959F6D}$Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy$[SMA] Advertising successful animations patching.
API String ID: 2912553727-3824306247
Opcode ID: 77db84de59c62dfd770b2048574863a4296daba2a7a34100df496ef98e8fba53
Instruction ID: cc8c334aa60ff21e4f0309e46be50fdc814ed7e490634e11596bd4ef81a73eeb
Opcode Fuzzy Hash: 77db84de59c62dfd770b2048574863a4296daba2a7a34100df496ef98e8fba53
Instruction Fuzzy Hash: FC712A32B48A46CAFF509FA1D4203B933B2BB44B98F054535DE4E1BA99DE3CE995C340

Function 00007FFD6567A120 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 78windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00007FFD6567A141
WaitForSingleObject.KERNEL32 ref: 00007FFD6567A179
GetShellWindow.USER32 ref: 00007FFD6567A190
SleepEx.KERNELBASE ref: 00007FFD6567A1A3
GetWindowThreadProcessId.USER32 ref: 00007FFD6567A1BF
SetWindowsHookExW.USER32 ref: 00007FFD6567A1D7
GetMessageW.USER32 ref: 00007FFD6567A20B
TranslateMessage.USER32 ref: 00007FFD6567A225
DispatchMessageW.USER32 ref: 00007FFD6567A230
GetMessageW.USER32 ref: 00007FFD6567A243

Strings

Progman hook: %d, xrefs: 00007FFD6567A1E0
Started "Open Start on current monitor" thread., xrefs: 00007FFD6567A17F
Failed to start "Open Start on current monitor" thread., xrefs: 00007FFD6567A14C
Progman: %d, xrefs: 00007FFD6567A1AE
ShellDesktopSwitchEvent, xrefs: 00007FFD6567A133
Ended "Open Start on current monitor" thread., xrefs: 00007FFD6567A24D

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Message$Window$CreateDispatchEventHookObjectProcessShellSingleSleepThreadTranslateWaitWindows
String ID: Ended "Open Start on current monitor" thread.$Failed to start "Open Start on current monitor" thread.$Progman hook: %d$Progman: %d$ShellDesktopSwitchEvent$Started "Open Start on current monitor" thread.
API String ID: 2718461970-1416847937
Opcode ID: 90c938bcfe6ddd29e0c9442af5c55c2c7d718c590cd870c2b4843c8362eab85f
Instruction ID: 35e3fab112e0eb5058d08be256e3813fbe73dbc2c080309f38fe83363b116739
Opcode Fuzzy Hash: 90c938bcfe6ddd29e0c9442af5c55c2c7d718c590cd870c2b4843c8362eab85f
Instruction Fuzzy Hash: 14314B21F18D4AC2FB20ABA1E83177A6371BF98F44F845235D94E46664EE2CE595C700

Function 00007FFD656935A0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 92memorywindowCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007FFD65693613
GetLastError.KERNEL32 ref: 00007FFD6569364C
FormatMessageA.KERNEL32 ref: 00007FFD6569367D
GetLastError.KERNEL32 ref: 00007FFD656936C1

Strings

Unknown Error, xrefs: 00007FFD6569368A
Failed to unprotect memory %p (size=%llu) <- %p (size=%llu, error=%lu(%s)), xrefs: 00007FFD656936CB
unprotect memory %p (size=%llu) <- %p (size=%llu), xrefs: 00007FFD65693621

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ErrorLast$FormatMessageProtectVirtual
String ID: unprotect memory %p (size=%llu) <- %p (size=%llu)$Failed to unprotect memory %p (size=%llu) <- %p (size=%llu, error=%lu(%s))$Unknown Error
API String ID: 2888148163-2742179861
Opcode ID: 76f81bbd27526eec4d54eb52136fd5565e358d5aa963c2d15698727e3856a4dd
Instruction ID: 2ff24a687723de4fc6452f2ad5cc41a518e127a3ed53934015c1f5b7264a7e80
Opcode Fuzzy Hash: 76f81bbd27526eec4d54eb52136fd5565e358d5aa963c2d15698727e3856a4dd
Instruction Fuzzy Hash: A1414B32B18E8AC5EB608F91E8603B967A0FB59F88F044136EA8D57759DF3CD495C700

Function 00007FFD6565D920 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49fileCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FFD6565D96D
FindFirstFileW.KERNELBASE ref: 00007FFD6565D999
FindClose.KERNEL32 ref: 00007FFD6565D9A8

Part of subcall function 00007FFD65652890: GetModuleHandleW.KERNEL32 ref: 00007FFD656528AF
Part of subcall function 00007FFD65652890: GetProcAddress.KERNEL32 ref: 00007FFD656528C8
Part of subcall function 00007FFD65652890: RegOpenKeyExW.KERNELBASE ref: 00007FFD6565293F
Part of subcall function 00007FFD65652890: RegQueryValueExW.KERNELBASE ref: 00007FFD6565296F

GetWindowsDirectoryW.KERNEL32 ref: 00007FFD6565D9D8

Part of subcall function 00007FFD656A7C0C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7C35

FindFirstFileW.KERNELBASE ref: 00007FFD6565DA04

Strings

\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI.dll, xrefs: 00007FFD6565D973
\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll, xrefs: 00007FFD6565D9DE

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Find$DirectoryFileFirstWindows$AddressCloseHandleModuleOpenProcQueryValue_invalid_parameter_noinfo
String ID: \SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI.dll$\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll
API String ID: 658624814-2596525942
Opcode ID: 83d2bc5265cd564426ecaa33edb809e73b5fea43d63d5d8a03987a1c32f5fdb0
Instruction ID: 20ff701cb280640fc4fe1f560bdfb140a118002eef3be112959f422c469e698d
Opcode Fuzzy Hash: 83d2bc5265cd564426ecaa33edb809e73b5fea43d63d5d8a03987a1c32f5fdb0
Instruction Fuzzy Hash: F421E071F18D4AC1EB60AB64E8653EA2361FB95B28F801232C16E465E4DF7CD58DC740

Function 00007FFD6565D7C0 Relevance: 6.0, APIs: 4, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FFD6565D829
CheckTokenMembership.KERNELBASE ref: 00007FFD6565D83F
GetLastError.KERNEL32 ref: 00007FFD6565D849
FreeSid.ADVAPI32 ref: 00007FFD6565D85B

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: AllocateCheckErrorFreeInitializeLastMembershipToken
String ID:
API String ID: 3835361876-0
Opcode ID: 9bc4818ac291dff88db8240e3eeb39b943aa672b01a7781d9cca6c2466c65656
Instruction ID: 96a54cfeaa8344e833f0c50fe6a38dc563b27f78b0109efece7a6aa1205078b2
Opcode Fuzzy Hash: 9bc4818ac291dff88db8240e3eeb39b943aa672b01a7781d9cca6c2466c65656
Instruction Fuzzy Hash: 8411E472B08B4586EB508F6AF49031AF6E8FFD4B84F50402AE68987A69DF7CD445CF40

Function 00007FFD6566A6C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00007FFD6566A721

Part of subcall function 00007FFD65652890: GetModuleHandleW.KERNEL32 ref: 00007FFD656528AF
Part of subcall function 00007FFD65652890: GetProcAddress.KERNEL32 ref: 00007FFD656528C8
Part of subcall function 00007FFD65652890: RegOpenKeyExW.KERNELBASE ref: 00007FFD6565293F
Part of subcall function 00007FFD65652890: RegQueryValueExW.KERNELBASE ref: 00007FFD6565296F

CoCreateInstance.COMBASE ref: 00007FFD6566A8E5

Strings

Taskbar10.cpp, xrefs: 00007FFD6566A819, 00007FFD6566A8B0

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CreateInstance$AddressHandleModuleOpenProcQueryValue
String ID: Taskbar10.cpp
API String ID: 1469795854-890630466
Opcode ID: 60967b9696fd8883450f0bcb51fd51fa93ffb76d10351a79bb68758c02aca6cd
Instruction ID: 44d6920417c33a47d3f3f5cf010bca59ad6e090bd4b970524ddd0ca7fe16d150
Opcode Fuzzy Hash: 60967b9696fd8883450f0bcb51fd51fa93ffb76d10351a79bb68758c02aca6cd
Instruction Fuzzy Hash: 0C512535B48F5AC1EB909B95E8A437923A1BB54F84F005536DA4E037A0CF7CE8C9C742

Function 00007FFD65692D90 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00007FFD65691E89), ref: 00007FFD65692DA5

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: e4d82352877221a0b517692e33a5f3ddb88e79afc553e17f30fd7a49fed66e58
Instruction ID: 15bf90e6add16253a226234dbdfe1124d695773b7141d09e6589821092231b4c
Opcode Fuzzy Hash: e4d82352877221a0b517692e33a5f3ddb88e79afc553e17f30fd7a49fed66e58
Instruction Fuzzy Hash: 0AF05876F0AD46C2EF148B81E86072873A2FB59F88F000034DA4D82324DE3CD190CB00

Function 00007FFD6568B190 Relevance: 70.4, APIs: 14, Strings: 26, Instructions: 427
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FFD6566E9FC), ref: 00007FFD6568B1C4
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FFD6566E9FC), ref: 00007FFD6568B1CD
K32GetModuleInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FFD6566E9FC), ref: 00007FFD6568B1E3

Part of subcall function 00007FFD6568AC80: GetSystemDirectoryW.KERNEL32 ref: 00007FFD6568ACAB
Part of subcall function 00007FFD6568AC80: CreateFileW.KERNELBASE ref: 00007FFD6568ACF1

VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FFD6566E9FC), ref: 00007FFD6568B2E4
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FFD6566E9FC), ref: 00007FFD6568B303
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FFD6566E9FC), ref: 00007FFD6568B4C6
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FFD6566E9FC), ref: 00007FFD6568B4FF
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FFD6566E9FC), ref: 00007FFD6568B618
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FFD6566E9FC), ref: 00007FFD6568B653
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FFD6566E9FC), ref: 00007FFD6568B70F
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FFD6566E9FC), ref: 00007FFD6568B74D
LoadLibraryExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FFD6566E9FC), ref: 00007FFD6568B766
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FFD6566E9FC), ref: 00007FFD6568B76F
K32GetModuleInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FFD6566E9FC), ref: 00007FFD6568B785

Strings

twinui.pcshell.dll, xrefs: 00007FFD6568B1B9
API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL, xrefs: 00007FFD6568B8BA
[AC] blockBegin = %llX, xrefs: 00007FFD6568B464
[CC] blockBegin = %llX, xrefs: 00007FFD6568B5B6
[CC] rcWorkAssignment = %llX, xrefs: 00007FFD6568B57B
x?xxxx?xx?x????xxxx, xrefs: 00007FFD6568B6A5
xxxx?xxxxx?x, xrefs: 00007FFD6568B518
[CC] Patched!, xrefs: 00007FFD6568B659
[TV] Patched!, xrefs: 00007FFD6568B753
[AC] rcMonitorAssignment = %llX, xrefs: 00007FFD6568B3EA
Failed to hook CMultitaskingViewManager::_CreateXamlMTVHost(). rv = %d, xrefs: 00007FFD6568B34F
Setup twinui.pcshell functions done, xrefs: 00007FFD6568B8C6
RegGetValueW, xrefs: 00007FFD6568B8B3
[CC] blockEnd = %llX, xrefs: 00007FFD6568B5F2
[AC] Patched!, xrefs: 00007FFD6568B505
xxx?xxxxx?x, xrefs: 00007FFD6568B550
[CC] rcMonitorAssignment = %llX, xrefs: 00007FFD6568B541
Failed to hook PenMenuSystemTrayManager::GetDynamicSystemTrayHeightForMonitor(). rv = %d, xrefs: 00007FFD6568B7F8
[TV] firstCallPrep = %llX, xrefs: 00007FFD6568B6CD
xxx?xxx?x???xxx, xrefs: 00007FFD6568B3B8
PenMenuSystemTrayManager::GetDynamicSystemTrayHeightForMonitor() = %llX, xrefs: 00007FFD6568B7C2
[TV] firstCallCall = %llX, xrefs: 00007FFD6568B6EB
x?xxx?xx?x????xxxx, xrefs: 00007FFD6568B672
xxxx?xxxx?xxxxxxx?xxx, xrefs: 00007FFD6568B797
[AC] blockEnd = %llX, xrefs: 00007FFD6568B4A0
Windows.Internal.HardwareConfirmator.dll, xrefs: 00007FFD6568B75F

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ProtectVirtual$CurrentInformationLibraryLoadModuleProcess$CreateDirectoryFileSystem
String ID: API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL$Failed to hook CMultitaskingViewManager::_CreateXamlMTVHost(). rv = %d$Failed to hook PenMenuSystemTrayManager::GetDynamicSystemTrayHeightForMonitor(). rv = %d$PenMenuSystemTrayManager::GetDynamicSystemTrayHeightForMonitor() = %llX$RegGetValueW$Setup twinui.pcshell functions done$Windows.Internal.HardwareConfirmator.dll$[AC] Patched!$[AC] blockBegin = %llX$[AC] blockEnd = %llX$[AC] rcMonitorAssignment = %llX$[CC] Patched!$[CC] blockBegin = %llX$[CC] blockEnd = %llX$[CC] rcMonitorAssignment = %llX$[CC] rcWorkAssignment = %llX$[TV] Patched!$[TV] firstCallCall = %llX$[TV] firstCallPrep = %llX$twinui.pcshell.dll$x?xxx?xx?x????xxxx$x?xxxx?xx?x????xxxx$xxx?xxx?x???xxx$xxx?xxxxx?x$xxxx?xxxx?xxxxxxx?xxx$xxxx?xxxxx?x
API String ID: 823495189-2291248886
Opcode ID: 8854462bb2b8e82a1f37dfa626f4381d32bf278cabee296ad67b2b26d0c190aa
Instruction ID: 40c639635916ecce3774bb1baf8e7c9b997d7b877eb345d6363d7ed6a7954e09
Opcode Fuzzy Hash: 8854462bb2b8e82a1f37dfa626f4381d32bf278cabee296ad67b2b26d0c190aa
Instruction Fuzzy Hash: 35222621F08E4AD5EB50DFA1D8643B923A1EB40F98F944236DA0D476A5EF3CE9C9C750

Function 00007FFD65689AC0 Relevance: 56.4, APIs: 12, Strings: 20, Instructions: 370
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD65689EC7
VirtualProtect.KERNELBASE ref: 00007FFD65689EE8
VirtualProtect.KERNELBASE ref: 00007FFD65689F19
VirtualProtect.KERNELBASE ref: 00007FFD65689F3A
VirtualProtect.KERNELBASE ref: 00007FFD65689F6B
VirtualProtect.KERNELBASE ref: 00007FFD65689F8C
VirtualProtect.KERNELBASE ref: 00007FFD65689FBD
VirtualProtect.KERNELBASE ref: 00007FFD65689FDE
VirtualProtect.KERNEL32 ref: 00007FFD6568A006
VirtualProtect.KERNEL32 ref: 00007FFD6568A026
VirtualProtect.KERNEL32 ref: 00007FFD6568A043
VirtualProtect.KERNEL32 ref: 00007FFD6568A063

Strings

xxxxxxxxxx, xrefs: 00007FFD65689D14
xxxx????xxxx, xrefs: 00007FFD65689C8B
[SMA] Not all offsets were found, cannot perform patch, xrefs: 00007FFD6568A0AB
[SMA] matchVtable = %llX, xrefs: 00007FFD65689B39
Failed to hook CStartExperienceManager::GetMonitorInformation(). rv = %d, xrefs: 00007FFD6568A098
[SMA] matchTransitioningToCortanaField = %llX, +0x%X, xrefs: 00007FFD65689C1A
xxx????xx????xxxx, xrefs: 00007FFD65689BA1
[SMA] CStartExperienceManager::GetMonitorInformation() = %llX, xrefs: 00007FFD65689C75
[SMA] matchAnimationHelperFields = %llX, +0x%X, +0x%X, xrefs: 00007FFD65689BC0
xxx????xxxxxxxxx, xrefs: 00007FFD65689B4B
x??xxxxxx, xrefs: 00007FFD65689D55, 00007FFD65689D8F, 00007FFD65689DCD, 00007FFD65689E0E
[SMA] matchHideB in CStartExperienceManager::Hide() = %llX, xrefs: 00007FFD65689E39
[SMA] CExperienceManagerAnimationHelper::Begin() = %llX, xrefs: 00007FFD65689D05
xx?x????x?xxxx????xxx?x, xrefs: 00007FFD65689C3A
xxxxxx????x????xxxx, xrefs: 00007FFD65689CC9
[SMA] CExperienceManagerAnimationHelper::End() = %llX, xrefs: 00007FFD65689D46
[SMA] matchSingleViewShellExperienceFields = %llX, xrefs: 00007FFD65689B8C
xx????xx?xxxx, xrefs: 00007FFD65689BEC
[SMA] matchHideA in CStartExperienceManager::Hide() = %llX, xrefs: 00007FFD65689D7D, 00007FFD65689DF5
xxxxxxx????xxxxxxxxx, xrefs: 00007FFD65689AE8

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ProtectVirtual
String ID: Failed to hook CStartExperienceManager::GetMonitorInformation(). rv = %d$[SMA] CExperienceManagerAnimationHelper::Begin() = %llX$[SMA] CExperienceManagerAnimationHelper::End() = %llX$[SMA] CStartExperienceManager::GetMonitorInformation() = %llX$[SMA] Not all offsets were found, cannot perform patch$[SMA] matchAnimationHelperFields = %llX, +0x%X, +0x%X$[SMA] matchHideA in CStartExperienceManager::Hide() = %llX$[SMA] matchHideB in CStartExperienceManager::Hide() = %llX$[SMA] matchSingleViewShellExperienceFields = %llX$[SMA] matchTransitioningToCortanaField = %llX, +0x%X$[SMA] matchVtable = %llX$x??xxxxxx$xx????xx?xxxx$xx?x????x?xxxx????xxx?x$xxx????xx????xxxx$xxx????xxxxxxxxx$xxxx????xxxx$xxxxxx????x????xxxx$xxxxxxx????xxxxxxxxx$xxxxxxxxxx
API String ID: 544645111-3813412712
Opcode ID: 463401602733c6c049993bda1178c1a1fd5eb53c5a08e06d197a52809546894a
Instruction ID: 6ba4604e243e7980a5ea2b825c5f8c26aa2856a7fa1e60040d89302191fb9576
Opcode Fuzzy Hash: 463401602733c6c049993bda1178c1a1fd5eb53c5a08e06d197a52809546894a
Instruction Fuzzy Hash: 45025D21B19E4AC2EB60CFA5E8607AA63A1FF44B88F444536DA4D47B94DF3CE589C710

Function 00007FFD6568AC80 Relevance: 47.6, APIs: 5, Strings: 22, Instructions: 332
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32 ref: 00007FFD6568ACAB

Part of subcall function 00007FFD656A7C0C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7C35

CreateFileW.KERNELBASE ref: 00007FFD6568ACF1
GetFileSize.KERNEL32 ref: 00007FFD6568AD2E
ReadFile.KERNELBASE ref: 00007FFD6568AD58

Strings

xx?x????xxxxxxx????xxxx????x, xrefs: 00007FFD6568AFA1
xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xxx????xxx, xrefs: 00007FFD6568AEA1
xx?x????xxxxxxx????xxxx?xxx, xrefs: 00007FFD6568AF82
xxx?????x?x??x??x?xxxxxxxx, xrefs: 00007FFD6568B022, 00007FFD6568B0C8
xxxx??x??x?xxxxxx????x, xrefs: 00007FFD6568AFF3, 00007FFD6568B09D
ImmersiveContextMenuHelper::ApplyOwnerDrawToMenu() = %lX, xrefs: 00007FFD6568AECA
CMultitaskingViewManager::_CreateDCompMTVHost() = %lX, xrefs: 00007FFD6568B12E
CMultitaskingViewManager::_CreateXamlMTVHost() = %lX, xrefs: 00007FFD6568B07A
CLauncherTipContextMenu::GetMenuItemsAsync() = %lX, xrefs: 00007FFD6568AE81
xxxx?xxxx?xxxxxxxxxxxxxxx, xrefs: 00007FFD6568AEEA
xxxxx????x????xxx, xrefs: 00007FFD6568ADAE
ImmersiveContextMenuHelper::RemoveOwnerDrawFromMenu() = %lX, xrefs: 00007FFD6568AF13
xxx????xxxxxxxxx????xxxxxxx????xxxxxxx????xxxxxxx????xxxx, xrefs: 00007FFD6568ADEF
\twinui.pcshell.dll, xrefs: 00007FFD6568ACB1
CImmersiveContextMenuOwnerDrawHelper::s_ContextMenuWndProc() = %lX, xrefs: 00007FFD6568ADDC
Failed to read twinui.pcshell.dll, xrefs: 00007FFD6568B13C
ILauncherTipContextMenuVtbl = %lX, xrefs: 00007FFD6568AE4D
Failed to open twinui.pcshell.dll, xrefs: 00007FFD6568AD00
CLauncherTipContextMenu::_ExecuteCommand() = %lX, xrefs: 00007FFD6568AFD0
CLauncherTipContextMenu::_ExecuteShutdownCommand() = %lX, xrefs: 00007FFD6568AF62
xx?x????xx?xx?xxxx????x, xrefs: 00007FFD6568AF33
CLauncherTipContextMenu::ShowLauncherTipContextMenu() = %lX, xrefs: 00007FFD6568AE6A

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: File$CreateDirectoryReadSizeSystem_invalid_parameter_noinfo
String ID: CImmersiveContextMenuOwnerDrawHelper::s_ContextMenuWndProc() = %lX$CLauncherTipContextMenu::GetMenuItemsAsync() = %lX$CLauncherTipContextMenu::ShowLauncherTipContextMenu() = %lX$CLauncherTipContextMenu::_ExecuteCommand() = %lX$CLauncherTipContextMenu::_ExecuteShutdownCommand() = %lX$CMultitaskingViewManager::_CreateDCompMTVHost() = %lX$CMultitaskingViewManager::_CreateXamlMTVHost() = %lX$Failed to open twinui.pcshell.dll$Failed to read twinui.pcshell.dll$ILauncherTipContextMenuVtbl = %lX$ImmersiveContextMenuHelper::ApplyOwnerDrawToMenu() = %lX$ImmersiveContextMenuHelper::RemoveOwnerDrawFromMenu() = %lX$\twinui.pcshell.dll$xx?x????xx?xx?xxxx????x$xx?x????xxxxxxx????xxxx????x$xx?x????xxxxxxx????xxxx?xxx$xxx?????x?x??x??x?xxxxxxxx$xxx????xxxxxxxxx????xxxxxxx????xxxxxxx????xxxxxxx????xxxx$xxxx??x??x?xxxxxx????x$xxxx?xxxx?xxxxxxxxxxxxxxx$xxxxx????x????xxx$xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xxx????xxx
API String ID: 1602095072-688399519
Opcode ID: 88517552822ccb7787b5f9b1f2ba9f59645bc4d2d2f66214d2ecf1fcfb0b0a1e
Instruction ID: 251890c862386d9d5b39d855b195750fb3e3aba84c91803636b6a01b2a8da6d5
Opcode Fuzzy Hash: 88517552822ccb7787b5f9b1f2ba9f59645bc4d2d2f66214d2ecf1fcfb0b0a1e
Instruction Fuzzy Hash: 34F17F62B0894AC6EB64DFA4D8603B933A1AF40F64F444731DA5E832E5DF3CE989C750

Function 00007FFD656929B0 Relevance: 37.0, APIs: 11, Strings: 10, Instructions: 226
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 00007FFD656929EA
VirtualQuery.KERNEL32 ref: 00007FFD65692A85
GetLastError.KERNEL32 ref: 00007FFD65692A94
FormatMessageA.KERNEL32 ref: 00007FFD65692AC7
VirtualAlloc.KERNELBASE ref: 00007FFD65692B0E
GetLastError.KERNEL32 ref: 00007FFD65692B20
FormatMessageA.KERNEL32 ref: 00007FFD65692B53
VirtualAlloc.KERNELBASE ref: 00007FFD65692C08
GetLastError.KERNEL32 ref: 00007FFD65692C1A
FormatMessageA.KERNEL32 ref: 00007FFD65692C4D
VirtualFree.KERNEL32 ref: 00007FFD65692CC4

Strings

Unknown Error, xrefs: 00007FFD65692AD7, 00007FFD65692B5F, 00007FFD65692C59
Failed to reserve memory %p (hint=%p, size=%llu, errro=%lu(%s)), xrefs: 00007FFD65692BA2
free, xrefs: 00007FFD656929F9
process map: %08llx-%08llx %s, xrefs: 00007FFD65692A14
change hint address from %p to %p, xrefs: 00007FFD65692AE6
commit memory %p for read-write (hint=%p, size=%llu), xrefs: 00007FFD65692CD6
Failed to execute VirtualQuery (addr=%p, error=%lu(%s)), xrefs: 00007FFD65692D58
reserve memory %p (hint=%p, size=%llu), xrefs: 00007FFD65692BD8
used, xrefs: 00007FFD65692A08
Failed to commit memory %p for read-write (hint=%p, size=%llu, error=%lu(%s)), xrefs: 00007FFD65692C94

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Virtual$ErrorFormatLastMessage$AllocQuery$Free
String ID: change hint address from %p to %p$ commit memory %p for read-write (hint=%p, size=%llu)$ process map: %08llx-%08llx %s$ reserve memory %p (hint=%p, size=%llu)$Failed to commit memory %p for read-write (hint=%p, size=%llu, error=%lu(%s))$Failed to execute VirtualQuery (addr=%p, error=%lu(%s))$Failed to reserve memory %p (hint=%p, size=%llu, errro=%lu(%s))$Unknown Error$free$used
API String ID: 2999834170-966645287
Opcode ID: 8954e7f1f4c74206c707921dadd97844bae45565a732bf98f7726cddd87cb0b5
Instruction ID: 6b4ef4edc852c53e98b3d6cf4968150fff38ab8fa77e0d4650e1f7d3251e5a71
Opcode Fuzzy Hash: 8954e7f1f4c74206c707921dadd97844bae45565a732bf98f7726cddd87cb0b5
Instruction Fuzzy Hash: 80A16F21B1DE4BC6EB608B95E8603B563A1FB5AF88F440135D98D47BA4EF3CD595CB00

Function 00007FFD656689C0 Relevance: 35.3, APIs: 9, Strings: 11, Instructions: 301
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetAncestor.USER32 ref: 00007FFD65668B65
GetClassNameW.USER32 ref: 00007FFD65668B7C
GetClassNameW.USER32 ref: 00007FFD65668C38
CreateWindowExW.USER32 ref: 00007FFD65668CCD
#410.COMCTL32 ref: 00007FFD65668E09
GetCurrentThreadId.KERNEL32 ref: 00007FFD65668E0F
SetWindowsHookExW.USER32 ref: 00007FFD65668E27
FindWindowW.USER32 ref: 00007FFD65668E8E
#410.COMCTL32 ref: 00007FFD65668EAF

Strings

ReBarWindow32, xrefs: 00007FFD65668BC0, 00007FFD65668E76
TrayNotifyWnd, xrefs: 00007FFD65668A7D
ClockButton, xrefs: 00007FFD65668D35
SysListView32, xrefs: 00007FFD65668AEA
TrayShowDesktopButtonWClass, xrefs: 00007FFD65668D7D
Shell_TrayWnd, xrefs: 00007FFD65668C49, 00007FFD65668DC9, 00007FFD65668E36
Shell_SecondaryTrayWnd, xrefs: 00007FFD65668E43
CabinetWClass, xrefs: 00007FFD65668B8D
TrayClockWClass, xrefs: 00007FFD65668CEC
SysTreeView32, xrefs: 00007FFD65668B16
NotifyIconOverflowWindow, xrefs: 00007FFD65668AAA

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: #410ClassNameWindow$AncestorCreateCurrentFindHookThreadWindows
String ID: CabinetWClass$ClockButton$NotifyIconOverflowWindow$ReBarWindow32$Shell_SecondaryTrayWnd$Shell_TrayWnd$SysListView32$SysTreeView32$TrayClockWClass$TrayNotifyWnd$TrayShowDesktopButtonWClass
API String ID: 2746137922-373551488
Opcode ID: 7fff841f66bb9f0377a613a03398ed6c11275bed224b490feb09b733b40c26fb
Instruction ID: 62b745b67343563928c0b8aaba7395d7efcba3372d249fef88e78599c8910f86
Opcode Fuzzy Hash: 7fff841f66bb9f0377a613a03398ed6c11275bed224b490feb09b733b40c26fb
Instruction Fuzzy Hash: 6CE16DA6B48E4AC5EB649B95E42077973E1FB95F50F804131DE4E426A8EF3CE8D1C701

Function 00007FFD6565E350 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 106
registrywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterWindowMessageW.USER32 ref: 00007FFD6565E37F
DefWindowProcW.USER32 ref: 00007FFD6565E4E1

Strings

Windows.UI.Core.CoreWindow, xrefs: 00007FFD6565E44A
TaskbarAl, xrefs: 00007FFD6565E476
Refreshed Spotlight, xrefs: 00007FFD6565E4CA
d, xrefs: 00007FFD6565E4AB
TaskbarCreated, xrefs: 00007FFD6565E378
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FFD6565E485

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Window$MessageProcRegister
String ID: Refreshed Spotlight$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$TaskbarAl$TaskbarCreated$Windows.UI.Core.CoreWindow$d
API String ID: 136062168-2101710627
Opcode ID: 58ce70c73b0260ac4f8212daba56987900227f23a0229d149a55cebbedb80899
Instruction ID: 87b2ab270d020b4e06d3d3ff1160ed0e5a383d30f644a19bd59d0469cdb64dd7
Opcode Fuzzy Hash: 58ce70c73b0260ac4f8212daba56987900227f23a0229d149a55cebbedb80899
Instruction Fuzzy Hash: 40416665F5CE0BC5FF609BA1E9747B92361AF55FA4F440272D90F06690DF2CA8C4C601

Function 00007FFD656890A0 Relevance: 21.2, APIs: 4, Strings: 8, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007FFD656892E4
VirtualProtect.KERNELBASE ref: 00007FFD65689336
VirtualProtect.KERNELBASE ref: 00007FFD6568935B

Part of subcall function 00007FFD65652890: GetModuleHandleW.KERNEL32 ref: 00007FFD656528AF
Part of subcall function 00007FFD65652890: GetProcAddress.KERNEL32 ref: 00007FFD656528C8
Part of subcall function 00007FFD65652890: RegOpenKeyExW.KERNELBASE ref: 00007FFD6565293F
Part of subcall function 00007FFD65652890: RegQueryValueExW.KERNELBASE ref: 00007FFD6565296F

VirtualProtect.KERNELBASE ref: 00007FFD65689383

Strings

xxx????xx, xrefs: 00007FFD656890CC
[HC] match2 = %llX, xrefs: 00007FFD65689139
xxx?xxxx, xrefs: 00007FFD6568910A
[HC] Patched!, xrefs: 00007FFD65689389
[HC] writeAt = %llX, xrefs: 00007FFD6568918E
xxx?x, xrefs: 00007FFD65689159
[HC] match1 = %llX, xrefs: 00007FFD656890EC
[HC] cleanup = %llX-%llX, xrefs: 00007FFD656891E6

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ProtectVirtual$AddressHandleModuleOpenProcQueryValue
String ID: [HC] Patched!$[HC] cleanup = %llX-%llX$[HC] match1 = %llX$[HC] match2 = %llX$[HC] writeAt = %llX$xxx????xx$xxx?x$xxx?xxxx
API String ID: 1029361184-3401359449
Opcode ID: a7a250d5ffd1d1e887633173dbc5b9b45788254cce80a72b013f6192cd1d282f
Instruction ID: b76dece946b788c326601a3dc146f4fc9deddda517a5bdface7a816408ed8f79
Opcode Fuzzy Hash: a7a250d5ffd1d1e887633173dbc5b9b45788254cce80a72b013f6192cd1d282f
Instruction Fuzzy Hash: 46919821B18E5ACAEB10CFB1D8642B977B1AB44F88F448136CA0E17B89DE3CE585C750

Function 00007FFD6565F530 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 92librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE ref: 00007FFD6565F547
GetModuleHandleW.KERNEL32 ref: 00007FFD6565F560

Part of subcall function 00007FFD6565F230: RegGetValueW.ADVAPI32 ref: 00007FFD6565F287

GetProcAddress.KERNEL32 ref: 00007FFD6565F59A

Part of subcall function 00007FFD6565F170: GetCurrentProcess.KERNEL32 ref: 00007FFD6565F190
Part of subcall function 00007FFD6565F170: K32GetModuleInformation.KERNEL32 ref: 00007FFD6565F1A7
Part of subcall function 00007FFD6565F170: VirtualProtect.KERNEL32 ref: 00007FFD6565F1F5
Part of subcall function 00007FFD6565F170: VirtualProtect.KERNEL32 ref: 00007FFD6565F214

WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6565F5CF
VirtualProtect.KERNEL32 ref: 00007FFD6565F63A
VirtualProtect.KERNEL32 ref: 00007FFD6565F671
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6565F692

Strings

DllGetActivationFactory, xrefs: 00007FFD6565F582
Error in Windows11v22H2_combase_LoadLibraryExW on DllGetActivationFactory, xrefs: 00007FFD6565F5A8
Windows.UI.Xaml.dll, xrefs: 00007FFD6565F559
Error in Windows11v22H2_combase_LoadLibraryExW on WindowsCreateStringReference, xrefs: 00007FFD6565F5D9
Windows.UI.Xaml.Hosting.WindowsXamlManager, xrefs: 00007FFD6565F5C8

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ProtectVirtual$ModuleStringWindows$AddressCreateCurrentDeleteHandleInformationLibraryLoadProcProcessReferenceValue
String ID: DllGetActivationFactory$Error in Windows11v22H2_combase_LoadLibraryExW on DllGetActivationFactory$Error in Windows11v22H2_combase_LoadLibraryExW on WindowsCreateStringReference$Windows.UI.Xaml.Hosting.WindowsXamlManager$Windows.UI.Xaml.dll
API String ID: 2113071911-1359692214
Opcode ID: 6a485842b1050d629c3e66bc8dcef4c77c58c436b41d0e9cebd794aef8aec54d
Instruction ID: 2d8d19cd44e9c53f1a9c003f9e1c1ab5205b675a04447f933401adfaebc90413
Opcode Fuzzy Hash: 6a485842b1050d629c3e66bc8dcef4c77c58c436b41d0e9cebd794aef8aec54d
Instruction Fuzzy Hash: 06411E66B19E4AC1EB60DFA1E960369A360FF88F94F441036EA4E47B64DF3CE595C700

Function 00007FFD6566B780 Relevance: 19.3, APIs: 4, Strings: 7, Instructions: 62registryCOMMON

Download Yara Rule

APIs

RegGetValueW.KERNELBASE ref: 00007FFD6566B829
GetDpiForSystem.USER32 ref: 00007FFD6566B84F
MulDiv.KERNEL32 ref: 00007FFD6566B85F
GetSystemMetrics.USER32 ref: 00007FFD6566B869

Strings

IconVerticalSpacing, xrefs: 00007FFD6566B7ED
Control Panel\Desktop\WindowMetrics, xrefs: 00007FFD6566B808
MinWidth, xrefs: 00007FFD6566B7D5
&, xrefs: 00007FFD6566B7DC
9, xrefs: 00007FFD6566B83F
IconSpacing, xrefs: 00007FFD6566B7E1
', xrefs: 00007FFD6566B7EA

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: System$MetricsValue
String ID: &$'$9$Control Panel\Desktop\WindowMetrics$IconSpacing$IconVerticalSpacing$MinWidth
API String ID: 1597967150-2735893900
Opcode ID: 938e79a5f4417f6df2efa723607223f6b844bda69fdcea2ab12127382762ddd3
Instruction ID: 17b500aea19aa3d5f8d9b69cf8d1a13a3db9172cb6059c8dbb18b64597326345
Opcode Fuzzy Hash: 938e79a5f4417f6df2efa723607223f6b844bda69fdcea2ab12127382762ddd3
Instruction Fuzzy Hash: C7219E35B0CE4AC2EB609B91E4A43AA63A0FF84B40F900136E54D466B5DF7DE8C4C741

Function 00007FFD65688CC0 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007FFD65688E32
VirtualProtect.KERNELBASE ref: 00007FFD65688E70

Strings

[TC] blockBegin = %llX, xrefs: 00007FFD65688DC5
xxx??xxx?xx, xrefs: 00007FFD65688D69
[TC] blockEnd = %llX, xrefs: 00007FFD65688E04
xxx??xxxx?xxx, xrefs: 00007FFD65688CEA
xxx??xxx?xxx, xrefs: 00007FFD65688D3A
[TC] Patched!, xrefs: 00007FFD65688E76
[TC] rcMonitorAssignment = %llX, xrefs: 00007FFD65688D8B
xxx??xxxx?xx, xrefs: 00007FFD65688D18

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ProtectVirtual
String ID: [TC] Patched!$[TC] blockBegin = %llX$[TC] blockEnd = %llX$[TC] rcMonitorAssignment = %llX$xxx??xxx?xx$xxx??xxx?xxx$xxx??xxxx?xx$xxx??xxxx?xxx
API String ID: 544645111-3560911239
Opcode ID: ed6e236de58509fe8fa8d4d2032086b5e9bdda05b63b4a47fc0754114a57bbae
Instruction ID: f2b606f625ee268be318599c6b6b559e9dc3c2b0d24d36f1d9a71a8dd2ae526d
Opcode Fuzzy Hash: ed6e236de58509fe8fa8d4d2032086b5e9bdda05b63b4a47fc0754114a57bbae
Instruction Fuzzy Hash: 3F518E21B08E4AD4EB61DFA5E4203A923A0EF54F84F484A32DA4D077A5EF3CE589C740

Function 00007FFD6566D870 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD6565D290: GetModuleHandleExW.KERNEL32 ref: 00007FFD6565D2C6
Part of subcall function 00007FFD6565D290: ImageDirectoryEntryToDataEx.DBGHELP ref: 00007FFD6565D2F9
Part of subcall function 00007FFD6565D290: FreeLibrary.KERNEL32 ref: 00007FFD6565D32F

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,00007FFD656630C8), ref: 00007FFD6566D8F3
K32GetModuleInformation.KERNEL32(?,?,?,?,?,?,?,00007FFD656630C8), ref: 00007FFD6566D90A

Part of subcall function 00007FFD6565D290: FreeLibrary.KERNEL32 ref: 00007FFD6565D3B9
Part of subcall function 00007FFD6565D290: VirtualQuery.KERNEL32 ref: 00007FFD6565D3F8
Part of subcall function 00007FFD6565D290: VirtualProtect.KERNELBASE ref: 00007FFD6565D413
Part of subcall function 00007FFD6565D290: VirtualProtect.KERNEL32 ref: 00007FFD6565D43B
Part of subcall function 00007FFD6565D290: FreeLibrary.KERNEL32 ref: 00007FFD6565D446

Strings

CoCreateInstance, xrefs: 00007FFD6566D893
xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xxx????xxx, xrefs: 00007FFD6566D914
TrackPopupMenu, xrefs: 00007FFD6566D8D9
api-ms-win-core-registry-l1-1-0.dll, xrefs: 00007FFD6566D8C3
Setup pnidui functions done, xrefs: 00007FFD6566D952
RegGetValueW, xrefs: 00007FFD6566D8BC
user32.dll, xrefs: 00007FFD6566D8E0
api-ms-win-core-com-l1-1-0.dll, xrefs: 00007FFD6566D89A

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: FreeLibraryVirtual$ModuleProtect$CurrentDataDirectoryEntryHandleImageInformationProcessQuery
String ID: CoCreateInstance$RegGetValueW$Setup pnidui functions done$TrackPopupMenu$api-ms-win-core-com-l1-1-0.dll$api-ms-win-core-registry-l1-1-0.dll$user32.dll$xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xxx????xxx
API String ID: 430087472-2450567920
Opcode ID: 3b037ebd7788b0975fb2461225ebafcf1d17e905b054a30dc4e6bf20cf7efa66
Instruction ID: 9d81baad2ad0db7db62284d51d1cbe82b5f9382c551e2c886ccfbbc15083fdcf
Opcode Fuzzy Hash: 3b037ebd7788b0975fb2461225ebafcf1d17e905b054a30dc4e6bf20cf7efa66
Instruction Fuzzy Hash: D821F765B48E4FD1FB10AFA1E8612F52361AF89B84F844132E94E06665DF3CE6C9C781

Function 00007FFD656662C0 Relevance: 17.5, APIs: 6, Strings: 4, Instructions: 46sleepwindowCOMMON

Download Yara Rule

APIs

FindWindowExW.USER32 ref: 00007FFD656662EE
FindWindowExW.USER32 ref: 00007FFD65666308
IsWindowVisible.USER32 ref: 00007FFD65666316
SleepEx.KERNELBASE ref: 00007FFD65666325
Sleep.KERNEL32 ref: 00007FFD6566633C
SetEvent.KERNEL32 ref: 00007FFD65666349

Strings

Start, xrefs: 00007FFD656662FC
Ended "Signal shell ready" thread., xrefs: 00007FFD65666369
Shell_TrayWnd, xrefs: 00007FFD656662E3
Started "Signal shell ready" thread., xrefs: 00007FFD656662C8

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Window$FindSleep$EventVisible
String ID: Ended "Signal shell ready" thread.$Shell_TrayWnd$Start$Started "Signal shell ready" thread.
API String ID: 3652910701-782476775
Opcode ID: ff470a5cfa1aad5f53a553b29d150c7776198f7f2fe8c3796b60f2596c71c77a
Instruction ID: ea91cb8b257f15c5da6af90fb17a1dc4110b65517c728f00a02d87552d534c49
Opcode Fuzzy Hash: ff470a5cfa1aad5f53a553b29d150c7776198f7f2fe8c3796b60f2596c71c77a
Instruction Fuzzy Hash: 5C11F864F49E0BC2FB58AFE1E8387B526A1AF94F45F445039C50E962A0DE3CA4D9C741

Function 00007FFD6566CB20 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegGetValueW.KERNELBASE ref: 00007FFD6566CB9B
RegGetValueW.KERNELBASE ref: 00007FFD6566CBDF
RegGetValueW.KERNELBASE ref: 00007FFD6566CC24
RegGetValueW.KERNELBASE ref: 00007FFD6566CC73

Strings

CrashCounter, xrefs: 00007FFD6566CBBA
CrashThresholdTime, xrefs: 00007FFD6566CBFF
Software\ExplorerPatcher, xrefs: 00007FFD6566CB7A, 00007FFD6566CBC6, 00007FFD6566CC0B, 00007FFD6566CC5A
CrashCounterThreshold, xrefs: 00007FFD6566CC4E
CrashCounterDisabled, xrefs: 00007FFD6566CB6E

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Value
String ID: CrashCounter$CrashCounterDisabled$CrashCounterThreshold$CrashThresholdTime$Software\ExplorerPatcher
API String ID: 3702945584-694238707
Opcode ID: a676f1da80b7d5bea20316a3c839fd19d2768aa93fa861a519cfd8a81d9524ca
Instruction ID: d5ca9b6637543191b3faa116fa494aa925f44bc131026e88dd4237d64de78d50
Opcode Fuzzy Hash: a676f1da80b7d5bea20316a3c839fd19d2768aa93fa861a519cfd8a81d9524ca
Instruction Fuzzy Hash: 65413672608F84CAEB109F98F450299B7B0FB84B54F904226EB9D07B98DF3ED195CB44

Function 00007FFD6566C8F0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE ref: 00007FFD6566C90C
GetCurrentProcess.KERNEL32 ref: 00007FFD6566C915
K32GetModuleInformation.KERNEL32 ref: 00007FFD6566C92C

Part of subcall function 00007FFD6565D460: GetModuleHandleExW.KERNEL32 ref: 00007FFD6565D494
Part of subcall function 00007FFD6565D460: VirtualProtect.KERNELBASE ref: 00007FFD6565D538
Part of subcall function 00007FFD6565D460: VirtualProtect.KERNELBASE ref: 00007FFD6565D55B
Part of subcall function 00007FFD6565D460: FreeLibrary.KERNEL32 ref: 00007FFD6565D566

Strings

Failed to hook CAppResolverCacheBuilder::_AddUserPinnedShortcutToStart(). rv = %d, xrefs: 00007FFD6566C9CC
api-ms-win-core-winrt-l1-1-0.dll, xrefs: 00007FFD6566C943
x?xxxx????xxx, xrefs: 00007FFD6566C953
RoGetActivationFactory, xrefs: 00007FFD6566C93C
AppResolver.dll, xrefs: 00007FFD6566C905
CAppResolverCacheBuilder::_AddUserPinnedShortcutToStart() = %llX, xrefs: 00007FFD6566C98B

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: LibraryModuleProtectVirtual$CurrentFreeHandleInformationLoadProcess
String ID: AppResolver.dll$CAppResolverCacheBuilder::_AddUserPinnedShortcutToStart() = %llX$Failed to hook CAppResolverCacheBuilder::_AddUserPinnedShortcutToStart(). rv = %d$RoGetActivationFactory$api-ms-win-core-winrt-l1-1-0.dll$x?xxxx????xxx
API String ID: 1174645330-3507426587
Opcode ID: 950ea70501d1a6d9539e8decf97b80bcbbe605be67eeafb75732d5da7a487ddd
Instruction ID: 327ed7b03a58e30f3d97c128da994481f644ce5ca32e0e186a0111968d335948
Opcode Fuzzy Hash: 950ea70501d1a6d9539e8decf97b80bcbbe605be67eeafb75732d5da7a487ddd
Instruction Fuzzy Hash: 8A21F361F09E0BD1FF14ABA1E8753B56361AF44B94F444532D84E4A3A5EE3CE6CAC340

Function 00007FFD656925E0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 161COMMON

Download Yara Rule

Strings

Could not allocate memory near address %p, xrefs: 00007FFD65692718
failed to get page, xrefs: 00007FFD65692739
failed to make trampoline, xrefs: 00007FFD65692663
Could not modify already-installed funchook handle., xrefs: 00007FFD6569260D

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID: failed to get page$ failed to make trampoline$Could not allocate memory near address %p$Could not modify already-installed funchook handle.
API String ID: 0-2189554615
Opcode ID: 0dcd918d6a9fb1b435397edfb2b92d1158f24f494b900e2e2f09df01581675ed
Instruction ID: 9a8f676a9348b3f3d1230cab2b97abce62b1004e6fa6ea46eb94035dea41ed7c
Opcode Fuzzy Hash: 0dcd918d6a9fb1b435397edfb2b92d1158f24f494b900e2e2f09df01581675ed
Instruction Fuzzy Hash: 74712B26B19F86C6DB608F55E8503AA73A0FB99B80F445035EE8E47B55EF3CE594C700

Function 00007FFD65652890 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 64registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FFD656528AF
GetProcAddress.KERNEL32 ref: 00007FFD656528C8
RegOpenKeyExW.KERNELBASE ref: 00007FFD6565293F
RegQueryValueExW.KERNELBASE ref: 00007FFD6565296F

Strings

UBR, xrefs: 00007FFD65652958
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FFD656528FD
ntdll.dll, xrefs: 00007FFD656528A8
RtlGetVersion, xrefs: 00007FFD656528BE

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: AddressHandleModuleOpenProcQueryValue
String ID: RtlGetVersion$UBR$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion$ntdll.dll
API String ID: 3749297518-2374052841
Opcode ID: 9d87f9b91261a5ef74bccfdd57653f5feb03a1092f759d2651c69dcd4f025410
Instruction ID: aa0e6acd63b2bffaea784912ce6eb675de692a903989bb2525b54ee3dc8e3ba9
Opcode Fuzzy Hash: 9d87f9b91261a5ef74bccfdd57653f5feb03a1092f759d2651c69dcd4f025410
Instruction Fuzzy Hash: AE217C31B19E46C2EB50DB61E8A136973A0EB95F54F841131EA9E477A4EF3CD585CB00

Function 00007FFD65693720 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 68memorywindowCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007FFD65693755
GetLastError.KERNEL32 ref: 00007FFD65693784
FormatMessageA.KERNEL32 ref: 00007FFD656937B5
GetLastError.KERNEL32 ref: 00007FFD656937FF

Strings

Unknown Error, xrefs: 00007FFD656937C2
Failed to protect memory %p (size=%llu, error=%lu(%s)), xrefs: 00007FFD65693809
protect memory %p (size=%llu), xrefs: 00007FFD65693763

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ErrorLast$FormatMessageProtectVirtual
String ID: protect memory %p (size=%llu)$Failed to protect memory %p (size=%llu, error=%lu(%s))$Unknown Error
API String ID: 2888148163-2522531280
Opcode ID: f6b57e912bedf80b5fb7971f670bf1aa8c7e6dba204ad976d1cd2a023942e529
Instruction ID: 03d53cf4f8f7b9c5156e96a40022b177ca5de607ec7ab213eef0187ad40af17e
Opcode Fuzzy Hash: f6b57e912bedf80b5fb7971f670bf1aa8c7e6dba204ad976d1cd2a023942e529
Instruction Fuzzy Hash: C0315025B0CE8AC1EB608B91E4203BA63A0FB59F88F444136DA8D5BB58DF7CD495C744

Function 00007FFD65693290 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 67memorywindowCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007FFD656932CA
GetLastError.KERNEL32 ref: 00007FFD656932FC
FormatMessageA.KERNEL32 ref: 00007FFD6569332D
GetLastError.KERNEL32 ref: 00007FFD65693371

Strings

Unknown Error, xrefs: 00007FFD6569333A
protect page %p (size=%llu, prot=read,exec), xrefs: 00007FFD656932DB
Failed to protect page %p (size=%llu, prot=read,exec, error=%lu(%s)), xrefs: 00007FFD6569337E

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ErrorLast$FormatMessageProtectVirtual
String ID: protect page %p (size=%llu, prot=read,exec)$Failed to protect page %p (size=%llu, prot=read,exec, error=%lu(%s))$Unknown Error
API String ID: 2888148163-3855186111
Opcode ID: d43fbaa4eeae4fc359402d00be4e85badc5513ee881c4fe30d7a734a902469b8
Instruction ID: d14e15f84483c062d659df9740bc0c1e7a416cf19ea9ff4d09a1ece20b8e4dc0
Opcode Fuzzy Hash: d43fbaa4eeae4fc359402d00be4e85badc5513ee881c4fe30d7a734a902469b8
Instruction Fuzzy Hash: E7315021B0CE8BC2EB608B96E8243AA63A0FB59F84F440136DA8D47B95DF3CD594C700

Function 00007FFD6566AAB0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 50memorystringregistryCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 00007FFD6566AAE8
VirtualProtect.KERNEL32 ref: 00007FFD6566AB05
lstrcpyW.KERNEL32 ref: 00007FFD6566AB19
VirtualProtect.KERNEL32 ref: 00007FFD6566AB31
RegOpenKeyExW.KERNELBASE ref: 00007FFD6566AB48

Strings

Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify, xrefs: 00007FFD6566AAD8
Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB, xrefs: 00007FFD6566AB0F

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ProtectVirtual$Openlstrcmpilstrcpy
String ID: Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotSIB$Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify
API String ID: 3588037206-2075971939
Opcode ID: fe4b2c8db1d22a09de3faee1197f5fe09447eefd6e4f7c3f1b905d291895351f
Instruction ID: 143361c24bcfd1e14ccf81d109acf9ee3551a7a635f7de990216c1a91c28025f
Opcode Fuzzy Hash: fe4b2c8db1d22a09de3faee1197f5fe09447eefd6e4f7c3f1b905d291895351f
Instruction Fuzzy Hash: 2F112E61B18A4AC6EB509F52F820B6A6761BB89FD4F845035EE4E47B14DE3CD895C700

Function 00007FFD6569155C Relevance: 12.2, APIs: 8, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFD65691584
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFD656915D6
_RTC_Initialize.LIBCMT ref: 00007FFD65691604
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFD6569162A
__scrt_release_startup_lock.LIBCMT ref: 00007FFD65691655

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 3b4f6e87e4b416f9f5b326fcb725a3830c06083ff715e3015abc40643045dafa
Instruction ID: cec89a911118f8935f25a39a698ef3261bb784612e1d2d6c0b27f597f79ee621
Opcode Fuzzy Hash: 3b4f6e87e4b416f9f5b326fcb725a3830c06083ff715e3015abc40643045dafa
Instruction Fuzzy Hash: C2819E20F08E4BC6FB50ABE6D4713B96299AFA6F80F244535D90D87796DE3CE9C5C600

Function 00007FFD6565D290 Relevance: 12.1, APIs: 8, Instructions: 118memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FFD6565D2C6
ImageDirectoryEntryToDataEx.DBGHELP ref: 00007FFD6565D2F9
FreeLibrary.KERNEL32 ref: 00007FFD6565D32F
FreeLibrary.KERNEL32 ref: 00007FFD6565D3B9
VirtualQuery.KERNEL32 ref: 00007FFD6565D3F8
VirtualProtect.KERNELBASE ref: 00007FFD6565D413
VirtualProtect.KERNEL32 ref: 00007FFD6565D43B
FreeLibrary.KERNEL32 ref: 00007FFD6565D446

Part of subcall function 00007FFD656AA154: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656AA171

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: FreeLibraryVirtual$Protect$DataDirectoryEntryHandleImageModuleQuery_invalid_parameter_noinfo
String ID:
API String ID: 3041990818-0
Opcode ID: 4e1dd611ff582084d51b0f53564d14d9bfa321502564381179b35b6334ffa167
Instruction ID: 6cc3f60cb1323c8d1bcc09fef32db3e1f2f4bc8f037e4dd99c10f3c7dcb361bb
Opcode Fuzzy Hash: 4e1dd611ff582084d51b0f53564d14d9bfa321502564381179b35b6334ffa167
Instruction Fuzzy Hash: AC513162B58E46C2EB549B66E86037A63B0FB85F94F445035EB8E87798DE3CD5C4C700

Function 00007FFD65679C13 Relevance: 10.7, APIs: 7, Instructions: 165registrysynchronizationCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00007FFD65679CA4
RegCreateKeyExW.KERNELBASE ref: 00007FFD65679D07
RegNotifyChangeKeyValue.KERNELBASE ref: 00007FFD65679D38
WaitForMultipleObjects.KERNEL32 ref: 00007FFD65679D5F
WaitForSingleObject.KERNEL32 ref: 00007FFD65679DA9
CloseHandle.KERNEL32 ref: 00007FFD65679E09
RegCloseKey.ADVAPI32 ref: 00007FFD65679E1F

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CloseCreateWait$ChangeEventHandleMultipleNotifyObjectObjectsSingleValue
String ID:
API String ID: 3111792343-0
Opcode ID: 74ca69e78427847dc10dd3a75c1c6ffb019dad91667b60695c2db7a9a9389b48
Instruction ID: 3e4c2d0507f14cc74e7ad712ec950d18d345f54bc0092a4b389aaa60765c98f2
Opcode Fuzzy Hash: 74ca69e78427847dc10dd3a75c1c6ffb019dad91667b60695c2db7a9a9389b48
Instruction Fuzzy Hash: 4B615C32B15E4AC6EB54CBA5D4A477973A1FB84F98F088135DA5E477A4DE3CE882C700

Function 00007FFD65692E20 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 146memorywindowCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FFD65692F2B
GetLastError.KERNEL32 ref: 00007FFD65692F3A
FormatMessageA.KERNEL32 ref: 00007FFD65692F6D

Strings

Unknown Error, xrefs: 00007FFD65692F79
Failed to commit page %p (base=%p(used=%d), idx=%llu, size=%llu, error=%lu(%s)), xrefs: 00007FFD65692FC6
commit page %p (base=%p(used=%d), idx=%llu, size=%llu), xrefs: 00007FFD65693005

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: AllocErrorFormatLastMessageVirtual
String ID: commit page %p (base=%p(used=%d), idx=%llu, size=%llu)$Failed to commit page %p (base=%p(used=%d), idx=%llu, size=%llu, error=%lu(%s))$Unknown Error
API String ID: 1689221563-3447313879
Opcode ID: b44925e47d1e0ccb1ee2569ab82a625ac04b462aafab48c4de13057f39da817c
Instruction ID: 8fbd5e08aa57e9549c099bfc49815a31dbb91d78405ad6ea2b0848bd104d5093
Opcode Fuzzy Hash: b44925e47d1e0ccb1ee2569ab82a625ac04b462aafab48c4de13057f39da817c
Instruction Fuzzy Hash: F7518F35B09E8AC6EB20CB92E86076667A5FB59F84F440135ED8C47B54DF3CD596C700

Function 00007FFD656B01F8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0000D0719468BDAC,00007FFD656ABEC9,?,?,?,?,00007FFD656B04C2,?,?,00000000,00007FFD656B4E97,?,?,?), ref: 00007FFD656B0207
FlsSetValue.KERNEL32(?,?,0000D0719468BDAC,00007FFD656ABEC9,?,?,?,?,00007FFD656B04C2,?,?,00000000,00007FFD656B4E97,?,?,?), ref: 00007FFD656B023D
FlsSetValue.KERNEL32(?,?,0000D0719468BDAC,00007FFD656ABEC9,?,?,?,?,00007FFD656B04C2,?,?,00000000,00007FFD656B4E97,?,?,?), ref: 00007FFD656B026A
FlsSetValue.KERNEL32(?,?,0000D0719468BDAC,00007FFD656ABEC9,?,?,?,?,00007FFD656B04C2,?,?,00000000,00007FFD656B4E97,?,?,?), ref: 00007FFD656B027B
FlsSetValue.KERNEL32(?,?,0000D0719468BDAC,00007FFD656ABEC9,?,?,?,?,00007FFD656B04C2,?,?,00000000,00007FFD656B4E97,?,?,?), ref: 00007FFD656B028C
SetLastError.KERNEL32(?,?,0000D0719468BDAC,00007FFD656ABEC9,?,?,?,?,00007FFD656B04C2,?,?,00000000,00007FFD656B4E97,?,?,?), ref: 00007FFD656B02A7

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: bdb54be4341d54bc273283cacb4df02bb34f6505d0b73b61a08f8a0cbfbe3732
Instruction ID: 0fbedf605784304c16d211bb72b6dadcddb10ad254765b360f69e91e75e8c3d2
Opcode Fuzzy Hash: bdb54be4341d54bc273283cacb4df02bb34f6505d0b73b61a08f8a0cbfbe3732
Instruction Fuzzy Hash: FD113834B09A8AC2FF64A7A1D67137962A2AF48FB0F140734DC2E066D6DE3DB4D1C600

Function 00007FFD6566AC50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53registrystringCOMMON

Download Yara Rule

APIs

lstrcmpW.KERNEL32 ref: 00007FFD6566ACA1
RegGetValueW.ADVAPI32 ref: 00007FFD6566ACDC

Part of subcall function 00007FFD65652890: GetModuleHandleW.KERNEL32 ref: 00007FFD656528AF
Part of subcall function 00007FFD65652890: GetProcAddress.KERNEL32 ref: 00007FFD656528C8
Part of subcall function 00007FFD65652890: RegOpenKeyExW.KERNELBASE ref: 00007FFD6565293F
Part of subcall function 00007FFD65652890: RegQueryValueExW.KERNELBASE ref: 00007FFD6565296F

RegGetValueW.KERNELBASE ref: 00007FFD6566AD1C

Strings

TaskbarDa, xrefs: 00007FFD6566ACB3
ShowCortanaButton, xrefs: 00007FFD6566AC97

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Value$AddressHandleModuleOpenProcQuerylstrcmp
String ID: ShowCortanaButton$TaskbarDa
API String ID: 4138643572-1008683796
Opcode ID: 9ca9e85aa57ae71f2ecce6068f2531ffac4e53ca24fc412a877a8943e03e930a
Instruction ID: 4107cf8ffad24638e4b1c9ef4617f4ca2533005c7c1a2bc6d9ae9d03437649e9
Opcode Fuzzy Hash: 9ca9e85aa57ae71f2ecce6068f2531ffac4e53ca24fc412a877a8943e03e930a
Instruction Fuzzy Hash: B421E635A08F85C6EB208F56F85425AB7A5FB88F84F444131EA8D43B68DF3CD494CB00

Function 00007FFD6565D460 Relevance: 7.6, APIs: 5, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FFD6565D494
FreeLibrary.KERNEL32 ref: 00007FFD6565D5BB

Part of subcall function 00007FFD656AA154: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656AA171

VirtualProtect.KERNELBASE ref: 00007FFD6565D538
VirtualProtect.KERNELBASE ref: 00007FFD6565D55B
FreeLibrary.KERNEL32 ref: 00007FFD6565D566

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: FreeLibraryProtectVirtual$HandleModule_invalid_parameter_noinfo
String ID:
API String ID: 172810297-0
Opcode ID: dae4ad9bb35fcd49da65b17bf2118d8f1734c85b4c447c57c7e2259dea9c94da
Instruction ID: 4c6f766776dcb2e6de047ef7899f238d2f1ab3f133e28bb72bfe83dbee225131
Opcode Fuzzy Hash: dae4ad9bb35fcd49da65b17bf2118d8f1734c85b4c447c57c7e2259dea9c94da
Instruction Fuzzy Hash: FC41FD62B48A4AC2EB648F51E86077A67B1FB89FD8F444035EE8E47794DE3CE594C700

Function 00007FFD6566BE40 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FFD6566BE77
GetProcAddress.KERNEL32 ref: 00007FFD6566BE87

Strings

NtUserFindWindowEx, xrefs: 00007FFD6566BE80
win32u.dll, xrefs: 00007FFD6566BE70

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtUserFindWindowEx$win32u.dll
API String ID: 1646373207-2703420062
Opcode ID: 83859f7c66667c9c358b2b8106913d927510356cc0bb071f2510942001acc61e
Instruction ID: 04b063961598e3b3f5d78e204dbae7c20f9cedb08efc60ed0f94ee0eff1e824a
Opcode Fuzzy Hash: 83859f7c66667c9c358b2b8106913d927510356cc0bb071f2510942001acc61e
Instruction Fuzzy Hash: 2F018B2AB08E59C6EA00CF92F86062AA7A0BB48FD4F450531EE4D47725DF3CE492CB00

Function 00007FFD6566D340 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20registryCOMMON

Download Yara Rule

APIs

SleepEx.KERNELBASE ref: 00007FFD6566D353
RegSetKeyValueW.ADVAPI32 ref: 00007FFD6566D38E

Strings

CrashCounter, xrefs: 00007FFD6566D371
Software\ExplorerPatcher, xrefs: 00007FFD6566D380

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: SleepValue
String ID: CrashCounter$Software\ExplorerPatcher
API String ID: 1540188156-2892006628
Opcode ID: ed63f36741d272485b999506698d90b264502b0eb51f636bacafd351425c53ee
Instruction ID: 1098ee0fbab936947881e4d650b96924f18090cb41d6232c9b517163e6eed566
Opcode Fuzzy Hash: ed63f36741d272485b999506698d90b264502b0eb51f636bacafd351425c53ee
Instruction Fuzzy Hash: 14F03AA1B28E85C5EB40DB50E46435573B0FB48BA4F801231EA4E067A4DF3CD195CB00

Function 00007FFD65692060 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00007FFD6569203B,?,?,00000000,00007FFD65661EA7), ref: 00007FFD65692145
FlushInstructionCache.KERNEL32(?,00007FFD6569203B,?,?,00000000,00007FFD65661EA7), ref: 00007FFD65692154

Strings

Patched Instructions:, xrefs: 00007FFD65692163

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcess
String ID: Patched Instructions:
API String ID: 2564211676-4020029282
Opcode ID: f3366050c6bc144045223ff0fb4e42f33b3c7d9e2d4a1136741ca7e68a8572d8
Instruction ID: e26609457a9ca205da91cef1aa23ca825f10743a5497806d90ff8f80d9935ea7
Opcode Fuzzy Hash: f3366050c6bc144045223ff0fb4e42f33b3c7d9e2d4a1136741ca7e68a8572d8
Instruction Fuzzy Hash: 0A416D62B18A8AC1EB209BA1E8203AAA7A5FB55F84F404032DF4D53749EF7CD595C704

Function 00007FFD656907D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,00007FFD6565E4B6), ref: 00007FFD6569080D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00007FFD6565E4B6), ref: 00007FFD65690821

Strings

Software\Classes\CLSID\{2CC5CA98-6485-489A-920E-B3E88A6CCCE3}, xrefs: 00007FFD656907FF

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Classes\CLSID\{2CC5CA98-6485-489A-920E-B3E88A6CCCE3}
API String ID: 47109696-1447196730
Opcode ID: 459941ef0f60087ec151cbdb1b6a71f2f3f312f2b353b135781bacdd490fabe1
Instruction ID: 28244abd60bfa08dc687d95d5d426d42dae78cd579680fa9af4c9d6b9e564bb5
Opcode Fuzzy Hash: 459941ef0f60087ec151cbdb1b6a71f2f3f312f2b353b135781bacdd490fabe1
Instruction Fuzzy Hash: D2F09021B28F45C2EB408F66F8A072673A0FF98B94F802135E98E46B54DF2CD095CB00

Function 00007FFD656ADBDC Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,834800000B7CE800,00007FFD656B743A,?,?,?,00007FFD656B7477,?,?,00000000,00007FFD656B5459,?,?,00007FFD656ACF3A,00007FFD656B538B), ref: 00007FFD656ADBF2
GetLastError.KERNEL32(?,?,834800000B7CE800,00007FFD656B743A,?,?,?,00007FFD656B7477,?,?,00000000,00007FFD656B5459,?,?,00007FFD656ACF3A,00007FFD656B538B), ref: 00007FFD656ADBFC

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 05ac9442f5ffea28a1eb1d21a830cbea16c909aefcadef8ffdc5edb47fdf31e1
Instruction ID: 0d2f310d2fcfaf0a8793470c6a00675e581cea30d26394fdb18de9729da89b2a
Opcode Fuzzy Hash: 05ac9442f5ffea28a1eb1d21a830cbea16c909aefcadef8ffdc5edb47fdf31e1
Instruction Fuzzy Hash: 05E0B664F19A4EC2FF286BF2D86537921B5AF89F40B444434D90A462A2EE2DA8D5C660

Function 00007FFD656B2BF8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD656B2C23

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3711b984e4991261f0e53ccc1e653d5e4836b509d74f60138b4e8019087179fd
Instruction ID: e4bdec168c3128e0d7381acd68a3a304a3e316c1c45b537e922db5bbd503f8a5
Opcode Fuzzy Hash: 3711b984e4991261f0e53ccc1e653d5e4836b509d74f60138b4e8019087179fd
Instruction Fuzzy Hash: 99116036B09E4AC6EA509F95E86037963A1FB40B40F054834D65D4B7A6DF3CE8A1C740

Function 00007FFD656B7244 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7a9823117b8e8457534ed740180dd486be6ae34585640664a697e8c0078950d
Instruction ID: a704f1f94e521bf5e289ec052969865cc7e693aaf81aea58909389c5c948555a
Opcode Fuzzy Hash: b7a9823117b8e8457534ed740180dd486be6ae34585640664a697e8c0078950d
Instruction Fuzzy Hash: C7F03A25F18E0EC4EE685BD5C8B13782661AF96F40F540672E60E863E6DA3DA1E5C601

Function 00007FFD65691358 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFD6569136C

Part of subcall function 00007FFD6569A948: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FFD6569A950
Part of subcall function 00007FFD6569A948: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FFD6569A955

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: b849d5d5db9ec032d2834ab2f9a910a3d2d2ea980f48a76a8b15cbc11d9ac2e5
Instruction ID: 90368ee1ee771be45ce7a8c493141ec5b224a2dd8fcbbc7593bec260ec2f82ef
Opcode Fuzzy Hash: b849d5d5db9ec032d2834ab2f9a910a3d2d2ea980f48a76a8b15cbc11d9ac2e5
Instruction Fuzzy Hash: 6FE0B664F0CA4BD2FE982AE191323B812A81F37B44E6001B9D80D429939D2E61C7D222

Function 00007FFD656ADB64 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FFD656B025A,?,?,0000D0719468BDAC,00007FFD656ABEC9,?,?,?,?,00007FFD656B04C2,?,?,00000000), ref: 00007FFD656ADBB9

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 55f2dc2961d20ebe61b3e15a53eaada1012a5273e33508384d1903945a15730e
Instruction ID: 6f705ff9e597dfb6f18982630e2d6bc5104de80aef7c5595ea4be31272b0b2f3
Opcode Fuzzy Hash: 55f2dc2961d20ebe61b3e15a53eaada1012a5273e33508384d1903945a15730e
Instruction Fuzzy Hash: 24F0F9A4B09A0FC5FF645AE5D9717B572A16F98F80F185430CD0E863E2EE2EE5D1C210

Function 00007FFD656AE420 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FFD656B04A9,?,?,00000000,00007FFD656B4E97,?,?,?,00007FFD656ACC63,?,?,?,00007FFD656ACB59), ref: 00007FFD656AE45E

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 93e5887e88414e6a8d65827f5456db655349e80249961f9d2f06a4db9c598047
Instruction ID: 14df898b04df09efd7f8b554b8222ef42e0ee0f54bd6ff8d28d55a916a55581b
Opcode Fuzzy Hash: 93e5887e88414e6a8d65827f5456db655349e80249961f9d2f06a4db9c598047
Instruction Fuzzy Hash: D1F0DA20B19E4FC5FE645AF5E86137572959F84FA0F080734D92E862C2DD2DA8D1C510

Non-executed Functions

Function 00007FFD656751C0 Relevance: 252.9, APIs: 114, Strings: 29, Instructions: 2682COMMON

Download Yara Rule

APIs

WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567523F
RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD65675266
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675272
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567529B
RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD656752C5
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675334
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675368
RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD65675395
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675445
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675469
GetDpiForWindow.USER32 ref: 00007FFD65675570
SetRect.USER32 ref: 00007FFD656755A6
MulDiv.KERNEL32 ref: 00007FFD656755BB
MulDiv.KERNEL32 ref: 00007FFD656755D2
MulDiv.KERNEL32 ref: 00007FFD656755E9
MulDiv.KERNEL32 ref: 00007FFD65675600
SetRect.USER32 ref: 00007FFD65675619
MonitorFromWindow.USER32 ref: 00007FFD6567563C
GetMonitorInfoW.USER32 ref: 00007FFD65675670
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656756CC
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675795
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656757B5
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656757DB
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675873
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675890
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656758AC
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675985
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656759A5
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656759CB
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675A67
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675A8B
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675B02
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675B5F
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675D55
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675D75
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675DAA
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675E4D
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675E6D
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675E96
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675F61
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675F81
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65675FB8
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567608B
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656760AB
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656760D8
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676302
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676322
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676355
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676405
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676425
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567644E
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676521
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676541
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676577
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676625
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676645
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567666E
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676741
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676761
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676797
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676871
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676891
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656768C7
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656769C1
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656769E1
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676A14
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676AF1
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676B11
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676B47
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676BF5
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676C15
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676C3E
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676D11
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676D31
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676D67
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676E15
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676E35
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676E5E
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676F05
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676F25
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65676F4E
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65677021
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65677041
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65677077
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65677125
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65677145
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567716E
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65677215
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65677235
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567725E
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65677315

Part of subcall function 00007FFD656A7DF4: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7E11

WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65677339
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656773DA
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656774D1
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656774F1
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65677527
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656775D5
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656775F5
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567761E
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656776C5
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656776E5
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567770E
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656777D1
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656777F1
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65677824
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656778C5
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656778E5
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65677955
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65677A21
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65677A41
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65677A7E
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65677B25
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65677B45
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65677B7E

Strings

Windows.UI.Xaml.Controls.ItemsPresenter, xrefs: 00007FFD6567712E
Windows.UI.Xaml.Controls.Canvas, xrefs: 00007FFD65675210
Windows.UI.Xaml.Media.VisualTreeHelper, xrefs: 00007FFD65675361
ScrollContentPresenter, xrefs: 00007FFD6567702A
Windows.UI.Xaml.Controls.Frame, xrefs: 00007FFD65675A70
Windows.UI.Xaml.Controls.ContentPresenter, xrefs: 00007FFD6567598E, 00007FFD65675D5E
Windows.UI.Xaml.Controls.TileGrid, xrefs: 00007FFD6567721E
Windows.UI.Xaml.Controls.Image, xrefs: 00007FFD6567587C
ScrollViewer, xrefs: 00007FFD65676D1A
Windows.UI.Xaml.Controls.Grid, xrefs: 00007FFD6567640E, 00007FFD65676F0E, 00007FFD656776CE
contentPresenter, xrefs: 00007FFD656774DA, 00007FFD65677A2A
StartUI.TileViewControl, xrefs: 00007FFD65677B2E
StartUI.SplitViewFrame, xrefs: 00007FFD65675E56
StartUI.StartSizingFramePanel, xrefs: 00007FFD6567579E
Windows.UI.Xaml.Window, xrefs: 00007FFD65675294
StartUI.StartSizingFrame, xrefs: 00007FFD6567544E
Windows.UI.Xaml.Controls.Border, xrefs: 00007FFD6567662E, 00007FFD65676BFE, 00007FFD65676E1E
ContentPaneGrid, xrefs: 00007FFD6567674A
AcrylicBorder, xrefs: 00007FFD65676094
gridRoot, xrefs: 00007FFD656769CA
StartUI.TileListViewItem, xrefs: 00007FFD6567731E, 00007FFD656778CE
GridPane, xrefs: 00007FFD6567687A
page, xrefs: 00007FFD656768EE
StartUI.TileGroupViewControl, xrefs: 00007FFD656775DE
RootContent, xrefs: 00007FFD6567630B
groupItems, xrefs: 00007FFD65676AFA
NestedPanel, xrefs: 00007FFD656777DA
RootGrid, xrefs: 00007FFD65675F6A
ContentRoot, xrefs: 00007FFD6567652A

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: StringWindows$Delete$Buffer$ActivationCreateFactoryReference$MonitorRectWindow$FromInfo_invalid_parameter_noinfo
String ID: AcrylicBorder$ContentPaneGrid$ContentRoot$GridPane$NestedPanel$RootContent$RootGrid$ScrollContentPresenter$ScrollViewer$StartUI.SplitViewFrame$StartUI.StartSizingFrame$StartUI.StartSizingFramePanel$StartUI.TileGroupViewControl$StartUI.TileListViewItem$StartUI.TileViewControl$Windows.UI.Xaml.Controls.Border$Windows.UI.Xaml.Controls.Canvas$Windows.UI.Xaml.Controls.ContentPresenter$Windows.UI.Xaml.Controls.Frame$Windows.UI.Xaml.Controls.Grid$Windows.UI.Xaml.Controls.Image$Windows.UI.Xaml.Controls.ItemsPresenter$Windows.UI.Xaml.Controls.TileGrid$Windows.UI.Xaml.Media.VisualTreeHelper$Windows.UI.Xaml.Window$contentPresenter$gridRoot$groupItems$page
API String ID: 347649780-2825766018
Opcode ID: e5b07c0f267d911b8b8bbf6575401f784d53ce77ca5a286dc459bbc077433eff
Instruction ID: 22c207719c570c82770ce415f9e00870c1fbc3cc1b3e22a8c4da63ab6f46d7c6
Opcode Fuzzy Hash: e5b07c0f267d911b8b8bbf6575401f784d53ce77ca5a286dc459bbc077433eff
Instruction Fuzzy Hash: A153D736704F8ACADB649F66D8942AD2765FB88F89F004126DE1E4BB68DF39D585C300

Function 00007FFD65686DE0 Relevance: 149.6, APIs: 75, Strings: 10, Instructions: 867windowregistryCOMMON

Download Yara Rule

APIs

RegisterWindowMessageW.USER32 ref: 00007FFD65686E27
GetClassWord.USER32 ref: 00007FFD65686E63
RegisterWindowMessageW.USER32 ref: 00007FFD65686E87
GetParent.USER32 ref: 00007FFD65686E96
GetClassWord.USER32 ref: 00007FFD65686EA7
GetPropW.USER32 ref: 00007FFD65686EE4
RemovePropW.USER32 ref: 00007FFD65686EF9
GetParent.USER32 ref: 00007FFD65686F17
GetParent.USER32 ref: 00007FFD65686F25
FindWindowExW.USER32 ref: 00007FFD65686F3D
GetWindowLongPtrW.USER32 ref: 00007FFD65686F4D
FindWindowExW.USER32 ref: 00007FFD65686F8B
FindWindowExW.USER32 ref: 00007FFD65686FA3
GetClientRect.USER32 ref: 00007FFD65687010
FindWindowExW.USER32 ref: 00007FFD65687033
IsWindowVisible.USER32 ref: 00007FFD65687058
GetClientRect.USER32 ref: 00007FFD65687069
FindWindowExW.USER32 ref: 00007FFD6568709F
GetWindowRect.USER32 ref: 00007FFD656870C7
MonitorFromWindow.USER32 ref: 00007FFD656870ED
GetMonitorInfoW.USER32 ref: 00007FFD656870FA
GetPropW.USER32 ref: 00007FFD65687124
SetWindowPos.USER32 ref: 00007FFD6568718A
GetClientRect.USER32 ref: 00007FFD65687197
FindWindowExW.USER32 ref: 00007FFD656871C9
IsWindowVisible.USER32 ref: 00007FFD656871EF
GetClientRect.USER32 ref: 00007FFD65687200
MoveWindow.USER32 ref: 00007FFD65687235
InvalidateRect.USER32 ref: 00007FFD6568724B
FindWindowExW.USER32 ref: 00007FFD65687278
SetWindowPos.USER32 ref: 00007FFD656872AE
GetClientRect.USER32 ref: 00007FFD656872BB
FindWindowExW.USER32 ref: 00007FFD656872ED
IsWindowVisible.USER32 ref: 00007FFD6568730E
GetClientRect.USER32 ref: 00007FFD6568731F
MoveWindow.USER32 ref: 00007FFD65687353
InvalidateRect.USER32 ref: 00007FFD65687364
FindWindowExW.USER32 ref: 00007FFD6568738A
InvalidateRect.USER32 ref: 00007FFD656873BC
GetClientRect.USER32 ref: 00007FFD656873E3
GetClientRect.USER32 ref: 00007FFD656873F5
GetWindowRect.USER32 ref: 00007FFD65687402
GetClientRect.USER32 ref: 00007FFD65687437
SetWindowPos.USER32 ref: 00007FFD6568758B
GetClientRect.USER32 ref: 00007FFD65687598
FindWindowExW.USER32 ref: 00007FFD656875CA
IsWindowVisible.USER32 ref: 00007FFD656875FF
GetClientRect.USER32 ref: 00007FFD65687610
MoveWindow.USER32 ref: 00007FFD65687643
InvalidateRect.USER32 ref: 00007FFD65687659
FindWindowExW.USER32 ref: 00007FFD6568768A
SetWindowPos.USER32 ref: 00007FFD656876D0
GetClientRect.USER32 ref: 00007FFD656876DD
FindWindowExW.USER32 ref: 00007FFD6568770F
IsWindowVisible.USER32 ref: 00007FFD6568772E
GetClientRect.USER32 ref: 00007FFD6568773F
MoveWindow.USER32 ref: 00007FFD65687776
InvalidateRect.USER32 ref: 00007FFD65687787
FindWindowExW.USER32 ref: 00007FFD656877B4
InvalidateRect.USER32 ref: 00007FFD656877E2
RegisterWindowMessageW.USER32 ref: 00007FFD65687813
SendMessageW.USER32 ref: 00007FFD65687861
GetClassWord.USER32 ref: 00007FFD65687870
SendMessageW.USER32 ref: 00007FFD656878AB
SendMessageW.USER32 ref: 00007FFD65687917
GetClassWord.USER32 ref: 00007FFD6568792B
SendMessageW.USER32 ref: 00007FFD6568795D
SendMessageW.USER32 ref: 00007FFD6568798F
SendNotifyMessageW.USER32 ref: 00007FFD656879B2
SendMessageW.USER32 ref: 00007FFD656879C6
SendMessageW.USER32 ref: 00007FFD65687A25
GetClassWord.USER32 ref: 00007FFD65687A39
GetClientRect.USER32 ref: 00007FFD65687A62
SendMessageW.USER32 ref: 00007FFD65687A9B
GetClientRect.USER32 ref: 00007FFD65687AB6

Strings

ReBarWindow32, xrefs: 00007FFD65686F7F
!@, xrefs: 00007FFD6568755B
PeopleBand, xrefs: 00007FFD65686F94, 00007FFD6568780C
Start, xrefs: 00007FFD65686F2E
MSTaskSwWClass, xrefs: 00007FFD65686E80
TrayButton, xrefs: 00007FFD6568701D, 00007FFD65687041, 00007FFD656871A1, 00007FFD656871E0, 00007FFD656872D0, 00007FFD656875A2, 00007FFD656875F0, 00007FFD65687674, 00007FFD656876F2
TraySettings, xrefs: 00007FFD6568799E
MSTaskListWClass, xrefs: 00007FFD65686E20
TrayDummySearchControl, xrefs: 00007FFD65686FF9, 00007FFD65687048, 00007FFD656871AC, 00007FFD6568725A, 00007FFD656872C5, 00007FFD656872FF, 00007FFD656875AD, 00007FFD65687668, 00007FFD656876E7, 00007FFD65687796
EPTBLEN, xrefs: 00007FFD65686EDA, 00007FFD65686EEF, 00007FFD6568711A

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Window$Rect$Client$Find$Message$Send$Invalidate$ClassVisibleWord$Move$ParentPropRegister$Monitor$FromInfoLongNotifyRemove
String ID: !@$EPTBLEN$MSTaskListWClass$MSTaskSwWClass$PeopleBand$ReBarWindow32$Start$TrayButton$TrayDummySearchControl$TraySettings
API String ID: 2509908205-217918233
Opcode ID: 711883755e967174166c771be66c080798932c6e11d56cd6f74aa121bd91870f
Instruction ID: aa2cba19f0da3449e555450429bf295c0d61d2a49fea8765420efd9646497d2a
Opcode Fuzzy Hash: 711883755e967174166c771be66c080798932c6e11d56cd6f74aa121bd91870f
Instruction Fuzzy Hash: B2825D76B08A4ACAEB14CFA5E8607A967A1FB88F88F044135DE0957B58DF3DE584C700

Function 00007FFD65655380 Relevance: 146.8, APIs: 76, Strings: 7, Instructions: 1511windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00007FFD656553E5
BeginPaint.USER32 ref: 00007FFD65655403
GetClientRect.USER32 ref: 00007FFD6565541B
QueryPerformanceFrequency.KERNEL32 ref: 00007FFD65655479
QueryPerformanceCounter.KERNEL32 ref: 00007FFD6565548A
GetTickCount.KERNEL32 ref: 00007FFD65655492
SelectObject.GDI32 ref: 00007FFD656554A2
StretchDIBits.GDI32 ref: 00007FFD6565559F
GdipCreateFromHDC.GDIPLUS ref: 00007FFD656555B0
SystemParametersInfoW.USER32 ref: 00007FFD65655729
StretchDIBits.GDI32 ref: 00007FFD65655A86
MulDiv.KERNEL32 ref: 00007FFD65655C16
StretchDIBits.GDI32 ref: 00007FFD65655D20
GetModuleHandleW.KERNEL32 ref: 00007FFD65655E63
LoadStringW.USER32 ref: 00007FFD65655E83
DwmIsCompositionEnabled.DWMAPI ref: 00007FFD65656241
DwmGetWindowAttribute.DWMAPI ref: 00007FFD65656270
MulDiv.KERNEL32 ref: 00007FFD65656290
IsThemeActive.UXTHEME ref: 00007FFD6565633F
DrawThemeTextEx.UXTHEME ref: 00007FFD65656395
DrawThemeTextEx.UXTHEME ref: 00007FFD656563EB

Part of subcall function 00007FFD656A7C0C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7C35

Part of subcall function 00007FFD65652F60: CreateCompatibleDC.GDI32 ref: 00007FFD65652F9B
Part of subcall function 00007FFD65652F60: SelectObject.GDI32 ref: 00007FFD65652FAA
Part of subcall function 00007FFD65652F60: CreateDIBSection.GDI32 ref: 00007FFD65653027
Part of subcall function 00007FFD65652F60: SelectObject.GDI32 ref: 00007FFD65653036
Part of subcall function 00007FFD65652F60: SetTextColor.GDI32 ref: 00007FFD65653050
Part of subcall function 00007FFD65652F60: SetBkColor.GDI32 ref: 00007FFD6565305B
Part of subcall function 00007FFD65652F60: SetBkMode.GDI32 ref: 00007FFD65653069
Part of subcall function 00007FFD65652F60: DrawTextW.USER32 ref: 00007FFD65653085

CreateCompatibleDC.GDI32 ref: 00007FFD65656455
SelectObject.GDI32 ref: 00007FFD65656464
GetObjectW.GDI32 ref: 00007FFD65656485
GdiAlphaBlend.GDI32 ref: 00007FFD656564D3
SelectObject.GDI32 ref: 00007FFD656564DF
DeleteObject.GDI32 ref: 00007FFD656564E8
DeleteDC.GDI32 ref: 00007FFD656564F1
CreateCompatibleDC.GDI32 ref: 00007FFD65656562
SelectObject.GDI32 ref: 00007FFD65656571
GetObjectW.GDI32 ref: 00007FFD65656592
GdiAlphaBlend.GDI32 ref: 00007FFD656565E0
SelectObject.GDI32 ref: 00007FFD656565EC
DeleteObject.GDI32 ref: 00007FFD656565F5
DeleteDC.GDI32 ref: 00007FFD656565FE
GetIconInfo.USER32 ref: 00007FFD6565679C
GetObjectW.GDI32 ref: 00007FFD656567B7
DeleteObject.GDI32 ref: 00007FFD656567DB
DeleteObject.GDI32 ref: 00007FFD656567EA
SelectObject.GDI32 ref: 00007FFD656569AB
IsThemeActive.UXTHEME ref: 00007FFD656569C6
DrawThemeTextEx.UXTHEME ref: 00007FFD65656A11
CreateCompatibleDC.GDI32 ref: 00007FFD65656A76
SelectObject.GDI32 ref: 00007FFD65656A85
GetObjectW.GDI32 ref: 00007FFD65656AA6
GdiAlphaBlend.GDI32 ref: 00007FFD65656AF4
SelectObject.GDI32 ref: 00007FFD65656B00
DeleteObject.GDI32 ref: 00007FFD65656B09
DeleteDC.GDI32 ref: 00007FFD65656B12
SelectObject.GDI32 ref: 00007FFD65656B22
MulDiv.KERNEL32 ref: 00007FFD65656B59
MulDiv.KERNEL32 ref: 00007FFD65656B70
IsThemeActive.UXTHEME ref: 00007FFD65656BA4
DrawThemeTextEx.UXTHEME ref: 00007FFD65656BEF
CreateCompatibleDC.GDI32 ref: 00007FFD65656C54
SelectObject.GDI32 ref: 00007FFD65656C63
GetObjectW.GDI32 ref: 00007FFD65656C84
GdiAlphaBlend.GDI32 ref: 00007FFD65656CD8
SelectObject.GDI32 ref: 00007FFD65656CE4
DeleteObject.GDI32 ref: 00007FFD65656CED
DeleteDC.GDI32 ref: 00007FFD65656CF6
GdipDeleteGraphics.GDIPLUS ref: 00007FFD65656D77
ResetEvent.KERNEL32 ref: 00007FFD65656DE9
UpdateLayeredWindow.USER32 ref: 00007FFD65656E3C
BitBlt.GDI32 ref: 00007FFD65656E75
QueryPerformanceFrequency.KERNEL32 ref: 00007FFD65656E82
QueryPerformanceCounter.KERNEL32 ref: 00007FFD65656E93
GetTickCount.KERNEL32 ref: 00007FFD65656EAF
EndPaint.USER32 ref: 00007FFD65656EFC

Strings

%, xrefs: 00007FFD65656BD3
(%d) , xrefs: 00007FFD65655F43
Desktop, xrefs: 00007FFD65655E8E
, xrefs: 00007FFD65656E54
ExplorerFrame.dll, xrefs: 00007FFD65655E5C
\rundll32.exe, xrefs: 00007FFD65655EBD
, xrefs: 00007FFD65655C5B

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Object$Select$Delete$CreateTheme$Text$CompatibleDraw$AlphaBlendPerformanceQuery$ActiveBitsStretchWindow$ColorCountCounterFrequencyGdipInfoPaintTick$AttributeBeginClientCompositionEnabledEventFromGraphicsHandleIconLayeredLoadModeModuleParametersRectResetSectionStringSystemUpdateVisible_invalid_parameter_noinfo
String ID: $ $%$(%d) $Desktop$ExplorerFrame.dll$\rundll32.exe
API String ID: 3026936367-3704886723
Opcode ID: 8004d31d2916429a112b036949a7ced1a4dc0d09858fd7f6daf62b0a02ee4215
Instruction ID: 11e8ca13ec1a93c35152c525bc0ef81962a614113ff3ac256f12718cb8df9e99
Opcode Fuzzy Hash: 8004d31d2916429a112b036949a7ced1a4dc0d09858fd7f6daf62b0a02ee4215
Instruction Fuzzy Hash: 16F28E32B08B85CAEB65CF65D8647E977A1FB54B88F004236DA4A57B94DF3CE584CB00

Function 00007FFD6568DD30 Relevance: 98.2, APIs: 7, Strings: 49, Instructions: 183registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD656A7C0C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7C35

RegCreateKeyExW.ADVAPI32 ref: 00007FFD6568DE10
RegQueryValueExW.ADVAPI32 ref: 00007FFD6568DE59
RegQueryValueExW.ADVAPI32 ref: 00007FFD6568DED7
RegQueryValueExW.ADVAPI32 ref: 00007FFD6568DF28
RegQueryValueExW.ADVAPI32 ref: 00007FFD6568DF59
RegQueryValueExW.ADVAPI32 ref: 00007FFD6568DFAB
RegCloseKey.ADVAPI32 ref: 00007FFD6568DFD8

Part of subcall function 00007FFD6568DD30: CreateEventW.KERNEL32 ref: 00007FFD6568C682
Part of subcall function 00007FFD6568DD30: WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6568C6C1
Part of subcall function 00007FFD6568DD30: WindowsCreateString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6568C6EB
Part of subcall function 00007FFD6568DD30: InternetOpenA.WININET ref: 00007FFD6568C72F
Part of subcall function 00007FFD6568DD30: WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6568C74F
Part of subcall function 00007FFD6568DD30: InternetOpenUrlW.WININET ref: 00007FFD6568C772

Strings

FilterAdministratorToken, xrefs: 00007FFD6568D437
html_url, xrefs: 00007FFD6568D8DC
ep_setup.exe, xrefs: 00007FFD6568DA14, 00007FFD6568DE96
https://github.com/valinet/ExplorerPatcher/releases/latest, xrefs: 00007FFD6568DDAC, 00007FFD6568DE6C, 00007FFD6568DEE9
invalid, xrefs: 00007FFD6568CADA
[Updates] Checking against hash "%s", xrefs: 00007FFD6568DDC4
updates.cpp, xrefs: 00007FFD6568D7EA, 00007FFD6568D873, 00007FFD6568D8AA, 00007FFD6568D90A, 00007FFD6568D96F, 00007FFD6568D9AA, 00007FFD6568DB5B, 00007FFD6568DC62, 00007FFD6568DC8A, 00007FFD6568DCB9
Windows.Data.Json.JsonArray, xrefs: 00007FFD6568D79C
[Updates] Hash of remote file is "%s" (%s)., xrefs: 00007FFD6568CAE5
[Updates] Downloaded finished., xrefs: 00007FFD6568D1D5
iex (irm 'https://raw.githubusercontent.com/valinet/ep_make/master/ep_make_safe.ps1'), xrefs: 00007FFD6568D5F0
UpdateURLStaging, xrefs: 00007FFD6568DF8E
S-1-5-, xrefs: 00007FFD6568D3D2
Software\ExplorerPatcher, xrefs: 00007FFD6568CE19, 00007FFD6568D076, 00007FFD6568DDE8
[Updates] Failed. Read %d bytes., xrefs: 00007FFD6568CEAC
UpdatePreferStaging, xrefs: 00007FFD6568DF3C
https://api.github.com/repos/valinet/ExplorerPatcher/releases?per_page=1, xrefs: 00007FFD6568DF67, 00007FFD6568DFBE
\ExplorerPatcher\ep_gui.dll, xrefs: 00007FFD6568D4D0
\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00007FFD6568D0A3
[Updates] Release notes URL: "%s", xrefs: 00007FFD6568C960
UpdateURL, xrefs: 00007FFD6568DE43, 00007FFD6568DEBE
ExplorerPatcher_GUI_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FFD6568D55C
ConsentPromptBehaviorAdmin, xrefs: 00007FFD6568D2AC
[Updates] Update successful, File Explorer will probably restart momentarily., xrefs: 00007FFD6568D668
/download/, xrefs: 00007FFD6568DE81
browser_download_url, xrefs: 00007FFD6568DC20
assets, xrefs: 00007FFD6568D940
/update_silent, xrefs: 00007FFD6568D5F7
ExplorerPatcher, xrefs: 00007FFD6568C728, 00007FFD6568CA00
[Updates] Prerelease update URL: "%s", xrefs: 00007FFD6568C980
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00007FFD6568D2B3, 00007FFD6568D43E
\ExplorerPatcher, xrefs: 00007FFD6568CF00
name, xrefs: 00007FFD6568DA84
runas, xrefs: 00007FFD6568D5D4
[Updates] In order to install this update for the product "ExplorerPatcher", please allow the request., xrefs: 00007FFD6568D20A
valid, xrefs: 00007FFD6568CAD1
[Updates] Local version obtained from hash is %d.%d.%d.%d., xrefs: 00007FFD6568CCDA
ExplorerPatcher, xrefs: 00007FFD6568D572
\Update for ExplorerPatcher from , xrefs: 00007FFD6568CF3C
kernel32.dll, xrefs: 00007FFD6568D25D
UpdateUseLocal, xrefs: 00007FFD6568D06F
[Updates] Update URL: %s, xrefs: 00007FFD6568DFE2
UpdateTimeout, xrefs: 00007FFD6568DF0B
CheckElevationEnabled, xrefs: 00007FFD6568D26D
[Updates] Update failed because the request was denied., xrefs: 00007FFD6568D6C0
[Updates] Update failed because the following error has occured: %d., xrefs: 00007FFD6568D692, 00007FFD6568D6DF
open, xrefs: 00007FFD6568D5CD
[Updates] Download path is "%s"., xrefs: 00007FFD6568D01C
UpdateAllowDowngrades, xrefs: 00007FFD6568CE12

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: QueryValue$CreateStringWindows$InternetOpen$BufferCloseDeleteEvent_invalid_parameter_noinfo
String ID: /download/$/update_silent$CheckElevationEnabled$ConsentPromptBehaviorAdmin$ExplorerPatcher$ExplorerPatcher$ExplorerPatcher_GUI_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}$FilterAdministratorToken$S-1-5-$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System$Software\ExplorerPatcher$UpdateAllowDowngrades$UpdatePreferStaging$UpdateTimeout$UpdateURL$UpdateURLStaging$UpdateUseLocal$Windows.Data.Json.JsonArray$[Updates] Checking against hash "%s"$[Updates] Download path is "%s".$[Updates] Downloaded finished.$[Updates] Failed. Read %d bytes.$[Updates] Hash of remote file is "%s" (%s).$[Updates] In order to install this update for the product "ExplorerPatcher", please allow the request.$[Updates] Local version obtained from hash is %d.%d.%d.%d.$[Updates] Prerelease update URL: "%s"$[Updates] Release notes URL: "%s"$[Updates] Update URL: %s$[Updates] Update failed because the following error has occured: %d.$[Updates] Update failed because the request was denied.$[Updates] Update successful, File Explorer will probably restart momentarily.$\ExplorerPatcher$\ExplorerPatcher\ep_gui.dll$\Update for ExplorerPatcher from $\WindowsPowerShell\v1.0\powershell.exe$assets$browser_download_url$ep_setup.exe$html_url$https://api.github.com/repos/valinet/ExplorerPatcher/releases?per_page=1$https://github.com/valinet/ExplorerPatcher/releases/latest$iex (irm 'https://raw.githubusercontent.com/valinet/ep_make/master/ep_make_safe.ps1')$invalid$kernel32.dll$name$open$runas$updates.cpp$valid
API String ID: 1866200-3143775457
Opcode ID: f48a65fc542332675df43c0f4c3631243fcddafdc05fa17b4744a3873ee274da
Instruction ID: 0bc15d08beae060aa0022ef3be7683ccfd2939225d8f981b67e31ea0971e3ba1
Opcode Fuzzy Hash: f48a65fc542332675df43c0f4c3631243fcddafdc05fa17b4744a3873ee274da
Instruction Fuzzy Hash: B4910C72B18E55DAFB208BA4E8547DE77B0FB84758F500236DA4D57AA8DF38D189CB00

Function 00007FFD6568E620 Relevance: 88.1, APIs: 33, Strings: 17, Instructions: 568filelibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD65674E90: RegCreateKeyExW.ADVAPI32 ref: 00007FFD65674EEC
Part of subcall function 00007FFD65674E90: RegQueryValueExW.ADVAPI32 ref: 00007FFD65674F41
Part of subcall function 00007FFD65674E90: GetLocaleInfoW.KERNEL32 ref: 00007FFD65674F8A
Part of subcall function 00007FFD65674E90: GetLocaleInfoW.KERNEL32 ref: 00007FFD65674FA5
Part of subcall function 00007FFD65674E90: SetThreadPreferredUILanguages.KERNEL32 ref: 00007FFD6567505B
Part of subcall function 00007FFD65674E90: RegCloseKey.ADVAPI32 ref: 00007FFD6567506B

SHGetFolderPathW.SHELL32 ref: 00007FFD6568E69B

Part of subcall function 00007FFD656A7C0C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7C35

LoadLibraryExW.KERNEL32 ref: 00007FFD6568E6C8
FindResourceW.KERNEL32 ref: 00007FFD6568E70F
SizeofResource.KERNEL32 ref: 00007FFD6568E71E
LoadResource.KERNEL32 ref: 00007FFD6568E72D
LockResource.KERNEL32 ref: 00007FFD6568E739
LocalAlloc.KERNEL32 ref: 00007FFD6568E74A
FreeResource.KERNEL32 ref: 00007FFD6568E764
VerQueryValueW.VERSION ref: 00007FFD6568E77D
LocalFree.KERNEL32 ref: 00007FFD6568E7B4
LoadStringW.USER32 ref: 00007FFD6568E8E1
LoadStringW.USER32 ref: 00007FFD6568E913
LoadStringW.USER32 ref: 00007FFD6568E942
GetModuleFileNameW.KERNEL32 ref: 00007FFD6568EA32
CreateFileW.KERNEL32 ref: 00007FFD6568EA95
CreateFileMappingW.KERNEL32 ref: 00007FFD6568EAC0
CloseHandle.KERNEL32 ref: 00007FFD6568EAD1
MapViewOfFile.KERNEL32 ref: 00007FFD6568EAEC
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD6568EB1C
UnmapViewOfFile.KERNEL32 ref: 00007FFD6568EB24
CloseHandle.KERNEL32 ref: 00007FFD6568EB2D
CloseHandle.KERNEL32 ref: 00007FFD6568EB36
LoadStringW.USER32 ref: 00007FFD6568EC62
LoadStringW.USER32 ref: 00007FFD6568EC7D
LoadStringW.USER32 ref: 00007FFD6568ED6A
LoadStringW.USER32 ref: 00007FFD6568ED7E
LoadStringW.USER32 ref: 00007FFD6568EDCF
LoadStringW.USER32 ref: 00007FFD6568EDF2
FreeLibrary.KERNEL32 ref: 00007FFD6568EEBF
LoadStringW.USER32 ref: 00007FFD6568EF30
LoadStringW.USER32 ref: 00007FFD6568EF42
LoadStringW.USER32 ref: 00007FFD6568EF5D
FreeLibrary.KERNEL32 ref: 00007FFD6568EFFF

Strings

action=update, xrefs: 00007FFD6568EDF8
This, xrefs: 00007FFD6568EB4B
[Updates] Configured update policy on this system: "Install updates automatically"., xrefs: 00007FFD6568E8BA
[Updates] An update is available., xrefs: 00007FFD6568EBEA
<toast scenario="reminder" activationType="protocol" launch="%s" duration="%s"><visual><binding template="ToastGeneric">, xrefs: 00007FFD6568E7FA
short, xrefs: 00007FFD6568ECB0, 00007FFD6568EF90
https://github.com/valinet/ExplorerPatcher/releases/latest, xrefs: 00007FFD6568E6E9
[Updates] Using hardcoded hash., xrefs: 00007FFD6568EB7B
[Updates] Configured update policy on this system: "Check for updates but let me choose whether to download and install them"., xrefs: 00007FFD6568E8A8
<progress value="{progressValue}" status="{progressStatus}"/>, xrefs: 00007FFD6568E8E7
\ExplorerPatcher\ep_gui.dll, xrefs: 00007FFD6568E6A1
[Updates] Configured update policy on this system: "Manually check for updates"., xrefs: 00007FFD6568E7E4
<actions><action content="%s" arguments="%s"/></actions>, xrefs: 00007FFD6568EE0B
[Updates] No updates are available., xrefs: 00007FFD6568EED7
long, xrefs: 00007FFD6568E891, 00007FFD6568EE50
[Updates] Unable to check for updates because the remote server is unavailable., xrefs: 00007FFD6568EED0
[Updates] Path to module: %s, xrefs: 00007FFD6568EA3F

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Load$String$FileResource$CloseFree$CreateHandleLibrary$InfoLocalLocaleQueryValueView_invalid_parameter_noinfo$AllocFindFolderLanguagesLockMappingModuleNamePathPreferredSizeofThreadUnmap
String ID: <progress value="{progressValue}" status="{progressStatus}"/>$<actions><action content="%s" arguments="%s"/></actions>$<toast scenario="reminder" activationType="protocol" launch="%s" duration="%s"><visual><binding template="ToastGeneric">$This$[Updates] An update is available.$[Updates] Configured update policy on this system: "Check for updates but let me choose whether to download and install them".$[Updates] Configured update policy on this system: "Install updates automatically".$[Updates] Configured update policy on this system: "Manually check for updates".$[Updates] No updates are available.$[Updates] Path to module: %s$[Updates] Unable to check for updates because the remote server is unavailable.$[Updates] Using hardcoded hash.$\ExplorerPatcher\ep_gui.dll$action=update$https://github.com/valinet/ExplorerPatcher/releases/latest$long$short
API String ID: 3445338827-2029114158
Opcode ID: 6f9a3a13e40f8a26155c297df19f68e736b4aeb311e71b466cd00d917e358fc6
Instruction ID: bedbd05e4e8aac9ed07061110972f06212962180d0059099b18caf2d7c8738c9
Opcode Fuzzy Hash: 6f9a3a13e40f8a26155c297df19f68e736b4aeb311e71b466cd00d917e358fc6
Instruction Fuzzy Hash: 32523D32B18F8AC6EB608F65D8607EA63A0FB85B48F405231DA4D17B59EF3CD695C740

Function 00007FFD656601B0 Relevance: 77.4, APIs: 39, Strings: 5, Instructions: 375windowkeyboardregistryCOMMON

Download Yara Rule

APIs

RegisterWindowMessageW.USER32 ref: 00007FFD65660460
GetModuleHandleW.KERNEL32 ref: 00007FFD6566048A
LoadMenuW.USER32 ref: 00007FFD65660498
LoadMenuW.USER32 ref: 00007FFD656604BB
GetSubMenu.USER32 ref: 00007FFD656604DA
GetAsyncKeyState.USER32 ref: 00007FFD656604F9
GetAsyncKeyState.USER32 ref: 00007FFD65660509
DeleteMenu.USER32 ref: 00007FFD6566051F
DeleteMenu.USER32 ref: 00007FFD65660530
DeleteMenu.USER32 ref: 00007FFD65660541
GetModuleHandleW.KERNEL32 ref: 00007FFD6566056E
LoadStringW.USER32 ref: 00007FFD65660586
GetModuleHandleW.KERNEL32 ref: 00007FFD65660599
LoadStringW.USER32 ref: 00007FFD656605AE
ModifyMenuW.USER32 ref: 00007FFD656605E8
#413.COMCTL32 ref: 00007FFD65660929

Strings

%SystemRoot%\system32\taskmgr.exe, xrefs: 00007FFD65660876
P, xrefs: 00007FFD65660791
c, xrefs: 00007FFD65660799
ExplorerFrame.dll, xrefs: 00007FFD656606F5
Windows11ContextMenu_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FFD65660459

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Menu$Load$DeleteHandleModule$AsyncStateString$#413MessageModifyRegisterWindow
String ID: %SystemRoot%\system32\taskmgr.exe$ExplorerFrame.dll$P$Windows11ContextMenu_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}$c
API String ID: 2510583281-2371452002
Opcode ID: f9d560b070c91b04f8ca3e6fc8ef0ada0cda45978650c2a06835ca219aa19d69
Instruction ID: 6bd9fd49f3bfec75127390b92ea65b11321d3eff619ce2ff89ebbb2aaae04c0f
Opcode Fuzzy Hash: f9d560b070c91b04f8ca3e6fc8ef0ada0cda45978650c2a06835ca219aa19d69
Instruction Fuzzy Hash: A7F16D35F58E4AC6FB648BA1E8247B923A1FF85F58F405135C90E4AA94DF3CA586CB01

Function 00007FFD65666380 Relevance: 77.3, APIs: 23, Strings: 21, Instructions: 289registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 00007FFD656663E0
RegQueryValueExW.ADVAPI32 ref: 00007FFD65666426
RegCloseKey.ADVAPI32 ref: 00007FFD65666440
RegCreateKeyExW.ADVAPI32 ref: 00007FFD6566647A
RegQueryValueExW.ADVAPI32 ref: 00007FFD65666582
RegQueryValueExW.ADVAPI32 ref: 00007FFD656665AE
RegQueryValueExW.ADVAPI32 ref: 00007FFD656665DA
RegQueryValueExW.ADVAPI32 ref: 00007FFD65666606
RegQueryValueExW.ADVAPI32 ref: 00007FFD65666632
RegQueryValueExW.ADVAPI32 ref: 00007FFD6566665E
RegQueryValueExW.ADVAPI32 ref: 00007FFD6566668A
RegQueryValueExW.ADVAPI32 ref: 00007FFD656666C1
RegQueryValueExW.ADVAPI32 ref: 00007FFD656666ED
RegQueryValueExW.ADVAPI32 ref: 00007FFD65666720
RegQueryValueExW.ADVAPI32 ref: 00007FFD65666753
RegQueryValueExW.ADVAPI32 ref: 00007FFD65666786
RegQueryValueExW.ADVAPI32 ref: 00007FFD656667B9
RegQueryValueExW.ADVAPI32 ref: 00007FFD656667EC
RegQueryValueExW.ADVAPI32 ref: 00007FFD6566681F
RegQueryValueExW.ADVAPI32 ref: 00007FFD65666852
RegQueryValueExW.ADVAPI32 ref: 00007FFD65666885
RegQueryValueExW.ADVAPI32 ref: 00007FFD656668B8
RegCloseKey.ADVAPI32 ref: 00007FFD6566690A

Part of subcall function 00007FFD656552E0: UnregisterHotKey.USER32 ref: 00007FFD656552F2
Part of subcall function 00007FFD656552E0: UnregisterHotKey.USER32 ref: 00007FFD65655301
Part of subcall function 00007FFD656552E0: UnregisterHotKey.USER32 ref: 00007FFD65655310
Part of subcall function 00007FFD656552E0: UnregisterHotKey.USER32 ref: 00007FFD6565531F
Part of subcall function 00007FFD656552E0: UnregisterHotKey.USER32 ref: 00007FFD65655337
Part of subcall function 00007FFD656552E0: UnregisterHotKey.USER32 ref: 00007FFD65655346
Part of subcall function 00007FFD656552E0: UnregisterHotKey.USER32 ref: 00007FFD65655355

Part of subcall function 00007FFD656550A0: MapVirtualKeyExW.USER32 ref: 00007FFD656550C1
Part of subcall function 00007FFD656550A0: RegisterHotKey.USER32 ref: 00007FFD656550EC
Part of subcall function 00007FFD656550A0: GetLastError.KERNEL32 ref: 00007FFD656550F6
Part of subcall function 00007FFD656550A0: RegisterHotKey.USER32 ref: 00007FFD6565512E
Part of subcall function 00007FFD656550A0: GetLastError.KERNEL32 ref: 00007FFD65655138
Part of subcall function 00007FFD656550A0: RegisterHotKey.USER32 ref: 00007FFD65655166
Part of subcall function 00007FFD656550A0: GetLastError.KERNEL32 ref: 00007FFD65655170
Part of subcall function 00007FFD656550A0: RegisterHotKey.USER32 ref: 00007FFD656551A8
Part of subcall function 00007FFD656550A0: GetLastError.KERNEL32 ref: 00007FFD656551B2
Part of subcall function 00007FFD656550A0: RegisterHotKey.USER32 ref: 00007FFD656551DD
Part of subcall function 00007FFD656550A0: GetLastError.KERNEL32 ref: 00007FFD656551E7
Part of subcall function 00007FFD656550A0: RegisterHotKey.USER32 ref: 00007FFD6565521F

Part of subcall function 00007FFD65654910: DwmSetWindowAttribute.DWMAPI ref: 00007FFD656549A4
Part of subcall function 00007FFD65654910: DwmExtendFrameIntoClientArea.DWMAPI ref: 00007FFD656549BA
Part of subcall function 00007FFD65654910: DwmSetWindowAttribute.DWMAPI ref: 00007FFD65654A19
Part of subcall function 00007FFD65654910: DwmSetWindowAttribute.DWMAPI ref: 00007FFD65654A4B

Strings

MaxWidthAbs, xrefs: 00007FFD65666733
MasterPadding, xrefs: 00007FFD656667CC
ShowDelay, xrefs: 00007FFD6566669C
NoPerApplicationList, xrefs: 00007FFD65666799
PrimaryOnly, xrefs: 00007FFD656666D4
ScrollWheelBehavior, xrefs: 00007FFD65666865
IncludeWallpaper, xrefs: 00007FFD6566654B
MaxWidth, xrefs: 00007FFD656665C1
CornerPreference, xrefs: 00007FFD65666671
PerMonitor, xrefs: 00007FFD65666700
Software\ExplorerPatcher\sws, xrefs: 00007FFD65666454
SwitcherIsPerApplication, xrefs: 00007FFD65666806
ScrollWheelInvert, xrefs: 00007FFD65666898
ColorScheme, xrefs: 00007FFD65666619
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer, xrefs: 00007FFD656663B2
RowHeight, xrefs: 00007FFD65666595
AlwaysUseWindowTitleAndIcon, xrefs: 00007FFD65666832
MaxHeight, xrefs: 00007FFD656665ED
AltTabSettings, xrefs: 00007FFD65666409
MaxHeightAbs, xrefs: 00007FFD65666766
Theme, xrefs: 00007FFD6566664D

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: QueryValue$Unregister$Register$ErrorLast$AttributeWindow$CloseCreate$AreaClientExtendFrameIntoVirtual
String ID: AltTabSettings$AlwaysUseWindowTitleAndIcon$ColorScheme$CornerPreference$IncludeWallpaper$MasterPadding$MaxHeight$MaxHeightAbs$MaxWidth$MaxWidthAbs$NoPerApplicationList$PerMonitor$PrimaryOnly$RowHeight$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer$ScrollWheelBehavior$ScrollWheelInvert$ShowDelay$Software\ExplorerPatcher\sws$SwitcherIsPerApplication$Theme
API String ID: 120246194-1466656710
Opcode ID: 08e0dc4a089c58c7e65733ad880e94a8016b912be8f752c570bb8e0c7e152e0d
Instruction ID: c4566b3f5f46fca9207372348f483de9d24a76425329b268b89ce1dee212e52c
Opcode Fuzzy Hash: 08e0dc4a089c58c7e65733ad880e94a8016b912be8f752c570bb8e0c7e152e0d
Instruction Fuzzy Hash: 80F1F576B14B56CAEB208FA0E454B9D77B4F788B58F841235DA8C17B28DF38C199CB14

Function 00007FFD65688190 Relevance: 73.9, APIs: 39, Strings: 3, Instructions: 401registrysynchronizationwindowCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FFD656881E0
CloseHandle.KERNEL32 ref: 00007FFD656881ED
GetCursorPos.USER32 ref: 00007FFD65688245
MonitorFromPoint.USER32 ref: 00007FFD65688263
FindWindowExW.USER32 ref: 00007FFD6568828B
MonitorFromWindow.USER32 ref: 00007FFD6568829A
MonitorFromPoint.USER32 ref: 00007FFD656882BB
GetMonitorInfoW.USER32 ref: 00007FFD656882C8
FindWindowExW.USER32 ref: 00007FFD656882DD
MonitorFromWindow.USER32 ref: 00007FFD656882EC
GetMonitorInfoW.USER32 ref: 00007FFD656882F9
GetWindowRect.USER32 ref: 00007FFD6568830C
GetCursorPos.USER32 ref: 00007FFD6568833A
IsThemeActive.UXTHEME ref: 00007FFD6568836B
PtInRect.USER32 ref: 00007FFD65688382
WindowFromPoint.USER32 ref: 00007FFD65688393
GetClassWord.USER32 ref: 00007FFD656883A1
RegisterWindowMessageW.USER32 ref: 00007FFD656883B1
MonitorFromPoint.USER32 ref: 00007FFD656883C5
GetMonitorInfoW.USER32 ref: 00007FFD656883DC
WindowFromPoint.USER32 ref: 00007FFD656883E5
GetClassNameW.USER32 ref: 00007FFD6568841B
FindWindowExW.USER32 ref: 00007FFD65688461
GetWindowRect.USER32 ref: 00007FFD65688471
GetDpiForMonitor.API-MS-WIN-SHCORE-SCALING-L1-1-1 ref: 00007FFD656884FC
GetCursorPos.USER32 ref: 00007FFD65688585
SetCursorPos.USER32 ref: 00007FFD656885E3
SetCursorPos.USER32 ref: 00007FFD6568860F
CreateThread.KERNEL32 ref: 00007FFD656887B9

Strings

Start, xrefs: 00007FFD656883A7, 00007FFD65688455
Shell_TrayWnd, xrefs: 00007FFD656882A0, 00007FFD656886AD
Shell_SecondaryTrayWnd, xrefs: 00007FFD65688271, 00007FFD65688654

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Window$Monitor$From$CursorPoint$FindInfoRect$Class$ActiveCloseCreateHandleMessageNameObjectRegisterSingleThemeThreadWaitWord
String ID: Shell_SecondaryTrayWnd$Shell_TrayWnd$Start
API String ID: 3963456163-2175658619
Opcode ID: 1f3180e44d35f91ef1a9850fb378fe04d911e7c89125ff2bf70966cd8cc43956
Instruction ID: e4803e62d002b671e426b1d8178b083e333ea8ae77345c1ca3c02cfbf28c42f7
Opcode Fuzzy Hash: 1f3180e44d35f91ef1a9850fb378fe04d911e7c89125ff2bf70966cd8cc43956
Instruction Fuzzy Hash: 2D126D76B08E46C6EB158BA5E4643AA73B1FB88F94F044235DA4E57B68DF3CE481C700

Function 00007FFD656847D0 Relevance: 68.5, APIs: 18, Strings: 21, Instructions: 256registrymemoryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 00007FFD6568483E
GetSystemDirectoryA.KERNEL32 ref: 00007FFD656848A5

Part of subcall function 00007FFD656AA224: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656AA24C

GetSystemDirectoryW.KERNEL32 ref: 00007FFD656848F6

Part of subcall function 00007FFD656A7C0C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7C35

Part of subcall function 00007FFD6568FC70: CreateFileW.KERNELBASE ref: 00007FFD6568FCEB
Part of subcall function 00007FFD6568FC70: GetLastError.KERNEL32 ref: 00007FFD6568FCFA

Part of subcall function 00007FFD6565CE30: CreateFileA.KERNEL32 ref: 00007FFD6565CEAB

VirtualProtect.KERNEL32 ref: 00007FFD656849B8
VirtualProtect.KERNEL32 ref: 00007FFD656849E6
RegCloseKey.ADVAPI32 ref: 00007FFD65684A5A
RegSetValueExW.ADVAPI32 ref: 00007FFD65684AB0
RegSetValueExW.ADVAPI32 ref: 00007FFD65684ADC
RegSetValueExW.ADVAPI32 ref: 00007FFD65684B08
RegSetValueExW.ADVAPI32 ref: 00007FFD65684B34
RegSetValueExW.ADVAPI32 ref: 00007FFD65684B60
RegSetValueExW.ADVAPI32 ref: 00007FFD65684B8C
RegSetValueExW.ADVAPI32 ref: 00007FFD65684BB8
RegSetValueExW.ADVAPI32 ref: 00007FFD65684BE4
RegSetValueExW.ADVAPI32 ref: 00007FFD65684C10
RegSetValueExA.ADVAPI32 ref: 00007FFD65684C50
RegSetValueExW.ADVAPI32 ref: 00007FFD65684C85

Part of subcall function 00007FFD65652890: GetModuleHandleW.KERNEL32 ref: 00007FFD656528AF
Part of subcall function 00007FFD65652890: GetProcAddress.KERNEL32 ref: 00007FFD656528C8
Part of subcall function 00007FFD65652890: RegOpenKeyExW.KERNELBASE ref: 00007FFD6565293F
Part of subcall function 00007FFD65652890: RegQueryValueExW.KERNELBASE ref: 00007FFD6565296F

RegCloseKey.ADVAPI32 ref: 00007FFD65684C95

Strings

[Symbols] Downloading symbols for "%s" ("%s")..., xrefs: 00007FFD6568492E
CLauncherTipContextMenu::_ExecuteCommand, xrefs: 00007FFD65684B77
.dll, xrefs: 00007FFD656848D5
CLauncherTipContextMenu::ShowLauncherTipContextMenu, xrefs: 00007FFD65684BA3
CLauncherTipContextMenu::GetMenuItemsAsync, xrefs: 00007FFD65684AC7
Hash, xrefs: 00007FFD65684C30
ImmersiveContextMenuHelper::ApplyOwnerDrawToMenu, xrefs: 00007FFD65684AF3
CImmersiveContextMenuOwnerDrawHelper::s_ContextMenuWndProc, xrefs: 00007FFD65684A93
[Symbols] Reading symbols..., xrefs: 00007FFD6568496B
CLauncherTipContextMenu::_ExecuteShutdownCommand, xrefs: 00007FFD65684B4B
[Symbols] Please refer to "https://github.com/valinet/ExplorerPatcher/wiki/Symbols" for more information., xrefs: 00007FFD6568495A
twinui.pcshell, xrefs: 00007FFD656848C0
CMultitaskingViewManager::_CreateDCompMTVHost, xrefs: 00007FFD65684BFB
[Symbols] Symbols for "%s" are not available - unable to download., xrefs: 00007FFD6568494E
CMultitaskingViewManager::_CreateXamlMTVHost, xrefs: 00007FFD65684BCF
Version, xrefs: 00007FFD65684C68
\twinui.pcshell.dll, xrefs: 00007FFD656848FC
[Symbols] Unable to create registry key., xrefs: 00007FFD65684CA2
ImmersiveContextMenuHelper::RemoveOwnerDrawFromMenu, xrefs: 00007FFD65684B1F
[Symbols] Failure in reading symbols for "%s"., xrefs: 00007FFD65684A40
Software\ExplorerPatcher\twinui.pcshell, xrefs: 00007FFD65684816

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Value$Create$CloseDirectoryFileProtectSystemVirtual_invalid_parameter_noinfo$AddressErrorHandleLastModuleOpenProcQuery
String ID: .dll$CImmersiveContextMenuOwnerDrawHelper::s_ContextMenuWndProc$CLauncherTipContextMenu::GetMenuItemsAsync$CLauncherTipContextMenu::ShowLauncherTipContextMenu$CLauncherTipContextMenu::_ExecuteCommand$CLauncherTipContextMenu::_ExecuteShutdownCommand$CMultitaskingViewManager::_CreateDCompMTVHost$CMultitaskingViewManager::_CreateXamlMTVHost$Hash$ImmersiveContextMenuHelper::ApplyOwnerDrawToMenu$ImmersiveContextMenuHelper::RemoveOwnerDrawFromMenu$Software\ExplorerPatcher\twinui.pcshell$Version$[Symbols] Downloading symbols for "%s" ("%s")...$[Symbols] Failure in reading symbols for "%s".$[Symbols] Please refer to "https://github.com/valinet/ExplorerPatcher/wiki/Symbols" for more information.$[Symbols] Reading symbols...$[Symbols] Symbols for "%s" are not available - unable to download.$[Symbols] Unable to create registry key.$\twinui.pcshell.dll$twinui.pcshell
API String ID: 2736650789-497210955
Opcode ID: 0675f4ab8254927a775032cea71827116847c6cb81a9a532533a81f165ca049e
Instruction ID: f03bfac562afb6789510bfdac11a5dc05b5349a5e8bbcdca33ecb28be491c79b
Opcode Fuzzy Hash: 0675f4ab8254927a775032cea71827116847c6cb81a9a532533a81f165ca049e
Instruction Fuzzy Hash: 64D16775B18E4AC6EB20DF94E8603A97375FB84B58F404131DA8D47AA4DFBCD589C740

Function 00007FFD65670370 Relevance: 63.3, APIs: 24, Strings: 12, Instructions: 291registrywindowCOMMON

Download Yara Rule

APIs

SetProcessDpiAwarenessContext.USER32 ref: 00007FFD6567039F

Part of subcall function 00007FFD6565D7C0: AllocateAndInitializeSid.ADVAPI32 ref: 00007FFD6565D829
Part of subcall function 00007FFD6565D7C0: CheckTokenMembership.KERNELBASE ref: 00007FFD6565D83F
Part of subcall function 00007FFD6565D7C0: GetLastError.KERNEL32 ref: 00007FFD6565D849
Part of subcall function 00007FFD6565D7C0: FreeSid.ADVAPI32 ref: 00007FFD6565D85B

GetModuleFileNameW.KERNEL32 ref: 00007FFD656703E2
GetCurrentDirectoryW.KERNEL32 ref: 00007FFD65670407
GetModuleHandleW.KERNEL32 ref: 00007FFD65670413
ShellExecuteExW.SHELL32 ref: 00007FFD656704EA
GetLastError.KERNEL32 ref: 00007FFD656704F8
LoadStringW.USER32 ref: 00007FFD6567054A
LoadStringW.USER32 ref: 00007FFD65670569
MessageBoxW.USER32 ref: 00007FFD65670585
GetModuleFileNameW.KERNEL32 ref: 00007FFD656705EE
GetLastError.KERNEL32 ref: 00007FFD656705F8
RegCreateKeyExW.ADVAPI32 ref: 00007FFD65670644
RegSetValueExW.ADVAPI32 ref: 00007FFD656706AB
RegSetValueExW.ADVAPI32 ref: 00007FFD656706D3
RegCloseKey.ADVAPI32 ref: 00007FFD656706E0
PathRemoveExtensionW.SHLWAPI ref: 00007FFD656706F3
PathRemoveExtensionW.SHLWAPI ref: 00007FFD656706FE
RegCreateKeyExW.ADVAPI32 ref: 00007FFD6567074E
RegSetValueExW.ADVAPI32 ref: 00007FFD656707AB
RegSetValueExW.ADVAPI32 ref: 00007FFD656707D3
RegCloseKey.ADVAPI32 ref: 00007FFD656707E0
RegCreateKeyExW.ADVAPI32 ref: 00007FFD65670822
RegSetValueExW.ADVAPI32 ref: 00007FFD65670863
RegCloseKey.ADVAPI32 ref: 00007FFD65670870

Strings

SOFTWARE\Classes\Drive\shellex\FolderExtensions\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FFD656707FD
DriveMask, xrefs: 00007FFD6567085C
MessageBoxW, xrefs: 00007FFD65670423
SOFTWARE\Classes\CLSID\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}\InProcServer32, xrefs: 00007FFD65670617
runas, xrefs: 00007FFD65670489
ThreadingModel, xrefs: 00007FFD656706B6, 00007FFD656707B6
ext-ms-win-ntuser-dialogbox-l1-1-0.dll, xrefs: 00007FFD6567042A
SOFTWARE\WOW6432Node\Classes\CLSID\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}\InProcServer32, xrefs: 00007FFD65670729
.IA-32.dll, xrefs: 00007FFD65670704
Apartment, xrefs: 00007FFD6567064F
p, xrefs: 00007FFD656704AB
\ExplorerPatcher.amd64.dll", xrefs: 00007FFD65670471

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Value$CloseCreateErrorLastModule$ExtensionFileLoadNamePathRemoveString$AllocateAwarenessCheckContextCurrentDirectoryExecuteFreeHandleInitializeMembershipMessageProcessShellToken
String ID: .IA-32.dll$Apartment$DriveMask$MessageBoxW$SOFTWARE\Classes\CLSID\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}\InProcServer32$SOFTWARE\Classes\Drive\shellex\FolderExtensions\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}$SOFTWARE\WOW6432Node\Classes\CLSID\{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}\InProcServer32$ThreadingModel$\ExplorerPatcher.amd64.dll"$ext-ms-win-ntuser-dialogbox-l1-1-0.dll$p$runas
API String ID: 3183597740-1688178669
Opcode ID: ceaab783ba9ea9b201be885b6fc26ef9a5b853ab2f436d5dad6f9baee700225c
Instruction ID: 0e7a231d3e9dc339eefb832af4f3c1fe7cc862f1366e946ad89e4aec07ce02ed
Opcode Fuzzy Hash: ceaab783ba9ea9b201be885b6fc26ef9a5b853ab2f436d5dad6f9baee700225c
Instruction Fuzzy Hash: EFE15171B18F86C6EB209FA0E4643AA73A1FB84B64F404235DA9D47B98DF7DD195CB00

Function 00007FFD6566F5E0 Relevance: 61.6, APIs: 20, Strings: 15, Instructions: 322registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 00007FFD6566F63B
RegQueryValueExW.ADVAPI32 ref: 00007FFD6566F680
RegQueryValueExW.ADVAPI32 ref: 00007FFD6566F6B3
RegCloseKey.ADVAPI32 ref: 00007FFD6566F6BD
RegCreateKeyExW.ADVAPI32 ref: 00007FFD6566F6F6
RegQueryValueExW.ADVAPI32 ref: 00007FFD6566F742
RegQueryValueExW.ADVAPI32 ref: 00007FFD6566F78E
RegQueryValueExW.ADVAPI32 ref: 00007FFD6566F7DC
RegQueryValueExW.ADVAPI32 ref: 00007FFD6566F82A
RegCloseKey.ADVAPI32 ref: 00007FFD6566F855
RegCreateKeyExW.ADVAPI32 ref: 00007FFD6566F88E
RegQueryValueExW.ADVAPI32 ref: 00007FFD6566F903
RegQueryValueExW.ADVAPI32 ref: 00007FFD6566F988
RegCloseKey.ADVAPI32 ref: 00007FFD6566F9B4
RegCreateKeyExW.ADVAPI32 ref: 00007FFD6566F9ED
RegQueryValueExW.ADVAPI32 ref: 00007FFD6566FA32
RegCloseKey.ADVAPI32 ref: 00007FFD6566FA55
RegCreateKeyExW.ADVAPI32 ref: 00007FFD6566FA8E
RegQueryValueExW.ADVAPI32 ref: 00007FFD6566FACB
RegCloseKey.ADVAPI32 ref: 00007FFD6566FAEA

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00007FFD6566FA69
TaskbarAl, xrefs: 00007FFD6566F95D
StartUI_EnableRoundedCorners, xrefs: 00007FFD6566F7AD
Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher, xrefs: 00007FFD6566F6D1
Start_MaximumFrequentApps, xrefs: 00007FFD6566F725
SOFTWARE\Policies\Microsoft\Windows\Explorer, xrefs: 00007FFD6566F9C8
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage, xrefs: 00007FFD6566F60B
StartUI_ShowMoreTiles, xrefs: 00007FFD6566F7FB
StartDocked_DisableRecommendedSection, xrefs: 00007FFD6566F75F
MonitorOverride, xrefs: 00007FFD6566F693
NoStartMenuMorePrograms, xrefs: 00007FFD6566FAB2
MakeAllAppsDefault, xrefs: 00007FFD6566F667
Start_ShowClassicMode, xrefs: 00007FFD6566F8DC
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FFD6566F869
ForceStartSize, xrefs: 00007FFD6566FA19

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: QueryValue$CloseCreate
String ID: ForceStartSize$MakeAllAppsDefault$MonitorOverride$NoStartMenuMorePrograms$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer$SOFTWARE\Policies\Microsoft\Windows\Explorer$Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher$StartDocked_DisableRecommendedSection$StartUI_EnableRoundedCorners$StartUI_ShowMoreTiles$Start_MaximumFrequentApps$Start_ShowClassicMode$TaskbarAl
API String ID: 2657993070-1512199074
Opcode ID: 7e91b4fd689718da68debbc9959a60179704b034e2a6f1ebd680488db1f3f30f
Instruction ID: 8ac55778d7ff58a84100c7b263a24c837c2098b2a920f0f9fd74df0b5a918b78
Opcode Fuzzy Hash: 7e91b4fd689718da68debbc9959a60179704b034e2a6f1ebd680488db1f3f30f
Instruction Fuzzy Hash: E9F1F476F18B06CAEB10CFA0E4A07A977B4FB84B58F500635DA4D52A68DF3CD184CB50

Function 00007FFD6568BD00 Relevance: 54.8, APIs: 21, Strings: 10, Instructions: 574libraryCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FFD6568BD47
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6568BD78
RoActivateInstance.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD6568BD90
StrFormatByteSizeW.SHLWAPI ref: 00007FFD6568BF7D
StrFormatByteSizeW.SHLWAPI ref: 00007FFD6568BF9A
SHGetFolderPathW.SHELL32 ref: 00007FFD6568C006
LoadLibraryExW.KERNEL32 ref: 00007FFD6568C033
LoadStringW.USER32 ref: 00007FFD6568C052
FreeLibrary.KERNEL32 ref: 00007FFD6568C061
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6568C0B0
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6568C0DB

Part of subcall function 00007FFD656A7CA8: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7CCE

WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6568C19D
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6568C1CA
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6568C314
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6568C470
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6568C524

Strings

Windows.UI.Notifications.NotificationData, xrefs: 00007FFD6568BD71
action=update, xrefs: 00007FFD6568C4B6
updates.cpp, xrefs: 00007FFD6568BDA6, 00007FFD6568BE1C, 00007FFD6568BE84, 00007FFD6568C10B, 00007FFD6568C1FA, 00007FFD6568C27F, 00007FFD6568C345, 00007FFD6568C447, 00007FFD6568C493
\ExplorerPatcher\ep_gui.dll, xrefs: 00007FFD6568C00C
progressValue, xrefs: 00007FFD6568C0D4
indeterminate, xrefs: 00007FFD6568BF4E
EP_Ev_InstallUpdatesNoConfirm_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FFD6568C4E2
ep_updates, xrefs: 00007FFD6568C30D
progressStatus, xrefs: 00007FFD6568C1C3
%s / %s, xrefs: 00007FFD6568BFA8

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: String$Windows$CreateReference$ByteDeleteFormatLibraryLoadSize$ActivateCounterFolderFreeInstancePathPerformanceQuery_invalid_parameter_noinfo
String ID: %s / %s$EP_Ev_InstallUpdatesNoConfirm_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}$Windows.UI.Notifications.NotificationData$\ExplorerPatcher\ep_gui.dll$action=update$ep_updates$indeterminate$progressStatus$progressValue$updates.cpp
API String ID: 2375332063-2428038664
Opcode ID: d9f4d5dde8a7d03f1098689d6001779440e47441b912f1d012fa573a0040d778
Instruction ID: 5fce03132a53b0eb6e4c3190f16605a54d42ae29e09f3f4347de8268888e156e
Opcode Fuzzy Hash: d9f4d5dde8a7d03f1098689d6001779440e47441b912f1d012fa573a0040d778
Instruction Fuzzy Hash: 62324D32B08F4AC6EB149BA5E4607AE6361FB84F84F444636DA4E57B64DF3CD489C700

Function 00007FFD65684420 Relevance: 52.7, APIs: 13, Strings: 17, Instructions: 191registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 00007FFD65684491
GetWindowsDirectoryA.KERNEL32 ref: 00007FFD656844F8

Part of subcall function 00007FFD656AA224: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656AA24C

GetWindowsDirectoryW.KERNEL32 ref: 00007FFD6568451F

Part of subcall function 00007FFD656A7C0C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7C35

Part of subcall function 00007FFD6568FC70: CreateFileW.KERNELBASE ref: 00007FFD6568FCEB
Part of subcall function 00007FFD6568FC70: GetLastError.KERNEL32 ref: 00007FFD6568FCFA

Part of subcall function 00007FFD6565CE30: CreateFileA.KERNEL32 ref: 00007FFD6565CEAB

RegSetValueExW.ADVAPI32 ref: 00007FFD65684607
RegSetValueExW.ADVAPI32 ref: 00007FFD65684633
RegSetValueExW.ADVAPI32 ref: 00007FFD6568465F
RegSetValueExW.ADVAPI32 ref: 00007FFD6568468B
RegSetValueExW.ADVAPI32 ref: 00007FFD656846B7
RegSetValueExW.ADVAPI32 ref: 00007FFD656846E3
RegSetValueExA.ADVAPI32 ref: 00007FFD65684723
RegSetValueExW.ADVAPI32 ref: 00007FFD65684758
RegCloseKey.ADVAPI32 ref: 00007FFD65684768
RegCloseKey.ADVAPI32 ref: 00007FFD6568478F

Strings

Software\ExplorerPatcher\explorer, xrefs: 00007FFD65684471
[Symbols] Downloading symbols for "%s" ("%s")..., xrefs: 00007FFD65684557
HandleFirstTimeLegacy, xrefs: 00007FFD65684676
SetColorPreferenceForLogonUI, xrefs: 00007FFD656846A2
\explorer.exe, xrefs: 00007FFD656844FE
TrayUI::_UpdatePearlSize, xrefs: 00007FFD656846CE
ImmersiveTray::RaiseWindow, xrefs: 00007FFD6568461E
Hash, xrefs: 00007FFD65684703
ImmersiveTray::AttachWindowToTray, xrefs: 00007FFD656845EA
[Symbols] Reading symbols..., xrefs: 00007FFD65684594
[Symbols] Please refer to "https://github.com/valinet/ExplorerPatcher/wiki/Symbols" for more information., xrefs: 00007FFD65684583
[Symbols] Symbols for "%s" are not available - unable to download., xrefs: 00007FFD65684577
Version, xrefs: 00007FFD6568473B
[Symbols] Unable to create registry key., xrefs: 00007FFD65684797
[Symbols] Failure in reading symbols for "%s"., xrefs: 00007FFD65684779
CTaskBand_CreateInstance, xrefs: 00007FFD6568464A
\explorer.exe, xrefs: 00007FFD65684525

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Value$Create$CloseDirectoryFileWindows_invalid_parameter_noinfo$ErrorLast
String ID: CTaskBand_CreateInstance$HandleFirstTimeLegacy$Hash$ImmersiveTray::AttachWindowToTray$ImmersiveTray::RaiseWindow$SetColorPreferenceForLogonUI$Software\ExplorerPatcher\explorer$TrayUI::_UpdatePearlSize$Version$[Symbols] Downloading symbols for "%s" ("%s")...$[Symbols] Failure in reading symbols for "%s".$[Symbols] Please refer to "https://github.com/valinet/ExplorerPatcher/wiki/Symbols" for more information.$[Symbols] Reading symbols...$[Symbols] Symbols for "%s" are not available - unable to download.$[Symbols] Unable to create registry key.$\explorer.exe$\explorer.exe
API String ID: 3922731654-964289750
Opcode ID: 106e1ce24d9322d45e8a4499fdd46a895db9c7ec386d72e10d2cb2b8b8a8a8c4
Instruction ID: 1c6219cb4815aeca65aa03f8f23e2a2b809bc21e46a00c62a03bba1875e84bea
Opcode Fuzzy Hash: 106e1ce24d9322d45e8a4499fdd46a895db9c7ec386d72e10d2cb2b8b8a8a8c4
Instruction Fuzzy Hash: 0DA17972B18E46C6EB20DFA4E4607A97371FB84B58F404231DA8D47AA9DFBCD189C740

Function 00007FFD65663350 Relevance: 51.0, APIs: 19, Strings: 10, Instructions: 297synchronizationregistrythreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FFD656634B1
CloseHandle.KERNEL32 ref: 00007FFD656634BE
ShellExecuteW.SHELL32 ref: 00007FFD656635AC
ShellExecuteW.SHELL32 ref: 00007FFD656636C0
CreateThread.KERNEL32 ref: 00007FFD656635CB

Part of subcall function 00007FFD65652890: GetModuleHandleW.KERNEL32 ref: 00007FFD656528AF
Part of subcall function 00007FFD65652890: GetProcAddress.KERNEL32 ref: 00007FFD656528C8
Part of subcall function 00007FFD65652890: RegOpenKeyExW.KERNELBASE ref: 00007FFD6565293F
Part of subcall function 00007FFD65652890: RegQueryValueExW.KERNELBASE ref: 00007FFD6565296F

WaitForSingleObject.KERNEL32 ref: 00007FFD6566374F
WaitForSingleObject.KERNEL32 ref: 00007FFD65663772
CloseHandle.KERNEL32 ref: 00007FFD6566377F
RegCreateKeyExW.ADVAPI32 ref: 00007FFD656637C4
RegCloseKey.ADVAPI32 ref: 00007FFD656637D2
Sleep.KERNEL32 ref: 00007FFD656637F9
CreateThread.KERNEL32 ref: 00007FFD65663818

Part of subcall function 00007FFD65672140: CoCreateInstance.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD6565E15D), ref: 00007FFD6567217F
Part of subcall function 00007FFD65672140: IUnknown_QueryService.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD6565E15D), ref: 00007FFD656721AA
Part of subcall function 00007FFD65672140: WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD6565E15D), ref: 00007FFD656721D6
Part of subcall function 00007FFD65672140: WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD6565E15D), ref: 00007FFD6567223D

CoCreateInstance.OLE32 ref: 00007FFD65663836

Strings

van.dll, xrefs: 00007FFD65663539, 00007FFD6566363F
ms-settings:network, xrefs: 00007FFD6566352A, 00007FFD65663631
ReplaceVan, xrefs: 00007FFD656633EF
ms-availablenetworks:, xrefs: 00007FFD6566350B, 00007FFD6566360C
shell:::{7007ACC7-3202-11D1-AAD2-00805FC1270E}, xrefs: 00007FFD6566358C, 00007FFD656636A0
ShowVAN, xrefs: 00007FFD6566354E, 00007FFD65663658
open, xrefs: 00007FFD6566359B, 00007FFD656636AF
shell:::{8E908FC9-BECC-40f6-915B-F4CA0E70D03D}, xrefs: 00007FFD6566357D, 00007FFD6566368E
Control Panel\Quick Actions\Control Center\QuickActionsStateCapture\ExplorerPatcher, xrefs: 00007FFD6566379A
SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Settings\Network, xrefs: 00007FFD65663405

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Create$CloseHandleObjectSingleWait$ExecuteInstanceQueryShellStringThreadWindows$AddressDeleteModuleOpenProcReferenceServiceSleepUnknown_Value
String ID: Control Panel\Quick Actions\Control Center\QuickActionsStateCapture\ExplorerPatcher$ReplaceVan$SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Settings\Network$ShowVAN$ms-availablenetworks:$ms-settings:network$open$shell:::{7007ACC7-3202-11D1-AAD2-00805FC1270E}$shell:::{8E908FC9-BECC-40f6-915B-F4CA0E70D03D}$van.dll
API String ID: 1920378819-2880650144
Opcode ID: b675cd6dceb69a7e36282b34b0d70cd36532ff9b7445b0c106042c40146c3297
Instruction ID: 11a5e3d9154848ba47cbee303f42bf4b9e673c3f28a6a8cc5e0ed7a9c29d079c
Opcode Fuzzy Hash: b675cd6dceb69a7e36282b34b0d70cd36532ff9b7445b0c106042c40146c3297
Instruction Fuzzy Hash: AFE12335F58E4AC6FB649BE1E8707B923A1AF84B58F50413AD90E476A4DF3CA8C4C701

Function 00007FFD6565CE30 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 248fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD656AA224: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656AA24C

CreateFileA.KERNEL32 ref: 00007FFD6565CEAB
CreateFileMappingW.KERNEL32 ref: 00007FFD6565CEE3
CloseHandle.KERNEL32 ref: 00007FFD6565CEF4

Strings

/download/symbols/, xrefs: 00007FFD6565CE6C
%x/, xrefs: 00007FFD6565D17E
%08lX%04hX%04hX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX, xrefs: 00007FFD6565D111
RSDS, xrefs: 00007FFD6565D063

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CreateFile$CloseHandleMapping_invalid_parameter_noinfo
String ID: %08lX%04hX%04hX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX$%x/$/download/symbols/$RSDS
API String ID: 1983873661-2402091955
Opcode ID: 487057ca424dff22dcf5c02e0f811aaff343f7eb314c5405646703778120c259
Instruction ID: 9d1a51d6b69290527ecf6b719a37c4cdf70dea0eb9f5c748176ba5312ef04905
Opcode Fuzzy Hash: 487057ca424dff22dcf5c02e0f811aaff343f7eb314c5405646703778120c259
Instruction Fuzzy Hash: 01B18971B08A8AC6EB249B91E4247B967B0FB85F54F444131DA5A07BD4DF3CE6E5C700

Function 00007FFD65684CE0 Relevance: 50.9, APIs: 12, Strings: 17, Instructions: 182registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 00007FFD65684D51
GetWindowsDirectoryA.KERNEL32 ref: 00007FFD65684DB8

Part of subcall function 00007FFD656AA224: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656AA24C

GetWindowsDirectoryW.KERNEL32 ref: 00007FFD65684E09

Part of subcall function 00007FFD656A7C0C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7C35

Part of subcall function 00007FFD6568FC70: CreateFileW.KERNELBASE ref: 00007FFD6568FCEB
Part of subcall function 00007FFD6568FC70: GetLastError.KERNEL32 ref: 00007FFD6568FCFA

Part of subcall function 00007FFD6565CE30: CreateFileA.KERNEL32 ref: 00007FFD6565CEAB

RegCloseKey.ADVAPI32 ref: 00007FFD65684EC1
RegSetValueExW.ADVAPI32 ref: 00007FFD65684EEE
RegSetValueExW.ADVAPI32 ref: 00007FFD65684F1A
RegSetValueExW.ADVAPI32 ref: 00007FFD65684F46
RegSetValueExW.ADVAPI32 ref: 00007FFD65684F72
RegSetValueExW.ADVAPI32 ref: 00007FFD65684F9E
RegSetValueExA.ADVAPI32 ref: 00007FFD65684FDE
RegSetValueExW.ADVAPI32 ref: 00007FFD65685013
RegCloseKey.ADVAPI32 ref: 00007FFD65685023

Strings

[Symbols] Downloading symbols for "%s" ("%s")..., xrefs: 00007FFD65684E41
.dll, xrefs: 00007FFD65684DE8
\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartDocked.dll, xrefs: 00007FFD65684E0F
Hash, xrefs: 00007FFD65684FBE
StartDocked::SystemListPolicyProvider::GetMaximumFrequentApps, xrefs: 00007FFD65684F5D
[Symbols] Reading symbols..., xrefs: 00007FFD65684E7B
Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher\StartDocked, xrefs: 00007FFD65684D31
[Symbols] Please refer to "https://github.com/valinet/ExplorerPatcher/wiki/Symbols" for more information., xrefs: 00007FFD65684E6D
\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\, xrefs: 00007FFD65684DBE
StartDocked::LauncherFrame::OnVisibilityChanged, xrefs: 00007FFD65684F31
[Symbols] Symbols for "%s" are not available - unable to download., xrefs: 00007FFD65684E61
StartDocked::StartSizingFrame::StartSizingFrame, xrefs: 00007FFD65684F89
Version, xrefs: 00007FFD65684FF6
StartDocked, xrefs: 00007FFD65684DD3
[Symbols] Unable to create registry key., xrefs: 00007FFD65685030
StartDocked::LauncherFrame::ShowAllApps, xrefs: 00007FFD65684ED1, 00007FFD65684F05
[Symbols] Failure in reading symbols for "%s"., xrefs: 00007FFD65684EA7

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Value$Create$CloseDirectoryFileWindows_invalid_parameter_noinfo$ErrorLast
String ID: .dll$Hash$Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher\StartDocked$StartDocked$StartDocked::LauncherFrame::OnVisibilityChanged$StartDocked::LauncherFrame::ShowAllApps$StartDocked::StartSizingFrame::StartSizingFrame$StartDocked::SystemListPolicyProvider::GetMaximumFrequentApps$Version$[Symbols] Downloading symbols for "%s" ("%s")...$[Symbols] Failure in reading symbols for "%s".$[Symbols] Please refer to "https://github.com/valinet/ExplorerPatcher/wiki/Symbols" for more information.$[Symbols] Reading symbols...$[Symbols] Symbols for "%s" are not available - unable to download.$[Symbols] Unable to create registry key.$\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\$\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartDocked.dll
API String ID: 3922731654-50308056
Opcode ID: 57d90254c9c19c550f591e3b05eaf88ccb49ecfd7eea07f34ada1ed5097ac538
Instruction ID: 4671ba4678b862652cbc76bf39e9225bf81577a2ce267fdc587990fdebbba3e2
Opcode Fuzzy Hash: 57d90254c9c19c550f591e3b05eaf88ccb49ecfd7eea07f34ada1ed5097ac538
Instruction Fuzzy Hash: BD916972B18E46D6EB20DFA4E8607A97370FB94B58F404232DA8D47AA5DF7CD189C740

Function 00007FFD65685070 Relevance: 49.2, APIs: 13, Strings: 15, Instructions: 174registryfileCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 00007FFD656850DE
GetWindowsDirectoryW.KERNEL32 ref: 00007FFD65685116

Part of subcall function 00007FFD656A7C0C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7C35

FindFirstFileW.KERNEL32 ref: 00007FFD65685140
FindClose.KERNEL32 ref: 00007FFD6568514F

Part of subcall function 00007FFD6565CAC0: GetSystemInfo.KERNEL32 ref: 00007FFD6565CAF2
Part of subcall function 00007FFD6565CAC0: SymGetOptions.DBGHELP ref: 00007FFD6565CB02
Part of subcall function 00007FFD6565CAC0: SymSetOptions.DBGHELP ref: 00007FFD6565CB12
Part of subcall function 00007FFD6565CAC0: SymInitialize.DBGHELP ref: 00007FFD6565CB22

GetWindowsDirectoryW.KERNEL32 ref: 00007FFD65685163
FindFirstFileW.KERNEL32 ref: 00007FFD6568518D
FindClose.KERNEL32 ref: 00007FFD656851A0
GetWindowsDirectoryA.KERNEL32 ref: 00007FFD656851CB
RegCloseKey.ADVAPI32 ref: 00007FFD656852ED
RegSetValueExW.ADVAPI32 ref: 00007FFD6568531A
RegSetValueExA.ADVAPI32 ref: 00007FFD65685360
RegSetValueExW.ADVAPI32 ref: 00007FFD65685395
RegCloseKey.ADVAPI32 ref: 00007FFD656853A5

Strings

[Symbols] Downloading symbols for "%s" ("%s")..., xrefs: 00007FFD65685264
StartUI.dll, xrefs: 00007FFD656851F2
Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher\StartUI, xrefs: 00007FFD656850B6
\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI.dll, xrefs: 00007FFD6568511C
Hash, xrefs: 00007FFD6568533E
\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll, xrefs: 00007FFD65685169
[Symbols] Reading symbols..., xrefs: 00007FFD656852A4
[Symbols] Please refer to "https://github.com/valinet/ExplorerPatcher/wiki/Symbols" for more information., xrefs: 00007FFD65685296
StartUI_.dll, xrefs: 00007FFD656851E9
\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\, xrefs: 00007FFD656851D1
[Symbols] Symbols for "%s" are not available - unable to download., xrefs: 00007FFD6568528A
Version, xrefs: 00007FFD65685378
[Symbols] Unable to create registry key., xrefs: 00007FFD656853B2
[Symbols] Failure in reading symbols for "%s"., xrefs: 00007FFD656852D3
StartUI::SystemListPolicyProvider::GetMaximumFrequentApps, xrefs: 00007FFD656852FD

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CloseFind$DirectoryValueWindows$FileFirstOptions$CreateInfoInitializeSystem_invalid_parameter_noinfo
String ID: Hash$Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher\StartUI$StartUI.dll$StartUI::SystemListPolicyProvider::GetMaximumFrequentApps$StartUI_.dll$Version$[Symbols] Downloading symbols for "%s" ("%s")...$[Symbols] Failure in reading symbols for "%s".$[Symbols] Please refer to "https://github.com/valinet/ExplorerPatcher/wiki/Symbols" for more information.$[Symbols] Reading symbols...$[Symbols] Symbols for "%s" are not available - unable to download.$[Symbols] Unable to create registry key.$\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\$\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI.dll$\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartUI_.dll
API String ID: 1213659724-3422473855
Opcode ID: 09fcb9d82f41ee2f3310ba133a493f16fa31f4de6f2d332b26b52c2ab1a2e9e2
Instruction ID: 4a1e316369421a5599ee96a2abb24f4e37be8de82ac2076505b30573904698e0
Opcode Fuzzy Hash: 09fcb9d82f41ee2f3310ba133a493f16fa31f4de6f2d332b26b52c2ab1a2e9e2
Instruction Fuzzy Hash: E1912331B18E8AD6EB20DFA4E8A43E92360FB94B54F404231D65E47AE5DF7CD689C740

Function 00007FFD6565C200 Relevance: 43.9, APIs: 21, Strings: 4, Instructions: 195windowprocessCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FFD6565C25F
GetForegroundWindow.USER32 ref: 00007FFD6565C265
SetForegroundWindow.USER32 ref: 00007FFD6565C273
CreatePopupMenu.USER32 ref: 00007FFD6565C279
PathUnquoteSpacesW.SHLWAPI ref: 00007FFD6565C2BC
PathRemoveExtensionW.SHLWAPI ref: 00007FFD6565C2C6
PathStripPathW.SHLWAPI ref: 00007FFD6565C2D0
wsprintfW.USER32 ref: 00007FFD6565C2E8
InsertMenuW.USER32 ref: 00007FFD6565C30B
InsertMenuW.USER32 ref: 00007FFD6565C32E
TrackPopupMenu.USER32 ref: 00007FFD6565C388
SetForegroundWindow.USER32 ref: 00007FFD6565C3A8
wsprintfW.USER32 ref: 00007FFD6565C3E7
PathUnquoteSpacesW.SHLWAPI ref: 00007FFD6565C475
PathRemoveExtensionW.SHLWAPI ref: 00007FFD6565C482
wsprintfW.USER32 ref: 00007FFD6565C4A4
CreateProcessW.KERNEL32 ref: 00007FFD6565C508
CloseHandle.KERNEL32 ref: 00007FFD6565C513
CloseHandle.KERNEL32 ref: 00007FFD6565C51E
DestroyMenu.USER32 ref: 00007FFD6565C527
ShowWindow.USER32 ref: 00007FFD6565C532

Strings

&Extract to "%s\", xrefs: 00007FFD6565C2DA
&Open archive, xrefs: 00007FFD6565C311
"C:\Program Files\7-Zip\7zG.exe" x -o"%s" -spe %s, xrefs: 00007FFD6565C496
"C:\Program Files\7-Zip\7zFM.exe" %s, xrefs: 00007FFD6565C3D9

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Path$Menu$Window$Foregroundwsprintf$CloseCreateExtensionHandleInsertPopupRemoveSpacesUnquote$CursorDestroyProcessShowStripTrack
String ID: "C:\Program Files\7-Zip\7zFM.exe" %s$"C:\Program Files\7-Zip\7zG.exe" x -o"%s" -spe %s$&Extract to "%s\"$&Open archive
API String ID: 369530117-1140292191
Opcode ID: 93874475ace18eb1cf65213562b3bc3a7745d5ecebc0d05dff543d959da77ce0
Instruction ID: 102b89f6a639a7c9f2e09e09978980aec7a797e3526996b311bd2a74db02aefd
Opcode Fuzzy Hash: 93874475ace18eb1cf65213562b3bc3a7745d5ecebc0d05dff543d959da77ce0
Instruction Fuzzy Hash: B7917D32B18E8AC5EB209BA1E8647ED2771FB85B98F804131DA5E07AA4DF3CD195C740

Function 00007FFD6565B150 Relevance: 42.8, APIs: 20, Strings: 4, Instructions: 773COMMON

Download Yara Rule

APIs

GetMonitorInfoW.USER32 ref: 00007FFD6565B263
GetLastError.KERNEL32 ref: 00007FFD6565B26D
GetSystemDirectoryW.KERNEL32 ref: 00007FFD6565B3A8
DwmGetWindowAttribute.DWMAPI ref: 00007FFD6565B412
GetPropW.USER32 ref: 00007FFD6565B515
GetPropW.USER32 ref: 00007FFD6565B52E
MonitorFromWindow.USER32 ref: 00007FFD6565B596
MonitorFromWindow.USER32 ref: 00007FFD6565B5A4
CoTaskMemFree.OLE32 ref: 00007FFD6565B619
GetPropW.USER32 ref: 00007FFD6565B6DA
GetPropW.USER32 ref: 00007FFD6565B6EF
MonitorFromWindow.USER32 ref: 00007FFD6565B743
MonitorFromWindow.USER32 ref: 00007FFD6565B751
MonitorFromWindow.USER32 ref: 00007FFD6565B78F
#334.COMCTL32 ref: 00007FFD6565B7CF
GetDpiForMonitor.API-MS-WIN-SHCORE-SCALING-L1-1-1 ref: 00007FFD6565B990
CreateFontIndirectW.GDI32 ref: 00007FFD6565BE03
GetLastError.KERNEL32 ref: 00007FFD6565BE15
CreateFontIndirectW.GDI32 ref: 00007FFD6565BE53
GetLastError.KERNEL32 ref: 00007FFD6565BE65

Strings

valinet.ExplorerPatcher.ShellManagedWindow, xrefs: 00007FFD6565B524, 00007FFD6565B6E5
Segoe UI, xrefs: 00007FFD6565BDAA
Microsoft.Windows.ShellManagedWindowAsNormalWindow, xrefs: 00007FFD6565B50B, 00007FFD6565B6D0
\rundll32.exe, xrefs: 00007FFD6565B3AE

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Monitor$Window$From$Prop$ErrorLast$CreateFontIndirect$#334AttributeDirectoryFreeInfoSystemTask
String ID: Microsoft.Windows.ShellManagedWindowAsNormalWindow$Segoe UI$\rundll32.exe$valinet.ExplorerPatcher.ShellManagedWindow
API String ID: 3197630062-846598209
Opcode ID: 61a72c6c5e4e7b9bdc74e535ae390a072383054a70b169dddcfed75f182e1dfd
Instruction ID: 14030ed770a44efce71bc7c9a1de5fb42178aabb1dc5b96896f6b3c373f18e07
Opcode Fuzzy Hash: 61a72c6c5e4e7b9bdc74e535ae390a072383054a70b169dddcfed75f182e1dfd
Instruction Fuzzy Hash: A172A072B19B46CAEB51CF75D06876973A5FB85B88F158235EA0F93654EF38E480CB00

Function 00007FFD6566FE40 Relevance: 40.6, APIs: 18, Strings: 5, Instructions: 349COMMON

Download Yara Rule

APIs

WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6566FE8C
RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD6566FEBE
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6566FF2F
OpenMutexW.KERNEL32 ref: 00007FFD6566FF7B
CloseHandle.KERNEL32 ref: 00007FFD6566FF89
ShowWindow.USER32 ref: 00007FFD6566FF9E
EnumDisplayMonitors.USER32 ref: 00007FFD65670020
MonitorFromPoint.USER32 ref: 00007FFD6567003C
FindWindowExW.USER32 ref: 00007FFD65670056
MonitorFromWindow.USER32 ref: 00007FFD6567006C
FindWindowExW.USER32 ref: 00007FFD6567008F
MonitorFromWindow.USER32 ref: 00007FFD656700A5
MonitorFromWindow.USER32 ref: 00007FFD656700EB
GetMonitorInfoW.USER32 ref: 00007FFD656700F8
GetWindowRect.USER32 ref: 00007FFD65670111
GetCursorPos.USER32 ref: 00007FFD65670157
SetWindowPos.USER32 ref: 00007FFD656702DA
SetWindowRgn.USER32 ref: 00007FFD65670345

Strings

!@, xrefs: 00007FFD656702C3
EPStart10_AnimationsPatched_{A6EA9C2D-4982-4827-9204-0AC532959F6D}, xrefs: 00007FFD6566FF6D
Shell_TrayWnd, xrefs: 00007FFD65670048
Windows.UI.Xaml.Window, xrefs: 00007FFD6566FE81
Shell_SecondaryTrayWnd, xrefs: 00007FFD65670083

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Window$Monitor$From$FindStringWindows$ActivationCloseCreateCursorDeleteDisplayEnumFactoryHandleInfoMonitorsMutexOpenPointRectReferenceShow
String ID: !@$EPStart10_AnimationsPatched_{A6EA9C2D-4982-4827-9204-0AC532959F6D}$Shell_SecondaryTrayWnd$Shell_TrayWnd$Windows.UI.Xaml.Window
API String ID: 3798604058-3529946197
Opcode ID: 6d5bf6db88b1762e8315eea215af2d78978069de4b08654467cf73516330815b
Instruction ID: 7ce048849eeb3c10f315cc20a18f2c31c7d7a70639ec9ac3c5fade7064256998
Opcode Fuzzy Hash: 6d5bf6db88b1762e8315eea215af2d78978069de4b08654467cf73516330815b
Instruction Fuzzy Hash: E5F12936F09A4BCAF720CBE5D8647AD37B1BB44B98F004135CE0957A98DE3DA995CB10

Function 00007FFD6566CCB0 Relevance: 40.4, APIs: 15, Strings: 8, Instructions: 163sleepregistryprocessCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 00007FFD6566CDA7
CloseHandle.KERNEL32 ref: 00007FFD6566CDB6
CloseHandle.KERNEL32 ref: 00007FFD6566CDC1
RegSetKeyValueW.ADVAPI32 ref: 00007FFD6566CE74
SetLastError.KERNEL32 ref: 00007FFD6566CE7C
CreateEventW.KERNEL32 ref: 00007FFD6566CE90
GetLastError.KERNEL32 ref: 00007FFD6566CE9E
SetEvent.KERNEL32 ref: 00007FFD6566CEAE
CreateThread.KERNEL32 ref: 00007FFD6566CED0
Sleep.KERNEL32 ref: 00007FFD6566CEDB
SetLastError.KERNEL32 ref: 00007FFD6566CEE3
CreateEventW.KERNEL32 ref: 00007FFD6566CEF7
GetLastError.KERNEL32 ref: 00007FFD6566CF05
SetEvent.KERNEL32 ref: 00007FFD6566CF15
ShellExecuteW.SHELL32 ref: 00007FFD6566CF3F

Strings

h, xrefs: 00007FFD6566CD2E
eplink://update/stable, xrefs: 00007FFD6566CE0B
EP_Ev_InstallUpdates_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FFD6566CE82, 00007FFD6566CEE9
Software\ExplorerPatcher, xrefs: 00007FFD6566CE6D
open, xrefs: 00007FFD6566CF36
eplink://update, xrefs: 00007FFD6566CDEE
eplink://update/staging, xrefs: 00007FFD6566CE2C
UpdatePreferStaging, xrefs: 00007FFD6566CE5F

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CreateErrorEventLast$CloseHandle$ExecuteProcessShellSleepThreadValue
String ID: EP_Ev_InstallUpdates_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}$Software\ExplorerPatcher$UpdatePreferStaging$eplink://update$eplink://update/stable$eplink://update/staging$h$open
API String ID: 2028834884-198725195
Opcode ID: a274810f2dd4b0325282cfab0de87efade91e6e96364b1a32c500caf592512fb
Instruction ID: 071e2700ea490a150e8eccd3c375556edcd8ff78249c318862f68f78f0877b43
Opcode Fuzzy Hash: a274810f2dd4b0325282cfab0de87efade91e6e96364b1a32c500caf592512fb
Instruction Fuzzy Hash: F3715031B08F8AC2FB649F95E5603AA6360FF98B94F505135DA8E46AA4DF7CE1C1C701

Function 00007FFD65690840 Relevance: 37.1, APIs: 16, Strings: 5, Instructions: 327windowregistryCOMMON

Download Yara Rule

APIs

SHParseDisplayName.SHELL32 ref: 00007FFD65690891
SHBindToParent.SHELL32 ref: 00007FFD656908B6
CreatePopupMenu.USER32 ref: 00007FFD6569090B
TrackPopupMenuEx.USER32 ref: 00007FFD65690970
RegQueryValueW.ADVAPI32 ref: 00007FFD65690A5A
RegQueryValueW.ADVAPI32 ref: 00007FFD65690B01
InsertMenuItemW.USER32 ref: 00007FFD65690BE6
DestroyMenu.USER32 ref: 00007FFD65690D7F
CoTaskMemFree.OLE32 ref: 00007FFD65690DA6

Strings

::{2CC5CA98-6485-489A-920E-B3E88A6CCCE3}, xrefs: 00007FFD65690884
c, xrefs: 00007FFD65690C02
InfoTip, xrefs: 00007FFD65690A78, 00007FFD65690B1F
P, xrefs: 00007FFD65690CF8
Software\Classes\CLSID\{2cc5ca98-6485-489a-920e-b3e88a6ccce3}, xrefs: 00007FFD65690A43, 00007FFD65690AEA

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Menu$PopupQueryValue$BindCreateDestroyDisplayFreeInsertItemNameParentParseTaskTrack
String ID: ::{2CC5CA98-6485-489A-920E-B3E88A6CCCE3}$InfoTip$P$Software\Classes\CLSID\{2cc5ca98-6485-489a-920e-b3e88a6ccce3}$c
API String ID: 3796425743-3612032762
Opcode ID: 01e19e4e1b1ea895e84e8702a983adbb03aaf9be2e572cba032b152f06b14b14
Instruction ID: 2ae29ecc6802de7924c47452ae033f73b6a8a762dd6a2126f2cef9244e942123
Opcode Fuzzy Hash: 01e19e4e1b1ea895e84e8702a983adbb03aaf9be2e572cba032b152f06b14b14
Instruction Fuzzy Hash: ACE16C32B08B56C6E7108FA5E8503A977B4FB99B68F104235EA8D47B98DF7DD184CB40

Function 00007FFD65664270 Relevance: 37.1, APIs: 18, Strings: 3, Instructions: 305threadwindowCOMMON

Download Yara Rule

APIs

TryEnterCriticalSection.KERNEL32 ref: 00007FFD656642A1
MulDiv.KERNEL32 ref: 00007FFD65664384
MonitorFromWindow.USER32 ref: 00007FFD6566441A
GetDpiForMonitor.API-MS-WIN-SHCORE-SCALING-L1-1-1 ref: 00007FFD65664430
GetMonitorInfoW.USER32 ref: 00007FFD65664455
MulDiv.KERNEL32 ref: 00007FFD656644CC
MulDiv.KERNEL32 ref: 00007FFD656644DD
MulDiv.KERNEL32 ref: 00007FFD656644F1
MulDiv.KERNEL32 ref: 00007FFD6566450C
MulDiv.KERNEL32 ref: 00007FFD6566451D
MulDiv.KERNEL32 ref: 00007FFD65664531
FindWindowW.USER32 ref: 00007FFD656646E9
PostMessageW.USER32 ref: 00007FFD65664700
GetThreadId.KERNEL32 ref: 00007FFD65664712
PostThreadMessageW.USER32 ref: 00007FFD65664725
GetThreadId.KERNEL32 ref: 00007FFD6566476B
PostThreadMessageW.USER32 ref: 00007FFD6566477E
LeaveCriticalSection.KERNEL32 ref: 00007FFD6566478B

Strings

SOFTWARE\Microsoft\Accessibility, xrefs: 00007FFD6566449C
TextScaleFactor, xrefs: 00007FFD65664486
Shell_TrayWnd, xrefs: 00007FFD656646E2

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Thread$MessageMonitorPost$CriticalSectionWindow$EnterFindFromInfoLeave
String ID: SOFTWARE\Microsoft\Accessibility$Shell_TrayWnd$TextScaleFactor
API String ID: 2849209329-777505285
Opcode ID: 111ecb4b0944f52e029e530ec12786c88d09f85c8ae2ef7f3cebbaa856a1a13f
Instruction ID: 4b699e241d7e21e22d3407491be4809743b776c5b122d759b240c99f24c63e51
Opcode Fuzzy Hash: 111ecb4b0944f52e029e530ec12786c88d09f85c8ae2ef7f3cebbaa856a1a13f
Instruction Fuzzy Hash: E4F1493AB08A4ACAE7148FA1E8607A937A6FB89F49F104135CE4D57B54DF7DE494CB00

Function 00007FFD65690540 Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 137networkfilesleepCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET ref: 00007FFD65690580
InternetOpenUrlA.WININET ref: 00007FFD656905B7
InternetReadFile.WININET ref: 00007FFD65690603
SHGetFolderPathW.SHELL32 ref: 00007FFD65690638

Part of subcall function 00007FFD656A7C0C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7C35

CreateDirectoryW.KERNEL32 ref: 00007FFD65690659
GetLastError.KERNEL32 ref: 00007FFD65690663
ShellExecuteExW.SHELL32 ref: 00007FFD65690730
WaitForSingleObject.KERNEL32 ref: 00007FFD65690748
CloseHandle.KERNEL32 ref: 00007FFD65690752
Sleep.KERNEL32 ref: 00007FFD6569075D
DeleteFileW.KERNEL32 ref: 00007FFD65690767
InternetCloseHandle.WININET ref: 00007FFD6569077D
InternetCloseHandle.WININET ref: 00007FFD6569078E

Strings

p, xrefs: 00007FFD656906DD
\ExplorerPatcher, xrefs: 00007FFD6569063E
@, xrefs: 00007FFD656906FB
https://go.microsoft.com/fwlink/p/?LinkId=2124703, xrefs: 00007FFD65690597
\MicrosoftEdgeWebview2Setup.exe, xrefs: 00007FFD65690674
ExplorerPatcher, xrefs: 00007FFD6569056D

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Internet$CloseHandle$FileOpen$CreateDeleteDirectoryErrorExecuteFolderLastObjectPathReadShellSingleSleepWait_invalid_parameter_noinfo
String ID: @$ExplorerPatcher$\ExplorerPatcher$\MicrosoftEdgeWebview2Setup.exe$https://go.microsoft.com/fwlink/p/?LinkId=2124703$p
API String ID: 2895610840-1819798696
Opcode ID: fee8e3442e41825557668e320b8500766bb06b32796133866a629d19263ef6a7
Instruction ID: 6e688975ed9e7cdb5183b6a3cf3e67b3ca781b35d3c09a010ae92aa38a5c1067
Opcode Fuzzy Hash: fee8e3442e41825557668e320b8500766bb06b32796133866a629d19263ef6a7
Instruction Fuzzy Hash: 09617F32B18F86C6FB109BA0E8643A97371FB95B94F404235DA4D07A59DF3DD595CB00

Function 00007FFD6565EF90 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 94windowsleepregistryCOMMON

Download Yara Rule

APIs

GetStockObject.GDI32 ref: 00007FFD6565EFDD
GetModuleHandleW.KERNEL32 ref: 00007FFD6565EFED
LoadCursorW.USER32 ref: 00007FFD6565F00E
RegisterClassW.USER32 ref: 00007FFD6565F021
GetModuleHandleW.KERNEL32 ref: 00007FFD6565F029
CreateWindowExW.USER32 ref: 00007FFD6565F061
GetMessageW.USER32 ref: 00007FFD6565F083
TranslateMessage.USER32 ref: 00007FFD6565F09D
DispatchMessageW.USER32 ref: 00007FFD6565F0AB
GetMessageW.USER32 ref: 00007FFD6565F0C1
DestroyWindow.USER32 ref: 00007FFD6565F0CE
SHAppBarMessage.SHELL32 ref: 00007FFD6565F0EC
SHAppBarMessage.SHELL32 ref: 00007FFD6565F10D
Sleep.KERNEL32 ref: 00007FFD6565F118
SHAppBarMessage.SHELL32 ref: 00007FFD6565F137
SetEvent.KERNEL32 ref: 00007FFD6565F144

Strings

0, xrefs: 00007FFD6565F0DC
FixTaskbarAutohide_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FFD6565EFF3

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Message$HandleModuleWindow$ClassCreateCursorDestroyDispatchEventLoadObjectRegisterSleepStockTranslate
String ID: 0$FixTaskbarAutohide_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}
API String ID: 2692392126-3745785993
Opcode ID: 372ee5a78053523f1f732c44edd9fd8a641ae2e0514952c61d0baf2847e36725
Instruction ID: a8b67487efd8a43416b1015e976536a369f6c9e1a838f5c7f09411a98c641538
Opcode Fuzzy Hash: 372ee5a78053523f1f732c44edd9fd8a641ae2e0514952c61d0baf2847e36725
Instruction Fuzzy Hash: DA411232B08F86C2EB649B64F86436AB3F5FB98B44F544135D68E46AA4DF7CD095CB00

Function 00007FFD65687D80 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 244windowsleepregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FFD65687E03
LoadCursorW.USER32 ref: 00007FFD65687E18
GetStockObject.GDI32 ref: 00007FFD65687E24
RegisterClassW.USER32 ref: 00007FFD65687E41
GetModuleHandleW.KERNEL32 ref: 00007FFD65687E67
CreateWindowInBand.USER32 ref: 00007FFD65687EAF
SetForegroundWindow.USER32 ref: 00007FFD65687EBB
Sleep.KERNEL32 ref: 00007FFD65687EE5
GetModuleHandleW.KERNEL32 ref: 00007FFD65687F1F
LoadStringW.USER32 ref: 00007FFD65687F36
GetMenuItemCount.USER32 ref: 00007FFD65687FD9
InsertMenuItemW.USER32 ref: 00007FFD65687FEF
TrackPopupMenu.USER32 ref: 00007FFD6568807B
RemoveMenu.USER32 ref: 00007FFD656880BD
SendMessageW.USER32 ref: 00007FFD6568814C

Strings

LauncherTipWnd, xrefs: 00007FFD65687E32
ExplorerFrame.dll, xrefs: 00007FFD65687F18

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Menu$HandleModule$ItemLoadWindow$BandClassCountCreateCursorForegroundInsertMessageObjectPopupRegisterRemoveSendSleepStockStringTrack
String ID: ExplorerFrame.dll$LauncherTipWnd
API String ID: 1231917228-1828045394
Opcode ID: a2ce811fbcbaa5abdfb05332ecdd07edec44e6b718b2e546fc625e4652fb423d
Instruction ID: fb5419b30e8695a32fc665722f32f0ed879d6e4efdd5da49352c93a29a52b457
Opcode Fuzzy Hash: a2ce811fbcbaa5abdfb05332ecdd07edec44e6b718b2e546fc625e4652fb423d
Instruction Fuzzy Hash: EDC11436B09B4ACAEB548FA5E8647A933A5FB48B88F104539DA4D47BA4CF3DD490C700

Function 00007FFD6568E310 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 184librarymemorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD65674E90: RegCreateKeyExW.ADVAPI32 ref: 00007FFD65674EEC
Part of subcall function 00007FFD65674E90: RegQueryValueExW.ADVAPI32 ref: 00007FFD65674F41
Part of subcall function 00007FFD65674E90: GetLocaleInfoW.KERNEL32 ref: 00007FFD65674F8A
Part of subcall function 00007FFD65674E90: GetLocaleInfoW.KERNEL32 ref: 00007FFD65674FA5
Part of subcall function 00007FFD65674E90: SetThreadPreferredUILanguages.KERNEL32 ref: 00007FFD6567505B
Part of subcall function 00007FFD65674E90: RegCloseKey.ADVAPI32 ref: 00007FFD6567506B

SHGetFolderPathW.SHELL32 ref: 00007FFD6568E383

Part of subcall function 00007FFD656A7C0C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7C35

LoadLibraryExW.KERNEL32 ref: 00007FFD6568E3B0
FindResourceW.KERNEL32 ref: 00007FFD6568E3CC
SizeofResource.KERNEL32 ref: 00007FFD6568E3DB
LoadResource.KERNEL32 ref: 00007FFD6568E3EA
LockResource.KERNEL32 ref: 00007FFD6568E3F6
LocalAlloc.KERNEL32 ref: 00007FFD6568E407
FreeResource.KERNEL32 ref: 00007FFD6568E421
VerQueryValueW.VERSION ref: 00007FFD6568E43B
LocalFree.KERNEL32 ref: 00007FFD6568E463
LoadStringW.USER32 ref: 00007FFD6568E4F8
LoadStringW.USER32 ref: 00007FFD6568E521
FreeLibrary.KERNEL32 ref: 00007FFD6568E5DD
SwitchToThread.KERNEL32 ref: 00007FFD6568E5E4

Strings

\ExplorerPatcher\ep_gui.dll, xrefs: 00007FFD6568E389
<toast scenario="reminder" activationType="protocol" launch="%s" duration="%s"><visual><binding template="ToastGeneric">, xrefs: 00007FFD6568E470
short, xrefs: 00007FFD6568E577

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Resource$Load$Free$InfoLibraryLocalLocaleQueryStringThreadValue$AllocCloseCreateFindFolderLanguagesLockPathPreferredSizeofSwitch_invalid_parameter_noinfo
String ID: <toast scenario="reminder" activationType="protocol" launch="%s" duration="%s"><visual><binding template="ToastGeneric">$\ExplorerPatcher\ep_gui.dll$short
API String ID: 2536480284-1480496686
Opcode ID: 87811b746d36d61cf86ced4364272ea2b398efece0665d3c22738b0e16dc0d31
Instruction ID: 67c0df1154d13dfa6e996d5a5d196a16ddaee0a19800aab8c4364c9668c92bbb
Opcode Fuzzy Hash: 87811b746d36d61cf86ced4364272ea2b398efece0665d3c22738b0e16dc0d31
Instruction Fuzzy Hash: C2817C62B18F8AC6EB14DF65D8103E96761FB98B88F449131DE4D17B65EF38D299C300

Function 00007FFD65688820 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 179comwindowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FFD6568886D
FindWindowExW.USER32 ref: 00007FFD65688883
FindWindowExW.USER32 ref: 00007FFD656888A1
GetCursorPos.USER32 ref: 00007FFD656888C0
MonitorFromPoint.USER32 ref: 00007FFD656888D9
FindWindowExW.USER32 ref: 00007FFD656888FF
MonitorFromWindow.USER32 ref: 00007FFD65688910
FindWindowExW.USER32 ref: 00007FFD65688950
MonitorFromWindow.USER32 ref: 00007FFD65688961
GetMonitorInfoW.USER32 ref: 00007FFD6568896E
GetWindowRect.USER32 ref: 00007FFD65688980
CoCreateInstance.OLE32 ref: 00007FFD656889E6

Strings

Start, xrefs: 00007FFD65688895
Shell_TrayWnd, xrefs: 00007FFD65688878, 00007FFD65688945
Shell_SecondaryTrayWnd, xrefs: 00007FFD656888F3

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Window$FindMonitor$From$CreateCursorInfoInstanceMessagePointRectSend
String ID: Shell_SecondaryTrayWnd$Shell_TrayWnd$Start
API String ID: 3957573836-2175658619
Opcode ID: 7d5b0573b76e2f28007cb4b648ccba6ba01dc73f564d0536a8582c9ff69fe12d
Instruction ID: ac5db4a22f0c7d2a93478e67309f16060df72feb8f0b29e3a460fde828f6cc29
Opcode Fuzzy Hash: 7d5b0573b76e2f28007cb4b648ccba6ba01dc73f564d0536a8582c9ff69fe12d
Instruction Fuzzy Hash: AA812876B09E4ACAEB14DBA5E8247A923B1FB48F88B444475CD0E57B68CF38D589C350

Function 00007FFD65662FD0 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 193registrylibrarysynchronizationCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32 ref: 00007FFD65663073

Part of subcall function 00007FFD656A7C0C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7C35

LoadLibraryW.KERNEL32 ref: 00007FFD6566309A
GetProcAddress.KERNEL32 ref: 00007FFD656630B2

Part of subcall function 00007FFD6566D870: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,00007FFD656630C8), ref: 00007FFD6566D8F3
Part of subcall function 00007FFD6566D870: K32GetModuleInformation.KERNEL32(?,?,?,?,?,?,?,00007FFD656630C8), ref: 00007FFD6566D90A

WaitForSingleObject.KERNEL32 ref: 00007FFD6566322E
WaitForSingleObject.KERNEL32 ref: 00007FFD65663251
CloseHandle.KERNEL32 ref: 00007FFD6566325E
RegCreateKeyExW.ADVAPI32 ref: 00007FFD656632A8
RegCloseKey.ADVAPI32 ref: 00007FFD656632B7
Sleep.KERNEL32 ref: 00007FFD656632E0
CreateThread.KERNEL32 ref: 00007FFD656632FF
CoCreateInstance.OLE32 ref: 00007FFD6566331D

Strings

\ExplorerPatcher\pnidui.dll, xrefs: 00007FFD65663079
DllGetClassObject, xrefs: 00007FFD656630A8
UseWin32BatteryFlyout, xrefs: 00007FFD65663185
SOFTWARE\Microsoft\Windows\CurrentVersion\ImmersiveShell, xrefs: 00007FFD6566319C
Control Panel\Quick Actions\Control Center\QuickActionsStateCapture\ExplorerPatcher, xrefs: 00007FFD6566327A

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Create$CloseObjectSingleWait$AddressCurrentFolderHandleInformationInstanceLibraryLoadModulePathProcProcessSleepThread_invalid_parameter_noinfo
String ID: Control Panel\Quick Actions\Control Center\QuickActionsStateCapture\ExplorerPatcher$DllGetClassObject$SOFTWARE\Microsoft\Windows\CurrentVersion\ImmersiveShell$UseWin32BatteryFlyout$\ExplorerPatcher\pnidui.dll
API String ID: 1967696875-3120677660
Opcode ID: e2d5b28068aa931c6fb9c5cbf57efc894ed3ba83578ae93960a9428d6e2c18b7
Instruction ID: f64532bd4e5373b195c25ee46c8e0cd1d0bc0675802966be111845a60bfbb87c
Opcode Fuzzy Hash: e2d5b28068aa931c6fb9c5cbf57efc894ed3ba83578ae93960a9428d6e2c18b7
Instruction Fuzzy Hash: 2F913636F48E4AC2EB509B95E8A03AA77A1BB84F94F404136D94D476A4DF7CE4C5C740

Function 00007FFD6568E070 Relevance: 28.1, APIs: 6, Strings: 10, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD656A7C0C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7C35

RegCreateKeyExW.ADVAPI32 ref: 00007FFD6568E114
RegQueryValueExW.ADVAPI32 ref: 00007FFD6568E15D
RegQueryValueExW.ADVAPI32 ref: 00007FFD6568E1DD
RegQueryValueExW.ADVAPI32 ref: 00007FFD6568E211
RegQueryValueExW.ADVAPI32 ref: 00007FFD6568E265
RegCloseKey.ADVAPI32 ref: 00007FFD6568E293

Strings

https://api.github.com/repos/valinet/ExplorerPatcher/releases?per_page=1, xrefs: 00007FFD6568E21E, 00007FFD6568E279
UpdateURLStaging, xrefs: 00007FFD6568E247
/download/, xrefs: 00007FFD6568E186
UpdateURL, xrefs: 00007FFD6568E147
[Updates] Update URL: %s, xrefs: 00007FFD6568E29D
ep_setup.exe, xrefs: 00007FFD6568E19B
UpdateTimeout, xrefs: 00007FFD6568E1BF
Software\ExplorerPatcher, xrefs: 00007FFD6568E0E2
https://github.com/valinet/ExplorerPatcher/releases/latest, xrefs: 00007FFD6568E0BE, 00007FFD6568E171
UpdatePreferStaging, xrefs: 00007FFD6568E1F2

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: QueryValue$CloseCreate_invalid_parameter_noinfo
String ID: /download/$Software\ExplorerPatcher$UpdatePreferStaging$UpdateTimeout$UpdateURL$UpdateURLStaging$[Updates] Update URL: %s$ep_setup.exe$https://api.github.com/repos/valinet/ExplorerPatcher/releases?per_page=1$https://github.com/valinet/ExplorerPatcher/releases/latest
API String ID: 2821414459-3346571005
Opcode ID: da3e1e35e89e51ba0aa011a3f5a3193dc25c751d9a6c9f66f81cca83597fd921
Instruction ID: af8d1d4b2515c617c1d30152d8454d339843afdc36268af71f4b30f1e1c0ecf8
Opcode Fuzzy Hash: da3e1e35e89e51ba0aa011a3f5a3193dc25c751d9a6c9f66f81cca83597fd921
Instruction Fuzzy Hash: B3712E72B18A56C6F7209FA4E85079A77B4FB84754F900236DA8D13A68DF3CD196CF00

Function 00007FFD6565BFA0 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 124windowsleepcomCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00007FFD6565BFC7
CoInitialize.OLE32 ref: 00007FFD6565BFDB
GetStockObject.GDI32 ref: 00007FFD6565C025
GetModuleHandleW.KERNEL32 ref: 00007FFD6565C035
LoadCursorW.USER32 ref: 00007FFD6565C059
RegisterClassW.USER32 ref: 00007FFD6565C06F
GetModuleHandleW.KERNEL32 ref: 00007FFD6565C077
CoCreateInstance.OLE32 ref: 00007FFD6565C0F9
ShowWindow.USER32 ref: 00007FFD6565C125
GetMessageW.USER32 ref: 00007FFD6565C182
TranslateMessage.USER32 ref: 00007FFD6565C198
DispatchMessageW.USER32 ref: 00007FFD6565C1A6
GetMessageW.USER32 ref: 00007FFD6565C1BC

Strings

Ended "Archive menu" thread., xrefs: 00007FFD6565C1C6
Started "Archive menu" thread., xrefs: 00007FFD6565BFCD
ArchiveMenuWindowExplorer, xrefs: 00007FFD6565C03B

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Message$HandleModule$ClassCreateCursorDispatchInitializeInstanceLoadObjectRegisterShowSleepStockTranslateWindow
String ID: ArchiveMenuWindowExplorer$Ended "Archive menu" thread.$Started "Archive menu" thread.
API String ID: 3032281874-998171920
Opcode ID: 70339f58fbc0c70cc0f0744e9ce5df35354568a971adf771224467d8c194659b
Instruction ID: fa73db5358d57cad4d535dbcbf96628bfae82a607d3d07478fb30115cce8cd98
Opcode Fuzzy Hash: 70339f58fbc0c70cc0f0744e9ce5df35354568a971adf771224467d8c194659b
Instruction Fuzzy Hash: 7251EE32B18E9AC2EB649F65F46476A73B4FB88F44F504136DA8E46A64DF3CD095CB00

Function 00007FFD656522F0 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 297COMMON

Download Yara Rule

Strings

Shlwapi.dll, xrefs: 00007FFD656524D7
SHRegGetValueFromHKCUHKLM, xrefs: 00007FFD65652518

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID: SHRegGetValueFromHKCUHKLM$Shlwapi.dll
API String ID: 0-2208286396
Opcode ID: 0b5de79a467dac8f40d44af8b3737f2a2da819ca8f7e7a7630e8c8b0690718a1
Instruction ID: 6dc7df3d604067cabff7b304eaecc75eb2346ffa1cded0f009a4d42c80980398
Opcode Fuzzy Hash: 0b5de79a467dac8f40d44af8b3737f2a2da819ca8f7e7a7630e8c8b0690718a1
Instruction Fuzzy Hash: DAC15021B58F4A82EB619BB5E87077A62E5AF54B94F005234DA8F87795EF3CE4C1C340

Function 00007FFD656B5C8C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FFD656B5CDA
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD656B6346
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD656B64BC
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD656B677A
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD656B699A
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD656B6BD7
memcpy_s.LIBCPMT ref: 00007FFD656B6CB2
memcpy_s.LIBCPMT ref: 00007FFD656B6D5D
memcpy_s.LIBCPMT ref: 00007FFD656B6E2C

Strings

1#QNAN, xrefs: 00007FFD656B5DF3
1#IND, xrefs: 00007FFD656B5DC7
1#INF, xrefs: 00007FFD656B5E03
1#SNAN, xrefs: 00007FFD656B5DEA

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: f350830a4adcc410153501d9ca6c2ab6903c9060955658178a02212302773db1
Instruction ID: e62cd4543a451a858e50f6542b8fa41ba0e36fc219860e8207b35d0a6d1793eb
Opcode Fuzzy Hash: f350830a4adcc410153501d9ca6c2ab6903c9060955658178a02212302773db1
Instruction Fuzzy Hash: 7AB2E472B18A9ACBEB648FA4D4607FD37A1FB54B88F405135DA0D57A84DF38E990CB40

Function 00007FFD6565E230 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 72windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32 ref: 00007FFD6565E243
PostMessageW.USER32 ref: 00007FFD6565E25A
FindWindowExW.USER32 ref: 00007FFD6565E27F
SetWindowPos.USER32 ref: 00007FFD6565E2A3
InvalidateRect.USER32 ref: 00007FFD6565E2B4
FindWindowExW.USER32 ref: 00007FFD6565E2DF
FindWindowExW.USER32 ref: 00007FFD6565E2FC
SetWindowPos.USER32 ref: 00007FFD6565E320
InvalidateRect.USER32 ref: 00007FFD6565E331

Strings

Start, xrefs: 00007FFD6565E273, 00007FFD6565E2F0
!@, xrefs: 00007FFD6565E302
Shell_TrayWnd, xrefs: 00007FFD6565E23C
Shell_SecondaryTrayWnd, xrefs: 00007FFD6565E2D3

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Window$Find$InvalidateRect$MessagePost
String ID: !@$Shell_SecondaryTrayWnd$Shell_TrayWnd$Start
API String ID: 492091407-2979015546
Opcode ID: 1f5712035e56aa1ba704b5cd63abf861ae1254b0da2d5933e247a04c8a3ddc34
Instruction ID: bcbe9aa34d161ef0aacefd7791865806fc13ee70c74911a1f2604d6d51f0b808
Opcode Fuzzy Hash: 1f5712035e56aa1ba704b5cd63abf861ae1254b0da2d5933e247a04c8a3ddc34
Instruction Fuzzy Hash: 06318F71F08A4AC2FB64DBA2F828B66A6A1AF89F94F485035DD0E47B54DF7CD085C700

Function 00007FFD6565DCF0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 87processCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FFD6565DD1E

Part of subcall function 00007FFD656A7C0C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7C35

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FFD6565DD5E
Process32FirstW.KERNEL32 ref: 00007FFD6565DD6F
OpenProcess.KERNEL32 ref: 00007FFD6565DDE1
QueryFullProcessImageNameW.KERNEL32 ref: 00007FFD6565DE0F
TerminateProcess.KERNEL32 ref: 00007FFD6565DE33
CloseHandle.KERNEL32 ref: 00007FFD6565DE41
Process32NextW.KERNEL32 ref: 00007FFD6565DE4F
CloseHandle.KERNEL32 ref: 00007FFD6565DE76

Strings

\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe, xrefs: 00007FFD6565DD24
ShellExperienceHost.exe, xrefs: 00007FFD6565DD86

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Process$CloseHandleProcess32$CreateDirectoryFirstFullImageNameNextOpenQuerySnapshotTerminateToolhelp32Windows_invalid_parameter_noinfo
String ID: ShellExperienceHost.exe$\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
API String ID: 2097983625-1597348990
Opcode ID: 7a2044ba403adc5f9672b0f5d5dc5f399b81ca774859eaf41cb4f37d0cc271ea
Instruction ID: 94861325e5aa6bcef1bced292eb5fb2969920ba6e3c2fc7e52d4a640a8216ac6
Opcode Fuzzy Hash: 7a2044ba403adc5f9672b0f5d5dc5f399b81ca774859eaf41cb4f37d0cc271ea
Instruction Fuzzy Hash: B5415B61B08E8AC1EB64AB55E4643BA63B1FBD8F44F844031C68E47698DF3DD695CB40

Function 00007FFD6565E100 Relevance: 19.3, APIs: 4, Strings: 7, Instructions: 76COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32 ref: 00007FFD6565E1FF

Part of subcall function 00007FFD65672270: CoCreateInstance.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD6565E130), ref: 00007FFD656722BE
Part of subcall function 00007FFD65672270: IUnknown_QueryService.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD6565E130), ref: 00007FFD656722F1
Part of subcall function 00007FFD65672270: WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD6565E130), ref: 00007FFD65672364
Part of subcall function 00007FFD65672270: WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD6565E130), ref: 00007FFD65672428

Strings

van.dll, xrefs: 00007FFD6565E182
ms-settings:network, xrefs: 00007FFD6565E174
ms-availablenetworks:, xrefs: 00007FFD6565E147
shell:::{7007ACC7-3202-11D1-AAD2-00805FC1270E}, xrefs: 00007FFD6565E21C
ShowVAN, xrefs: 00007FFD6565E19C
open, xrefs: 00007FFD6565E1F1
shell:::{8E908FC9-BECC-40f6-915B-F4CA0E70D03D}, xrefs: 00007FFD6565E1DF

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CreateStringWindows$DeleteExecuteInstanceQueryReferenceServiceShellUnknown_
String ID: ShowVAN$ms-availablenetworks:$ms-settings:network$open$shell:::{7007ACC7-3202-11D1-AAD2-00805FC1270E}$shell:::{8E908FC9-BECC-40f6-915B-F4CA0E70D03D}$van.dll
API String ID: 3979293583-2514944852
Opcode ID: 5c0a15b2daf2f68f49b6a66377e76e43853cb7513cf962a208d90d46eeec7387
Instruction ID: d57b8a7a0e6585d4117a9bdfac76b7e40b8d23b41e3666ccdabbbe834f3b7ff2
Opcode Fuzzy Hash: 5c0a15b2daf2f68f49b6a66377e76e43853cb7513cf962a208d90d46eeec7387
Instruction Fuzzy Hash: AE313E35F48E8BC1FE64AB91E4713B92261BF99F54F90107ADA4F06A51DF2CE9C5C600

Function 00007FFD656520D0 Relevance: 16.6, APIs: 11, Instructions: 131registrywindowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjectsEx.USER32 ref: 00007FFD6565212E
PeekMessageW.USER32 ref: 00007FFD65652164
TranslateMessage.USER32 ref: 00007FFD65652173
DispatchMessageW.USER32 ref: 00007FFD6565217E
RegQueryValueExW.ADVAPI32 ref: 00007FFD656521A5
RegNotifyChangeKeyValue.ADVAPI32 ref: 00007FFD656521D2
RegQueryValueExW.ADVAPI32 ref: 00007FFD65652221
RegNotifyChangeKeyValue.ADVAPI32 ref: 00007FFD6565224F
GetLastError.KERNEL32 ref: 00007FFD6565227B
GetLastError.KERNEL32 ref: 00007FFD65652296
GetLastError.KERNEL32 ref: 00007FFD656522B1

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Value$ErrorLastMessage$ChangeNotifyQuery$DispatchMultipleObjectsPeekTranslateWait
String ID:
API String ID: 2018483580-0
Opcode ID: 5185161d40e1e17cfffb2643026126e677c47f68272f6029feedd4a4c525977b
Instruction ID: 5f69ceb4254749186dcd8b1f8b74dba22acdaf3a522d85a254e05c8e21fd6583
Opcode Fuzzy Hash: 5185161d40e1e17cfffb2643026126e677c47f68272f6029feedd4a4c525977b
Instruction Fuzzy Hash: 53515D35B58E4AC2EB609FB5D86477A23A0FB89F88F404135DA8E876A4DF3CD484C750

Function 00007FFD656893F0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comserviceCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00007FFD65689467
IUnknown_QueryService.SHLWAPI ref: 00007FFD6568952A

Strings

IsAutoHideEnabled, xrefs: 00007FFD6568957F
TwinUIPatches.cpp, xrefs: 00007FFD6568947A, 00007FFD656894BD, 00007FFD65689555, 00007FFD656895B2, 00007FFD656895E0
Shell_TrayWnd, xrefs: 00007FFD6568956D

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CreateInstanceQueryServiceUnknown_
String ID: IsAutoHideEnabled$Shell_TrayWnd$TwinUIPatches.cpp
API String ID: 2021386587-823477751
Opcode ID: 2bd0394afbf3bb1deff56073b6b30e43571c1df2e6e5d789b496d091398be570
Instruction ID: 183eabdb026e8121ebb8b95997a98bdea6db5ac51cc65d31115ddf3205180e9f
Opcode Fuzzy Hash: 2bd0394afbf3bb1deff56073b6b30e43571c1df2e6e5d789b496d091398be570
Instruction Fuzzy Hash: 1C91F426B09F5AC5EB118BA5D8A07A927B0BB58F98F544132CE0E97B54DF38D4C9C310

Function 00007FFD6565A4E0 Relevance: 15.7, APIs: 10, Instructions: 742COMMON

Download Yara Rule

APIs

DwmRegisterThumbnail.DWMAPI ref: 00007FFD6565A6EC
DwmQueryThumbnailSourceSize.DWMAPI ref: 00007FFD6565A6FD
DwmUnregisterThumbnail.DWMAPI ref: 00007FFD6565A7DF
DwmRegisterThumbnail.DWMAPI(?), ref: 00007FFD6565A893
DwmQueryThumbnailSourceSize.DWMAPI ref: 00007FFD6565A8AC
DwmUnregisterThumbnail.DWMAPI ref: 00007FFD6565A8B6
DwmUnregisterThumbnail.DWMAPI(?), ref: 00007FFD6565AAE7
DwmQueryThumbnailSourceSize.DWMAPI(?), ref: 00007FFD6565ABB9
DwmQueryThumbnailSourceSize.DWMAPI(?), ref: 00007FFD6565AC2E
DwmUpdateThumbnailProperties.DWMAPI ref: 00007FFD6565AFAD

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Thumbnail$QuerySizeSource$Unregister$Register$PropertiesUpdate
String ID:
API String ID: 3108602342-0
Opcode ID: f18ce4ecb7d5584a72fe5b3af655532a1fc6869fdc1c023dbaf405e095f5fe85
Instruction ID: f8249af950833a8c05430be1b2964a9a4b65b37c3f4a1e541e351309a3bcc2c6
Opcode Fuzzy Hash: f18ce4ecb7d5584a72fe5b3af655532a1fc6869fdc1c023dbaf405e095f5fe85
Instruction Fuzzy Hash: 7572BF32B18A45CBD769CF79D250B6DB7A1FB54B85F108225EB4A53B44DB38F8A1CB00

Function 00007FFD656AB308 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD656AAEEC: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656AAF2D
Part of subcall function 00007FFD656AAEEC: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656AAFAB
Part of subcall function 00007FFD656AAEEC: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656AAFFC

CreateFileW.KERNEL32 ref: 00007FFD656AB40E
CreateFileW.KERNEL32 ref: 00007FFD656AB45E
GetLastError.KERNEL32 ref: 00007FFD656AB48E
GetFileType.KERNEL32 ref: 00007FFD656AB4A3
GetLastError.KERNEL32 ref: 00007FFD656AB4AD
CloseHandle.KERNEL32 ref: 00007FFD656AB4E0
CloseHandle.KERNEL32 ref: 00007FFD656AB643
CreateFileW.KERNEL32 ref: 00007FFD656AB678
GetLastError.KERNEL32 ref: 00007FFD656AB687

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 8a24f21186d3076e97c719e6723c893b26f1c3773e47fc18d1fd71f9efe3f4bd
Instruction ID: 815307c2e2658f088880dac14d111425e9b4183c2aa16ee83ac23ae5bf582e2f
Opcode Fuzzy Hash: 8a24f21186d3076e97c719e6723c893b26f1c3773e47fc18d1fd71f9efe3f4bd
Instruction Fuzzy Hash: 13C1B036B28E49C5EB10CFA5D4A02AC37B1FB49F98B011235DA1E9B3A5CF39D495C740

Function 00007FFD65663DA0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 50windowCOMMON

Download Yara Rule

APIs

FindWindowExW.USER32 ref: 00007FFD65663DD5
FindWindowExW.USER32 ref: 00007FFD65663DEF
FindWindowExW.USER32 ref: 00007FFD65663E09

Part of subcall function 00007FFD65688820: SendMessageW.USER32 ref: 00007FFD6568886D

SendMessageW.USER32 ref: 00007FFD65663E33

Strings

RebarWindow32, xrefs: 00007FFD65663DE3
MSTaskSwWClass, xrefs: 00007FFD65663DFD
Shell_TrayWnd, xrefs: 00007FFD65663DCA

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: FindWindow$MessageSend
String ID: MSTaskSwWClass$RebarWindow32$Shell_TrayWnd
API String ID: 1134572027-589293716
Opcode ID: f85175f125cf8e8b66d54df70546532ba3cac7d82357f4b638c5a70c5f5e0bf6
Instruction ID: 65cd55561b3a10e51a81877665fc792ee95bb180b580ddd6af2f338622d3626f
Opcode Fuzzy Hash: f85175f125cf8e8b66d54df70546532ba3cac7d82357f4b638c5a70c5f5e0bf6
Instruction Fuzzy Hash: 85116D62F08F4AD1EB649BA2F62077523A1AF98FA0F584636D91D17A94DE3CE480C311

Function 00007FFD6566C590 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FFD6566C66F
VirtualProtect.KERNEL32 ref: 00007FFD6566C69D
GetModuleHandleW.KERNEL32 ref: 00007FFD6566C6A5

Part of subcall function 00007FFD6565D290: GetModuleHandleExW.KERNEL32 ref: 00007FFD6565D2C6
Part of subcall function 00007FFD6565D290: ImageDirectoryEntryToDataEx.DBGHELP ref: 00007FFD6565D2F9
Part of subcall function 00007FFD6565D290: FreeLibrary.KERNEL32 ref: 00007FFD6565D32F

IsOS.SHLWAPI ref: 00007FFD6566C6DF

Strings

api-ms-win-shcore-sysinfo-l1-1-0.dll, xrefs: 00007FFD6566C6BC
IsOS, xrefs: 00007FFD6566C6B2

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: HandleModuleProtectVirtual$DataDirectoryEntryFreeImageLibrary
String ID: IsOS$api-ms-win-shcore-sysinfo-l1-1-0.dll
API String ID: 2091478098-2234916554
Opcode ID: e98dbb5fea8f3cad26d962c9c131c634824320574ccc615d19d2902921557c52
Instruction ID: 9f22b998aceca6d9415b0bdb875bdf6354bce95f401ee1c5e84b35e3e49969e2
Opcode Fuzzy Hash: e98dbb5fea8f3cad26d962c9c131c634824320574ccc615d19d2902921557c52
Instruction Fuzzy Hash: D731CF61F98E4E83FF509BA9D4203792360AB95B84F502036EE8E4B755DE3CE4C1CB15

Function 00007FFD65681100 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 172threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FFD65681199
IsDebuggerPresent.KERNEL32(?,?,00000000,00000000,?), ref: 00007FFD6568128B
OutputDebugStringW.KERNEL32(?,?,00000000,00000000,?), ref: 00007FFD65681328

Strings

StartMenuSettings.cpp, xrefs: 00007FFD656811A3

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CurrentDebugDebuggerOutputPresentStringThread
String ID: StartMenuSettings.cpp
API String ID: 4268342597-657291044
Opcode ID: 6d8b8fe23441a23184f810657323b9a692593ad32fad85dc3e2652344cdbfed2
Instruction ID: 81ae4431103dfbf347daaa249805349aa303b29d033d82bd570c2a325280bf66
Opcode Fuzzy Hash: 6d8b8fe23441a23184f810657323b9a692593ad32fad85dc3e2652344cdbfed2
Instruction Fuzzy Hash: A6716122F19B8AC6EB74DFA4E4603A967E1FB44B48F041575D99D42AA4DF3CE5C0C710

Function 00007FFD6565F4C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22windowtimeCOMMON

Download Yara Rule

APIs

FindWindowW.USER32 ref: 00007FFD6565F4D9
SendMessageTimeoutW.USER32 ref: 00007FFD6565F50A

Strings

EnsureXAML, xrefs: 00007FFD6565F4E8
Shell_TrayWnd, xrefs: 00007FFD6565F4D2

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: FindMessageSendTimeoutWindow
String ID: EnsureXAML$Shell_TrayWnd
API String ID: 268879178-954582075
Opcode ID: bc3035862facb520a34d482c511542335a9f8f46059ef51329d527d37712b2b1
Instruction ID: eaef6beda1b075371b5884b405df8e4db2b4cb5a1d1887263e0f81da0f67dbf7
Opcode Fuzzy Hash: bc3035862facb520a34d482c511542335a9f8f46059ef51329d527d37712b2b1
Instruction Fuzzy Hash: 47F08276B18E45C2E7048F51E8143656261FB88BD4F488030D94E06B54CF7CC185CB00

Function 00007FFD656B57F0 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FFD656B5856
memcpy_s.LIBCPMT ref: 00007FFD656B5881

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 54df691b28dde9a3de2a0b1b7d4322a8dab56d24a2e0dd98c6a87ab6e9c6fd8f
Instruction ID: 53c3a9d20885043fc1b0603931df31c1e95c93317571104374113886a75eff72
Opcode Fuzzy Hash: 54df691b28dde9a3de2a0b1b7d4322a8dab56d24a2e0dd98c6a87ab6e9c6fd8f
Instruction Fuzzy Hash: 83C11672B19A89C7DB24CF59E0547AAB791F794B84F448139DB4E43744EB3DE850CB00

Function 00007FFD6567A7B0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 74memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?,00000000,00007FFD6567B0AF,?,?,?,?,?,00000000,?,00007FFD6567B8AB), ref: 00007FFD6567A7D3

Strings

length, xrefs: 00007FFD6567A838

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: HeapProcess
String ID: length
API String ID: 54951025-25009842
Opcode ID: 6497c20ab327c247e3391e124cd2222a9c7f014157bb9895d514ed880f26a4c3
Instruction ID: 3145935a1d620bac0318be7ed8448fbd13206a8ee555cb7652bf091790fd8031
Opcode Fuzzy Hash: 6497c20ab327c247e3391e124cd2222a9c7f014157bb9895d514ed880f26a4c3
Instruction Fuzzy Hash: 41314A62B08E4AC1EA509F99E4A036873A0FB94F40F948A36D64C477B5DF7CE9C2C700

Function 00007FFD656AED14 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FFD656AEE21
gfff, xrefs: 00007FFD656AEE9E

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 401ca3d791ec56ee7fb3f1ebf025869707402de53eaa05fa8685b2422944ba93
Instruction ID: eae06edd3238b8510a1eee55535581c2cb51df9193a8e9f6bcd6bcd21dd88155
Opcode Fuzzy Hash: 401ca3d791ec56ee7fb3f1ebf025869707402de53eaa05fa8685b2422944ba93
Instruction Fuzzy Hash: 89514936B18ACAC6E7248A75D8607697B91F744F94F488231CB6847BD6CF3ED880C700

Function 00007FFD6566A5A0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SHBindToObject.SHELL32 ref: 00007FFD6566A5B9

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: BindObject
String ID:
API String ID: 761158930-0
Opcode ID: c0904f1775784fbdffb0825d8212574418776d9953f8ca2ed613c08eb1ad7e77
Instruction ID: 76993e1ee2df9ae5f4e207cb775f5d4f12754005f66d841c8c18fa4533f031c4
Opcode Fuzzy Hash: c0904f1775784fbdffb0825d8212574418776d9953f8ca2ed613c08eb1ad7e77
Instruction Fuzzy Hash: C5C01225F14E95C2DB149F58F81169533B0FB44708FE00136D68D05630CF3CC266CA04

Function 00007FFD656A1FDC Relevance: 1.5, Strings: 1, Instructions: 250COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD656A21E6

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: ef908d49defdeecee50d3da7e537f4c07f43aba96ae6a3cb168878c6caae1050
Instruction ID: 8d3eceda8e7b2e20755e30e05c883ccf257ad6d069627e17433a8241269cfdfc
Opcode Fuzzy Hash: ef908d49defdeecee50d3da7e537f4c07f43aba96ae6a3cb168878c6caae1050
Instruction Fuzzy Hash: 11B13C72B48A8AC5E7648FAAC8A036D3BA0EB45F48F144135DF4E47399DF2AD881C754

Function 00007FFD656A2374 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD656A2550

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: a95da338390158b58e8d7dac47523ee0e7d0ae6289380b73c11d4f7196d0344f
Instruction ID: 18d5a96a190344eb9e2b5c11e04e496f9dc3806151b5c05c691e236e71f95f8e
Opcode Fuzzy Hash: a95da338390158b58e8d7dac47523ee0e7d0ae6289380b73c11d4f7196d0344f
Instruction Fuzzy Hash: E8B17E72A49A49C6E7658F6AC8B037C3BA1FB49F48F645135CA8E47395DF2AD4C1C700

Function 00007FFD656A46C0 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fe1221e2acf0ae6bf989f2213628dd87e3d5c1a39ea450b01547ba6e59fff52
Instruction ID: 16c7844ca3dc4b572692a5a2a80b31b2164c06d55db8f12c59b3a9cdb9326179
Opcode Fuzzy Hash: 5fe1221e2acf0ae6bf989f2213628dd87e3d5c1a39ea450b01547ba6e59fff52
Instruction Fuzzy Hash: C5E1A136B08A8AC2EB69CAA5C96033977A1FF45F45F154135CA8D072D9DFBBE891C301

Function 00007FFD65696530 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5928575681f851bd86756db403d3da97f1196c8ac83e938697ac036f80151180
Instruction ID: cb43a6c835cea9bcbdaacb1e7060e59bb88911d138a75092b856db4d0906f76c
Opcode Fuzzy Hash: 5928575681f851bd86756db403d3da97f1196c8ac83e938697ac036f80151180
Instruction Fuzzy Hash: 12E1BF72B08B9BC5FA648B80D57477933A5EB22F94F648136D64E066E4DF2CE4C5C382

Function 00007FFD656A42BC Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84f7174f98fb35701058a949fccd1a4d76a0ccdf40606d0849c3fbccb9b37b8f
Instruction ID: e34a7d29cdc26e76901187ad37e06b94863a6253e14d970af5a79a41640bb6a1
Opcode Fuzzy Hash: 84f7174f98fb35701058a949fccd1a4d76a0ccdf40606d0849c3fbccb9b37b8f
Instruction Fuzzy Hash: D9D1AF32B08A4AC5EB688EA9C86037D37A0EB45F49F145235CE8D07695DFBEE8D1C340

Function 00007FFD656A26F8 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1188edb522b859df7e5dcf667770e6cd2adaf91aa135349a904e24ff44a07b20
Instruction ID: 8d0b5eb5189b50be394e32509f6b41d248480592e20813cdf30d616245d84057
Opcode Fuzzy Hash: 1188edb522b859df7e5dcf667770e6cd2adaf91aa135349a904e24ff44a07b20
Instruction Fuzzy Hash: FAB17D72A48B89C9E7658F6AC86033C3BA0E749F48F640136DA4E47399CF3AE491C754

Function 00007FFD656AF394 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be47964fcc4595da42470565f4ee94a9284566997e825a65d0fd1335d8fc76c3
Instruction ID: 8c5dd034515338b269671e1f9235b7580fd8999c7ffd7ff72edf2c799e09030c
Opcode Fuzzy Hash: be47964fcc4595da42470565f4ee94a9284566997e825a65d0fd1335d8fc76c3
Instruction Fuzzy Hash: 7781D476B08B8586E774CFA5E4A0379B691FB85B94F104235DA9D43B96CE3ED480CB01

Function 00007FFD656AAC6C Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 87826663fb88d95eb3373e8dcf29249e2651c96390ffb61b889701d1ece7043f
Instruction ID: d1530476f28a181d58589552f1b089c15d45d7ab6ecf2cd92f9a38ce4509f0b7
Opcode Fuzzy Hash: 87826663fb88d95eb3373e8dcf29249e2651c96390ffb61b889701d1ece7043f
Instruction Fuzzy Hash: 7561F832F0CA9AC6FB6599A8C4743797681BF40F60F14463AD65D466C6DE3FE880C700

Function 00007FFD656A03D0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fae3d71a0409ac533e92ee5e8c56820f1abf5f494794e29cc2365857733816a9
Instruction ID: 0466d169fadcf08b13fe74f70aababbf57b9b8cd7489bfbeeb67db833049380d
Opcode Fuzzy Hash: fae3d71a0409ac533e92ee5e8c56820f1abf5f494794e29cc2365857733816a9
Instruction Fuzzy Hash: F7518372B28A5AC6E7608EA8D1247B87390FB15F68F144235EA4D466D5CF3FE8C2C701

Function 00007FFD656A0808 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32a39131b1ea9c855f919021bf4e12638fc87ba38f04dc641b8aacd00c666a4f
Instruction ID: 152abdbd078d3ee356d54d8d1d38773df7934085d36749a029b7a579f5c8dcfe
Opcode Fuzzy Hash: 32a39131b1ea9c855f919021bf4e12638fc87ba38f04dc641b8aacd00c666a4f
Instruction Fuzzy Hash: 70518036B18A59C6FB648B69C06033937A0EB44F78F245231CE4D177A5DB3BE892C784

Function 00007FFD656A01C4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a7a51e5dbc6814b69a1f5516beb431e2955e309f392fad738cca70c3e99af50
Instruction ID: 2c881f500fb53ab8faa7ee26eaf04c82b7bc86d707869a90735425e1384b95d8
Opcode Fuzzy Hash: 7a7a51e5dbc6814b69a1f5516beb431e2955e309f392fad738cca70c3e99af50
Instruction Fuzzy Hash: 76514036B18F5AC6E7748BA9C06432837A0EB59F68F244131CE4D577A5DB3BE892C740

Function 00007FFD656A0E4C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45cfc8f3d66b23b604d29949c39df706330583ea5add7a420aff299b0c38cec5
Instruction ID: 3e6745813dd285947934ba07f464bcfff1ff6ead7c7dbda71ff9d7f6bfe134ae
Opcode Fuzzy Hash: 45cfc8f3d66b23b604d29949c39df706330583ea5add7a420aff299b0c38cec5
Instruction Fuzzy Hash: 66514F76B18A59C6E7248B69C06033837A0EB45F68F288131DE4D57795CF3BE993D780

Function 00007FFD656A0604 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16617ee0fc7f8c144c525315531aa15f76cd011324c60239c481cbad41e7e036
Instruction ID: e8d52f83a81ea4cb3673fc80ff5ffc550273d7110a9db984964569ee1e1a37ee
Opcode Fuzzy Hash: 16617ee0fc7f8c144c525315531aa15f76cd011324c60239c481cbad41e7e036
Instruction Fuzzy Hash: 23518336B18A5AC6E7258B69C06432837A0EB95F6CF245131CA4D17795CF3BE8C2CB80

Function 00007FFD6569FFC0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51aaf4873c05abffa460ff0bd214f66616c7fce314d1f5b4d1403479c50517f3
Instruction ID: 3b2db11277762600e66458fbeb9f661107338e256f24f1170d8d74f686b4f1ce
Opcode Fuzzy Hash: 51aaf4873c05abffa460ff0bd214f66616c7fce314d1f5b4d1403479c50517f3
Instruction Fuzzy Hash: 7F518036B18A59C6E7648BA9C06076877A0EB49FA8F244131CE4C57799DB3BECD3C740

Function 00007FFD6569F124 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02b7a2496c7568684aa243f87f5578d0fba0b47c0b8864685c6256374f78d05f
Instruction ID: 23672ab249159122d095e2afbd0b482d1c2c025fa3f4e9ac1e45206c77a49527
Opcode Fuzzy Hash: 02b7a2496c7568684aa243f87f5578d0fba0b47c0b8864685c6256374f78d05f
Instruction Fuzzy Hash: DB319E72608A4AC5EB258FA9E4503ADB7A0F799F48F254135DB8C4B764DF3AC092CB04

Function 00007FFD6569F448 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18b6748ca6a6a0d51e118e82d35fb9f5821d58e468e74478334e5de39f486265
Instruction ID: fac577dd8c7ae3f5eb01d34aa35c0b9027220359bd0cb38efa0da59b263854d4
Opcode Fuzzy Hash: 18b6748ca6a6a0d51e118e82d35fb9f5821d58e468e74478334e5de39f486265
Instruction Fuzzy Hash: 363180B2608A86C5EB618F69E0507BD77A0E769F4CF254135DB4C4B761DB3AD092C704

Function 00007FFD6569F33C Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b32a0ec8867fd1847959522346067af6a5e452e3e1d64f74d91d8c4bfa1493
Instruction ID: 8f0b8d469bec27b28657ade1fb2e4c32be1da743977917271e23c5e744f2cac3
Opcode Fuzzy Hash: a4b32a0ec8867fd1847959522346067af6a5e452e3e1d64f74d91d8c4bfa1493
Instruction Fuzzy Hash: 7631A172608A4AC6EB218F69E05036DB7A0F799F5CF658135DB8D4B751DF3AC092C700

Function 00007FFD6569EE04 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dd18c2af8978401385c3a4d18cc3c4cea6f6c2de30805c37561c0fbe2471736
Instruction ID: 9e1360dc81efb3a754fede899d6a263c94877e27faff61bcf9cdd5fa39450182
Opcode Fuzzy Hash: 2dd18c2af8978401385c3a4d18cc3c4cea6f6c2de30805c37561c0fbe2471736
Instruction Fuzzy Hash: E5318D72608A8AC5EB608F69E0507BD77A0F799F48F24413ADB8C0B761DF3AD492C704

Function 00007FFD6569ECF8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a81995dc725e745c91ef68e5add537126b3069e5817d0a70891599fc14a6951d
Instruction ID: 338bc3017f227444e4f903f356cee9b6c20e2a0ba92b3846c2b66ef352a56e0b
Opcode Fuzzy Hash: a81995dc725e745c91ef68e5add537126b3069e5817d0a70891599fc14a6951d
Instruction Fuzzy Hash: 3F31AB72608A9AC6EB208F68E0907BD77A0FB99F48F244135DB8C0B751DF3AD496C700

Function 00007FFD6569F230 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7f92cb70fea3df8bd33801a1eb83861a0d0286d040c3fca20cc0efed571b635
Instruction ID: fd2d5d275e1d03603ad1bbb5573144fb0eee08f6347a2ed274c8c1798b30dbab
Opcode Fuzzy Hash: a7f92cb70fea3df8bd33801a1eb83861a0d0286d040c3fca20cc0efed571b635
Instruction Fuzzy Hash: 7B31B572708A8AC5EB218FA9E0503ADB7A0FB99F48F654136DB4D4B750DF3AC092D704

Function 00007FFD65653170 Relevance: 82.7, APIs: 29, Strings: 18, Instructions: 413COMMON

Download Yara Rule

Strings

HungWindowFromGhostWindow, xrefs: 00007FFD65653423
SetWindowBand, xrefs: 00007FFD656535E6
CreateWindowInBand, xrefs: 00007FFD65653564
SHRegGetValueFromHKCUHKLM, xrefs: 00007FFD6565332F
Shlwapi.dll, xrefs: 00007FFD656532FB
NtUserBuildHwndList, xrefs: 00007FFD656533A9
InternalGetWindowIcon, xrefs: 00007FFD656536A9
InternalGetWindowText, xrefs: 00007FFD65653668
shcore.dll, xrefs: 00007FFD6565381A
Comctl32.dll, xrefs: 00007FFD65653201
IsTopLevelWindow, xrefs: 00007FFD65653627
GhostWindowFromHungWindow, xrefs: 00007FFD65653464
GetWindowBand, xrefs: 00007FFD656535A5
LoadIconWithScaleDown, xrefs: 00007FFD65653235
uxtheme.dll, xrefs: 00007FFD656536E5
SetWindowCompositionAttribute, xrefs: 00007FFD656534A5
win32u.dll, xrefs: 00007FFD6565336B
user32.dll, xrefs: 00007FFD656533E5

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID: Comctl32.dll$CreateWindowInBand$GetWindowBand$GhostWindowFromHungWindow$HungWindowFromGhostWindow$InternalGetWindowIcon$InternalGetWindowText$IsTopLevelWindow$LoadIconWithScaleDown$NtUserBuildHwndList$SHRegGetValueFromHKCUHKLM$SetWindowBand$SetWindowCompositionAttribute$Shlwapi.dll$shcore.dll$user32.dll$uxtheme.dll$win32u.dll
API String ID: 0-385217830
Opcode ID: 25e798a4944bcea0312062ca384872f833437a7808f1a2f5a8d42d04deea5800
Instruction ID: b5d59390ef75c25f0d38c024c40e6b02a27183187a957c59f783e2fed13115c9
Opcode Fuzzy Hash: 25e798a4944bcea0312062ca384872f833437a7808f1a2f5a8d42d04deea5800
Instruction Fuzzy Hash: 4222C228F59F0BC1FA569FD5E87437522A2AF58F48F401539D84E463A5EF7CA8C8C610

Function 00007FFD656596F0 Relevance: 64.9, APIs: 36, Strings: 1, Instructions: 195synchronizationwindowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FFD65659777
CloseHandle.KERNEL32 ref: 00007FFD65659784
CloseHandle.KERNEL32 ref: 00007FFD656597A3
CloseHandle.KERNEL32 ref: 00007FFD656597AD
CloseHandle.KERNEL32 ref: 00007FFD656597B7
CloseHandle.KERNEL32 ref: 00007FFD656597C0
FreeLibrary.KERNEL32 ref: 00007FFD656597CA
#386.COMCTL32 ref: 00007FFD65659860
UnhookWinEvent.USER32 ref: 00007FFD65659875
DestroyWindow.USER32 ref: 00007FFD6565987F
SetEvent.KERNEL32 ref: 00007FFD65659890
WaitForSingleObject.KERNEL32 ref: 00007FFD656598A2
CloseHandle.KERNEL32 ref: 00007FFD656598AF
CloseHandle.KERNEL32 ref: 00007FFD656598BC
SetEvent.KERNEL32 ref: 00007FFD656598C9
WaitForSingleObject.KERNEL32 ref: 00007FFD656598DB
CloseHandle.KERNEL32 ref: 00007FFD656598E8
CloseHandle.KERNEL32 ref: 00007FFD656598F5
BufferedPaintUnInit.UXTHEME ref: 00007FFD656598FB
GetModuleHandleW.KERNEL32 ref: 00007FFD65659903
UnregisterClassW.USER32 ref: 00007FFD65659913
DeleteObject.GDI32 ref: 00007FFD65659920
DeleteObject.GDI32 ref: 00007FFD6565992D
DeleteObject.GDI32 ref: 00007FFD6565993A
DeleteObject.GDI32 ref: 00007FFD65659947
CloseThemeData.UXTHEME ref: 00007FFD65659954
GdiplusShutdown.GDIPLUS ref: 00007FFD65659961
DestroyIcon.USER32 ref: 00007FFD6565997F
FreeLibrary.KERNEL32 ref: 00007FFD65659998
FreeLibrary.KERNEL32 ref: 00007FFD656599B1
FreeLibrary.KERNEL32 ref: 00007FFD656599CA
FreeLibrary.KERNEL32 ref: 00007FFD656599E3
FreeLibrary.KERNEL32 ref: 00007FFD656599FC
FreeLibrary.KERNEL32 ref: 00007FFD65659A15
RoUninitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD65659A46
CoUninitialize.OLE32 ref: 00007FFD65659A52

Strings

SimpleWindowSwitcher_{BEA057BB-66C7-4758-A610-FAE6013E9F98}, xrefs: 00007FFD6565990C

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CloseHandle$FreeLibrary$Object$Delete$DestroyEvent$SingleUninitializeWaitWindow$#386BufferedClassDataGdiplusIconInitModulePaintShutdownThemeUnhookUnregister
String ID: SimpleWindowSwitcher_{BEA057BB-66C7-4758-A610-FAE6013E9F98}
API String ID: 4090220598-648101266
Opcode ID: 3c5d39104d5d3aea03be413ea6a8cf5c4adf7188b00f61d9ca0ff57171f53492
Instruction ID: 0eb0d82fb8259a3a991bc2dea7f84b4a23cf088a3d6db2ea39240a1428d03946
Opcode Fuzzy Hash: 3c5d39104d5d3aea03be413ea6a8cf5c4adf7188b00f61d9ca0ff57171f53492
Instruction Fuzzy Hash: 78B1C226B19E4AC2EB549FA1E9643B83371FF84F98F045236DA4E46664DF2CA4E5C310

Function 00007FFD656691F0 Relevance: 42.3, APIs: 22, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

GetBkColor.GDI32 ref: 00007FFD656692B0
GetTextColor.GDI32 ref: 00007FFD656692BC
SetBkMode.GDI32 ref: 00007FFD656692CD
GetSysColor.USER32 ref: 00007FFD656692DA
SetTextColor.GDI32 ref: 00007FFD656692E5
SystemParametersInfoW.USER32 ref: 00007FFD65669303
CreateFontIndirectW.GDI32 ref: 00007FFD6566930D
WindowFromDC.USER32 ref: 00007FFD65669319
MonitorFromWindow.USER32 ref: 00007FFD65669325
GetDpiForMonitor.API-MS-WIN-SHCORE-SCALING-L1-1-1 ref: 00007FFD6566933A
SelectObject.GDI32 ref: 00007FFD6566935A
DrawTextW.USER32 ref: 00007FFD656693B0
SelectObject.GDI32 ref: 00007FFD656693BC
DeleteObject.GDI32 ref: 00007FFD656693C5
SetBkColor.GDI32 ref: 00007FFD656693D1
SetTextColor.GDI32 ref: 00007FFD656693DD
SetBkMode.GDI32 ref: 00007FFD656693E8
StretchDIBits.GDI32 ref: 00007FFD656694AB
StretchDIBits.GDI32 ref: 00007FFD65669516
StretchDIBits.GDI32 ref: 00007FFD6566957A
StretchDIBits.GDI32 ref: 00007FFD656695E2
DrawThemeBackground.UXTHEME ref: 00007FFD65669602

Strings

%, xrefs: 00007FFD65669392
, xrefs: 00007FFD656695AB

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Color$BitsStretchText$Object$DrawFromModeMonitorSelectWindow$BackgroundCreateDeleteFontIndirectInfoParametersSystemTheme
String ID: $%
API String ID: 4081638245-2111875603
Opcode ID: 06fb5e0f0b6666fe3b6ada0d3da665306d03e5dd35c31020688907680a487f78
Instruction ID: 3de3552d3142e3f05f96f17ff716d5e7b2354c4f368fc4f078b4d3a7dec7d8c5
Opcode Fuzzy Hash: 06fb5e0f0b6666fe3b6ada0d3da665306d03e5dd35c31020688907680a487f78
Instruction Fuzzy Hash: B9C18272B18A85CBEB14CF65E45866ABBB4FB88B98F104235DE4957B24CF3CD495CB00

Function 00007FFD65651210 Relevance: 31.6, APIs: 14, Strings: 4, Instructions: 137threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FFD6565123B
OpenProcess.KERNEL32 ref: 00007FFD6565124B
GetCurrentThread.KERNEL32 ref: 00007FFD65651254
SymInitializeW.DBGHELP ref: 00007FFD65651268
SymSetOptions.DBGHELP ref: 00007FFD6565128B
RtlCaptureContext.KERNEL32 ref: 00007FFD656512B6
StackWalk64.DBGHELP ref: 00007FFD65651346
SymGetModuleBase64.DBGHELP ref: 00007FFD65651379
GetModuleFileNameA.KERNEL32 ref: 00007FFD65651394
SymGetSymFromAddr64.DBGHELP ref: 00007FFD656513C4
SymGetLineFromAddrW64.DBGHELP ref: 00007FFD656513FF
StackWalk64.DBGHELP ref: 00007FFD65651469
SymCleanup.DBGHELP ref: 00007FFD6565147A
CloseHandle.KERNEL32 ref: 00007FFD65651483

Strings

(, xrefs: 00007FFD656513EF
%s:, xrefs: 00007FFD656513D5
[%3d] = [0x%p] :: , xrefs: 00007FFD65651364
%d in file "%s", xrefs: 00007FFD6565140E

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CurrentFromModuleProcessStackWalk64$AddrAddr64Base64CaptureCleanupCloseContextFileHandleInitializeLineNameOpenOptionsThread
String ID: %d in file "%s"$%s:$($[%3d] = [0x%p] ::
API String ID: 4210550807-1010961775
Opcode ID: 050fa87e029da15b90b38ee6014b47e1fba6518c91da2482904251519c129672
Instruction ID: b96f859555ea46237e651eb3d09d581925361e73c76ab79493a170dc00c0ce9b
Opcode Fuzzy Hash: 050fa87e029da15b90b38ee6014b47e1fba6518c91da2482904251519c129672
Instruction Fuzzy Hash: 3361D632B08B8AC5EB209FA1E8643A937B5FB49B88F444135DA8D57B58DF38D195CB40

Function 00007FFD6565F2B0 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 00007FFD6565F2EC
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6565F30F
RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD6565F33F
RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD6565F358
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6565F487

Strings

[EnsureXAML] RoGetActivationFactory(IXamlApplicationStatics) failed. 0x%lX, xrefs: 00007FFD6565F364
Windows.Internal.Shell.XamlExplorerHost.XamlApplication, xrefs: 00007FFD6565F305
[EnsureXAML] ICoreWindow5::get_DispatcherQueue() failed. 0x%lX, xrefs: 00007FFD6565F42B
[EnsureXAML] RoGetActivationFactory(ICoreWindow5) failed. 0x%lX, xrefs: 00007FFD6565F400
[EnsureXAML] IXamlApplicationStatics::get_Current() failed. 0x%lX, xrefs: 00007FFD6565F391
[EnsureXAML] WindowsCreateStringReference(XamlApplication) failed. 0x%lX, xrefs: 00007FFD6565F31B
Windows.UI.Xaml.Hosting.WindowsXamlManager, xrefs: 00007FFD6565F3BD
[EnsureXAML] WindowsCreateStringReference(WindowsXamlManager) failed. 0x%lX, xrefs: 00007FFD6565F3D0
[EnsureXAML] %lld ms., xrefs: 00007FFD6565F442

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ActivationFactoryStringWindows$Count64CreateDeleteReferenceTick
String ID: Windows.Internal.Shell.XamlExplorerHost.XamlApplication$Windows.UI.Xaml.Hosting.WindowsXamlManager$[EnsureXAML] %lld ms.$[EnsureXAML] ICoreWindow5::get_DispatcherQueue() failed. 0x%lX$[EnsureXAML] IXamlApplicationStatics::get_Current() failed. 0x%lX$[EnsureXAML] RoGetActivationFactory(ICoreWindow5) failed. 0x%lX$[EnsureXAML] RoGetActivationFactory(IXamlApplicationStatics) failed. 0x%lX$[EnsureXAML] WindowsCreateStringReference(WindowsXamlManager) failed. 0x%lX$[EnsureXAML] WindowsCreateStringReference(XamlApplication) failed. 0x%lX
API String ID: 1384349799-1320486068
Opcode ID: e3f8af037ba4f2a98a70c763aeb8eac72ad8f0af4c90e89948028746c07afb19
Instruction ID: 237bd883c518382f7996e27bac5fcabb7569126b621f336c1ba99bcb75b82c0a
Opcode Fuzzy Hash: e3f8af037ba4f2a98a70c763aeb8eac72ad8f0af4c90e89948028746c07afb19
Instruction Fuzzy Hash: F1510B62B49E0AD5FB11AFA5D4603BD6370BF84F88F404136C90E86659EF3DE58AC340

Function 00007FFD6566D3B0 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 124libraryloaderCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32 ref: 00007FFD6566D41B

Part of subcall function 00007FFD656A7C0C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7C35

LoadLibraryW.KERNEL32 ref: 00007FFD6566D457
LoadLibraryExW.KERNEL32 ref: 00007FFD6566D467
GetProcAddress.KERNEL32 ref: 00007FFD6566D4A5
GetProcAddress.KERNEL32 ref: 00007FFD6566D4D1
GetProcAddress.KERNEL32 ref: 00007FFD6566D538
GetProcAddress.KERNEL32 ref: 00007FFD6566D552
FreeLibrary.KERNEL32 ref: 00007FFD6566D5B8
FreeLibrary.KERNEL32 ref: 00007FFD6566D5D7

Strings

CopyExplorerSymbols, xrefs: 00007FFD6566D52E
EP_TrayUI_CreateInstance, xrefs: 00007FFD6566D4BF
[TB] '%s' with version %d is not compatible, xrefs: 00007FFD6566D5C5
[TB] '%s' not found, xrefs: 00007FFD6566D478
\ExplorerPatcher\, xrefs: 00007FFD6566D421
SetImmersiveMenuFunctions, xrefs: 00007FFD6566D548
[TB] Failed to hook TrayUI_CreateInstance(), xrefs: 00007FFD6566D5A9
[TB] Using '%s', xrefs: 00007FFD6566D577
GetVersion, xrefs: 00007FFD6566D49B

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: AddressLibraryProc$FreeLoad$FolderPath_invalid_parameter_noinfo
String ID: CopyExplorerSymbols$EP_TrayUI_CreateInstance$GetVersion$SetImmersiveMenuFunctions$[TB] '%s' not found$[TB] '%s' with version %d is not compatible$[TB] Failed to hook TrayUI_CreateInstance()$[TB] Using '%s'$\ExplorerPatcher\
API String ID: 1805524761-1356000006
Opcode ID: 2db6c055f175ea82300a4cd14d1fb923f10ac90707805e9606bc5d9fb8105206
Instruction ID: a78c8eff7e607744de879643c3059602896d08274c0998b7da42b0f9936d79bc
Opcode Fuzzy Hash: 2db6c055f175ea82300a4cd14d1fb923f10ac90707805e9606bc5d9fb8105206
Instruction Fuzzy Hash: 92519B64F19E4BD1FB649BA1E8743B923A2AF84F84F544535C80E466A5EE3CE4C8C740

Function 00007FFD656726C0 Relevance: 29.9, APIs: 2, Strings: 15, Instructions: 174windowthreadCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32 ref: 00007FFD656727F5
GetCurrentThreadId.KERNEL32 ref: 00007FFD65672876

Strings

%hs(%u)\%hs!%p: , xrefs: 00007FFD6567282A
Exception, xrefs: 00007FFD65672786
CallContext:[%hs] , xrefs: 00007FFD656728F6
(caller: %p) , xrefs: 00007FFD65672861
%hs!%p: , xrefs: 00007FFD65672843
Msg:[%ws] , xrefs: 00007FFD656728DB
LogNt, xrefs: 00007FFD65672761
, xrefs: 00007FFD656728C0
FailFast, xrefs: 00007FFD6567274D
[%hs], xrefs: 00007FFD65672936
[%hs(%hs)], xrefs: 00007FFD6567291D
ReturnHr, xrefs: 00007FFD65672772
LogHr, xrefs: 00007FFD6567275A
%hs(%d) tid(%x) %08X %ws, xrefs: 00007FFD65672898
ReturnNt, xrefs: 00007FFD65672779

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CurrentFormatMessageThread
String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%u)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$LogNt$Msg:[%ws] $ReturnHr$ReturnNt$[%hs(%hs)]$[%hs]
API String ID: 2411632146-1363043106
Opcode ID: 2935512d2c6e909dfa644574101ff65b8825e8c6f30e4c6078ed0d8e3a7d28fc
Instruction ID: 3d7862dfb95c221134b919c043087ee25b428891d1e7a075baf240ad8e233685
Opcode Fuzzy Hash: 2935512d2c6e909dfa644574101ff65b8825e8c6f30e4c6078ed0d8e3a7d28fc
Instruction Fuzzy Hash: E2713861B09E4BC1EA64DFA1E9607A963A0EF48F88F444536DA4D477A8DF3CE5C9C700

Function 00007FFD656550A0 Relevance: 27.1, APIs: 18, Instructions: 148registrykeyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyExW.USER32 ref: 00007FFD656550C1
MapVirtualKeyW.USER32 ref: 00007FFD656550CE
RegisterHotKey.USER32 ref: 00007FFD656550EC
GetLastError.KERNEL32 ref: 00007FFD656550F6
RegisterHotKey.USER32 ref: 00007FFD6565512E
GetLastError.KERNEL32 ref: 00007FFD65655138
RegisterHotKey.USER32 ref: 00007FFD65655166
GetLastError.KERNEL32 ref: 00007FFD65655170
RegisterHotKey.USER32 ref: 00007FFD656551A8
GetLastError.KERNEL32 ref: 00007FFD656551B2
RegisterHotKey.USER32 ref: 00007FFD656551DD
GetLastError.KERNEL32 ref: 00007FFD656551E7
RegisterHotKey.USER32 ref: 00007FFD6565521F
GetLastError.KERNEL32 ref: 00007FFD65655229
RegisterHotKey.USER32 ref: 00007FFD65655257
GetLastError.KERNEL32 ref: 00007FFD65655261
RegisterHotKey.USER32 ref: 00007FFD65655299
GetLastError.KERNEL32 ref: 00007FFD656552A3

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ErrorLastRegister$Virtual
String ID:
API String ID: 270683995-0
Opcode ID: c5d10ea8c7cc1500a942c4454fc4465b49889767eabafe1240a810fc2a09707a
Instruction ID: 549e7c847395a98a4f52454169482c396aba462cbcbb2a4b72ae6b29e1691843
Opcode Fuzzy Hash: c5d10ea8c7cc1500a942c4454fc4465b49889767eabafe1240a810fc2a09707a
Instruction Fuzzy Hash: C6517424B48F4BC6FB645BE6D5A877516A4BF64F94F004134CA0E87790EF6CE494C760

Function 00007FFD656542C0 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 282windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00007FFD65654329
QueryPerformanceFrequency.KERNEL32 ref: 00007FFD65654355
QueryPerformanceCounter.KERNEL32 ref: 00007FFD65654364
GetTickCount.KERNEL32 ref: 00007FFD6565437F
GetForegroundWindow.USER32(?), ref: 00007FFD65654393
GetWindow.USER32 ref: 00007FFD656543A4
IsWindowVisible.USER32 ref: 00007FFD656543B5
QueryPerformanceFrequency.KERNEL32 ref: 00007FFD65654416
QueryPerformanceCounter.KERNEL32 ref: 00007FFD65654425
GetTickCount.KERNEL32 ref: 00007FFD65654440
QueryPerformanceFrequency.KERNEL32(?), ref: 00007FFD6565445B
QueryPerformanceCounter.KERNEL32 ref: 00007FFD6565446A
GetTickCount.KERNEL32 ref: 00007FFD65654485
IsWindowVisible.USER32(?), ref: 00007FFD656544C1

Strings

[sws] CalculateHelper %d [[ %lld + %lld = %lld ]]., xrefs: 00007FFD65654494

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: PerformanceQuery$Window$CountCounterFrequencyTickVisible$Foreground
String ID: [sws] CalculateHelper %d [[ %lld + %lld = %lld ]].
API String ID: 488077963-247053615
Opcode ID: 3f65e0f771cb655437fab76eff18763099f99234690c18f14129bba6a5b08e21
Instruction ID: c331c48cd79c8e0e90f5ff5a9f88f243c9f1cb05108c2e6ec22aa817ee620029
Opcode Fuzzy Hash: 3f65e0f771cb655437fab76eff18763099f99234690c18f14129bba6a5b08e21
Instruction Fuzzy Hash: 3EC19E32B48E4AC6EB208FA5E4643A973A0FB84B85F154175DA8E47794EFBCE495C700

Function 00007FFD65662680 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 129COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FFD656626B4
GetAncestor.USER32 ref: 00007FFD656626C2
MapWindowPoints.USER32 ref: 00007FFD656626DB
GetParent.USER32 ref: 00007FFD656626F4
GetWindowTextW.USER32 ref: 00007FFD65662708

Part of subcall function 00007FFD656A7DF4: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7E11

RemovePropW.USER32 ref: 00007FFD65662740
GetAncestor.USER32 ref: 00007FFD65662778
GetPropW.USER32 ref: 00007FFD65662789
FindWindowExW.USER32 ref: 00007FFD656627A9
DwmExtendFrameIntoClientArea.DWMAPI ref: 00007FFD656627BE
SetPropW.USER32 ref: 00007FFD656627D4
DwmSetWindowAttribute.DWMAPI ref: 00007FFD6566286A

Strings

FloatingWindow, xrefs: 00007FFD6566270E
Windows.UI.Composition.DesktopWindowContentBridge, xrefs: 00007FFD6566279D
EP_METB, xrefs: 00007FFD65662736, 00007FFD656627CA

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Window$Prop$Ancestor$AreaAttributeClientExtendFindFrameIntoParentPointsRectRemoveText_invalid_parameter_noinfo
String ID: EP_METB$FloatingWindow$Windows.UI.Composition.DesktopWindowContentBridge
API String ID: 1583271118-1647979291
Opcode ID: c8ea524b2641a5da3709456cc57230e444ff2d13f894c06ebcf25f18ca11cfa0
Instruction ID: b66fbc6344c0ebcdd761662f0f66ac9209dff3f6b61e09a1dd782c774692fca7
Opcode Fuzzy Hash: c8ea524b2641a5da3709456cc57230e444ff2d13f894c06ebcf25f18ca11cfa0
Instruction Fuzzy Hash: 22516C75B08E4AC6EB54DB91E87476A23A2FB88F80F404135D94E47B98DF3CE985CB01

Function 00007FFD656546F0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 118windowCOMMON

Download Yara Rule

APIs

FindWindowExW.USER32 ref: 00007FFD65654758
PostMessageW.USER32 ref: 00007FFD6565476C
GetWindow.USER32 ref: 00007FFD656547E8
GetLastActivePopup.USER32 ref: 00007FFD656547F8
GetWindow.USER32 ref: 00007FFD6565484B
GetClassNameW.USER32 ref: 00007FFD6565485F
GetWindow.USER32 ref: 00007FFD6565488D
GetLastActivePopup.USER32 ref: 00007FFD6565489D
IsWindowVisible.USER32 ref: 00007FFD656548A9
SwitchToThisWindow.USER32 ref: 00007FFD656548CA
ShowWindow.USER32 ref: 00007FFD656548DE

Strings

[sws] Owner of window: %s, xrefs: 00007FFD6565486A
[sws] Chosen window: %s, xrefs: 00007FFD656547C5
[sws] Last active popup: %s, xrefs: 00007FFD6565482B
Shell_TrayWnd, xrefs: 00007FFD65654741

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Window$ActiveLastPopup$ClassFindMessageNamePostShowSwitchThisVisible
String ID: Shell_TrayWnd$[sws] Chosen window: %s$[sws] Last active popup: %s$[sws] Owner of window: %s
API String ID: 4254927367-3099396148
Opcode ID: e58f540687b648bce5fbf70db1b5a43db5114e58f026e382351965d45dabb4aa
Instruction ID: b21a2666ac477fc90ed657249c06ed9491a3f2c9badac48c169eb0ee70662d1b
Opcode Fuzzy Hash: e58f540687b648bce5fbf70db1b5a43db5114e58f026e382351965d45dabb4aa
Instruction Fuzzy Hash: 84512C65B09F4AC5EF24DF91E8A836963A0FB89F85F444139CA8E0B764DE3CE495C740

Function 00007FFD6566AD40 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 112registryCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00007FFD6566AD89
SetRect.USER32 ref: 00007FFD6566ADB7
SetRect.USER32 ref: 00007FFD6566ADE0
GetSystemMetrics.USER32 ref: 00007FFD6566ADED
SetRect.USER32 ref: 00007FFD6566AE0D
GetSystemMetrics.USER32 ref: 00007FFD6566AE1D
RegGetValueW.ADVAPI32 ref: 00007FFD6566AE7E
MonitorFromRect.USER32 ref: 00007FFD6566AEA6
GetMonitorInfoW.USER32 ref: 00007FFD6566AED0

Strings

0, xrefs: 00007FFD6566AE84
(, xrefs: 00007FFD6566AEC3
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StuckRectsLegacy, xrefs: 00007FFD6566AE61
Settings, xrefs: 00007FFD6566AE48
0, xrefs: 00007FFD6566AE8B

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Rect$MetricsSystem$Monitor$FromInfoValue
String ID: ($0$0$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StuckRectsLegacy$Settings
API String ID: 2079259257-2463101083
Opcode ID: 86ba576f1cc1592d9bc9463654c92b9e48c18665b4d514e460bda456097f7eca
Instruction ID: 6e14f20fdf97ac0c5cc1017da34522b2700215cf4ed29cffe7193ea50d86be66
Opcode Fuzzy Hash: 86ba576f1cc1592d9bc9463654c92b9e48c18665b4d514e460bda456097f7eca
Instruction Fuzzy Hash: 3B517F36F0CE6AC6E7248F64E46037AB6A0EF99B54F500135DA8D46A94DF7DE8C4CB40

Function 00007FFD656832E0 Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 290libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,?,?,?,00007FFD6567BD43), ref: 00007FFD65683345
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,?,?,?,00007FFD6567BD43), ref: 00007FFD65683354
LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,?,?,?,00007FFD6567BD43), ref: 00007FFD6568338F
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,?,?,?,00007FFD6567BD43), ref: 00007FFD6568339E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFD656836FE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFD65683704

Strings

DllGetActivationFactory, xrefs: 00007FFD656835CF
CoIncrementMTAUsage, xrefs: 00007FFD65683397
combase.dll, xrefs: 00007FFD6568333E, 00007FFD65683388
RoGetActivationFactory, xrefs: 00007FFD6568334D

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: AddressLibraryLoadProc_invalid_parameter_noinfo_noreturn
String ID: CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll
API String ID: 3318250257-4036682018
Opcode ID: 47f2e277db7f33a9d025472d12c4bddb3c880ee4c8368754ca942e3fbd5c54a0
Instruction ID: 5ef2f4b49f1810cc350555cd968af7fb23cc31a6df06ade314caca54eb3d5ee9
Opcode Fuzzy Hash: 47f2e277db7f33a9d025472d12c4bddb3c880ee4c8368754ca942e3fbd5c54a0
Instruction Fuzzy Hash: 1EC17962B04E5AD4FF10DBA5D8643BC27A1AB44F98F944236DE1E67798EE38E4C5C310

Function 00007FFD6567C430 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 248synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32 ref: 00007FFD6567C45C
CreateSemaphoreExW.KERNEL32 ref: 00007FFD6567C5C0
CreateSemaphoreExW.KERNEL32 ref: 00007FFD6567C6CC

Part of subcall function 00007FFD6567C430: GetLastError.KERNEL32 ref: 00007FFD6567C5FC
Part of subcall function 00007FFD6567C430: GetLastError.KERNEL32 ref: 00007FFD6567C60B
Part of subcall function 00007FFD6567C430: CloseHandle.KERNEL32 ref: 00007FFD6567C616
Part of subcall function 00007FFD6567C430: SetLastError.KERNEL32 ref: 00007FFD6567C62E
Part of subcall function 00007FFD6567C430: GetLastError.KERNEL32 ref: 00007FFD6567C705
Part of subcall function 00007FFD6567C430: GetLastError.KERNEL32 ref: 00007FFD6567C715
Part of subcall function 00007FFD6567C430: CloseHandle.KERNEL32 ref: 00007FFD6567C720
Part of subcall function 00007FFD6567C430: SetLastError.KERNEL32 ref: 00007FFD6567C734

Strings

_p0, xrefs: 00007FFD6567C556
wil, xrefs: 00007FFD6567C5E4, 00007FFD6567C6F0

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ErrorLast$CloseCreateHandleSemaphore$MutexRelease
String ID: _p0$wil
API String ID: 2058776845-1814513734
Opcode ID: 3a0d189ac191bc084a5fc5670cae84461b640c2f59d3b8f50f61060daf8f36b1
Instruction ID: 310820ab3f7e9b570e591df62b7f952dd35f7a7133fff3c754793cc335583d35
Opcode Fuzzy Hash: 3a0d189ac191bc084a5fc5670cae84461b640c2f59d3b8f50f61060daf8f36b1
Instruction Fuzzy Hash: F8918C22B19E8AC2FF619FA4D4687BA62A0EF84F94F544535DA0E47794EE3CE485C700

Function 00007FFD6565C6A0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 137networkfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET ref: 00007FFD6565C6DB
InternetConnectA.WININET ref: 00007FFD6565C728
HttpOpenRequestA.WININET ref: 00007FFD6565C763
HttpSendRequestA.WININET ref: 00007FFD6565C7A8
InternetReadFile.WININET ref: 00007FFD6565C814
InternetReadFile.WININET ref: 00007FFD6565C853
InternetCloseHandle.WININET ref: 00007FFD6565C886
InternetCloseHandle.WININET ref: 00007FFD6565C88F
InternetCloseHandle.WININET ref: 00007FFD6565C8A4

Strings

Microsoft-Symbol-Server/10.0.10036.206, xrefs: 00007FFD6565C6C4
msdl.microsoft.com, xrefs: 00007FFD6565C6F2
GET, xrefs: 00007FFD6565C73F
Content-Type: application/octet-stream;, xrefs: 00007FFD6565C79E

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSend
String ID: Content-Type: application/octet-stream;$GET$Microsoft-Symbol-Server/10.0.10036.206$msdl.microsoft.com
API String ID: 1354133546-1066975914
Opcode ID: 350d287939a7d2f1add441939b25f7b863f4f39f8f26b0a9b09781f25b1b9722
Instruction ID: 9f3a4f0f81658f5a1f9457b912e77ae35d1828e2f73594ad640d8c1562c921fd
Opcode Fuzzy Hash: 350d287939a7d2f1add441939b25f7b863f4f39f8f26b0a9b09781f25b1b9722
Instruction Fuzzy Hash: E8515131B0CA46C6FB609BA1E46076A67A0FB89F90F540035DE5E07B95DF7DD581C700

Function 00007FFD6566B5E0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 101windowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD656907D0: RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,00007FFD6565E4B6), ref: 00007FFD6569080D
Part of subcall function 00007FFD656907D0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00007FFD6565E4B6), ref: 00007FFD65690821

GetParent.USER32 ref: 00007FFD6566B63C
GetPropW.USER32 ref: 00007FFD6566B64C
GetParent.USER32 ref: 00007FFD6566B65A
GetClassWord.USER32 ref: 00007FFD6566B668
RegisterWindowMessageW.USER32 ref: 00007FFD6566B678
GetParent.USER32 ref: 00007FFD6566B685
GetClassWord.USER32 ref: 00007FFD6566B693
RegisterWindowMessageW.USER32 ref: 00007FFD6566B6A3
GetMenuItemInfoW.USER32 ref: 00007FFD6566B727

Strings

P, xrefs: 00007FFD6566B70F
WorkerW, xrefs: 00007FFD6566B66E
Progman, xrefs: 00007FFD6566B699
DesktopWindow, xrefs: 00007FFD6566B645

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Parent$ClassMessageRegisterWindowWord$CloseInfoItemMenuOpenProp
String ID: DesktopWindow$P$Progman$WorkerW
API String ID: 441032011-3530101500
Opcode ID: 73863012d50b2bd1d21eae4375196a3a5b19108d03dced183ceb9fe1bdf8281c
Instruction ID: 90a4a201a9c22b5a65fba6d2514a62c64326cbdc5fdafa360d8c1c650ee81613
Opcode Fuzzy Hash: 73863012d50b2bd1d21eae4375196a3a5b19108d03dced183ceb9fe1bdf8281c
Instruction Fuzzy Hash: 89413E65B0CE8AC2EB609B96E86477962A0AF85F95F400135ED4E46BA4DF3CE4C5CB01

Function 00007FFD65677FA0 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 216COMMON

Download Yara Rule

APIs

WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65677FE0
RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD6567800A
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65678076
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567809E
RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD656780C8
WindowsGetStringRawBuffer.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65678163
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65678180
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567819C
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656782E8

Strings

Windows.UI.Xaml.Media.VisualTreeHelper, xrefs: 00007FFD65678097
StartDocked.StartSizingFrame, xrefs: 00007FFD6567816C
Windows.UI.Xaml.Window, xrefs: 00007FFD65677FC8

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: StringWindows$Delete$ActivationCreateFactoryReference$Buffer
String ID: StartDocked.StartSizingFrame$Windows.UI.Xaml.Media.VisualTreeHelper$Windows.UI.Xaml.Window
API String ID: 2896072117-1951327480
Opcode ID: 406c51ab9b4f8bb1ad36d289adcd5a805c209490f3241a495b7a24305f52d179
Instruction ID: 7580c09e894ccbe0f9f19916feade60f0b3646e63b4bd75272e92f6dcc2aaaa0
Opcode Fuzzy Hash: 406c51ab9b4f8bb1ad36d289adcd5a805c209490f3241a495b7a24305f52d179
Instruction Fuzzy Hash: CAB1D626B04F5AC5EB109BA1D8A42AD37B1FB84F99F544436CE0E57B68DF39D885C340

Function 00007FFD656866E0 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 191registrylibraryloaderCOMMON

Download Yara Rule

APIs

WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6568672B
RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD65686748
RegGetValueW.ADVAPI32 ref: 00007FFD656867DB
GetModuleHandleW.KERNEL32 ref: 00007FFD65686812
GetProcAddress.KERNEL32 ref: 00007FFD65686825
RegGetValueW.ADVAPI32 ref: 00007FFD656868A5

Strings

ColorPrevalence, xrefs: 00007FFD656867C6
dcomp.dll, xrefs: 00007FFD6568680B
Taskbar10.cpp, xrefs: 00007FFD6568675A, 00007FFD65686786
WindowsUdk.UI.Themes.SystemVisualTheme, xrefs: 00007FFD65686724
EnableTransparency, xrefs: 00007FFD65686890
SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize, xrefs: 00007FFD656867CD, 00007FFD65686897

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Value$ActivationAddressCreateFactoryHandleModuleProcReferenceStringWindows
String ID: ColorPrevalence$EnableTransparency$SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize$Taskbar10.cpp$WindowsUdk.UI.Themes.SystemVisualTheme$dcomp.dll
API String ID: 342590677-1899219526
Opcode ID: 3c9b4e9b9acc2d63674af36005109daad2ed71ec6303830d23cf5222d9514225
Instruction ID: aa667ce2dc95b03a6b5f491643df107b87d11a6b43c26dca491faa40af3d8ff2
Opcode Fuzzy Hash: 3c9b4e9b9acc2d63674af36005109daad2ed71ec6303830d23cf5222d9514225
Instruction Fuzzy Hash: DA916A72B18E4ACAFB108FA1D4603B973A5EB24B48F404676CA1D47B94DF3CE598C760

Function 00007FFD65665780 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 122windowCOMMON

Download Yara Rule

APIs

TryEnterCriticalSection.KERNEL32 ref: 00007FFD656657B8
GetModuleHandleW.KERNEL32 ref: 00007FFD65665853
LoadStringW.USER32 ref: 00007FFD65665871
SendMessageW.USER32 ref: 00007FFD656658C3
LeaveCriticalSection.KERNEL32 ref: 00007FFD656658DD
LeaveCriticalSection.KERNEL32 ref: 00007FFD656658EF
GetModuleHandleW.KERNEL32 ref: 00007FFD65665909
LoadStringW.USER32 ref: 00007FFD65665922
SendMessageW.USER32 ref: 00007FFD6566597C

Strings

(null), xrefs: 00007FFD65665836
pnidui.dll, xrefs: 00007FFD6566584C
H, xrefs: 00007FFD6566593B

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CriticalSection$HandleLeaveLoadMessageModuleSendString$Enter
String ID: (null)$H$pnidui.dll
API String ID: 3318607081-2376156319
Opcode ID: 2adcfd1bc7f7106be87062b26d09ee880211e94a2488b4e2af3a87a323da4b34
Instruction ID: b5684ac36763ddbf6d8c99721775eacbcd80da7c5181aa3561ca7b9979f4d3ca
Opcode Fuzzy Hash: 2adcfd1bc7f7106be87062b26d09ee880211e94a2488b4e2af3a87a323da4b34
Instruction Fuzzy Hash: 81513D36B18F89C6EB608FA5E46036A73A1FB88B44F544236DA8D47B64DF3CD585CB00

Function 00007FFD656615C0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32 ref: 00007FFD656615F4
FindWindowExW.USER32 ref: 00007FFD65661610
MonitorFromWindow.USER32 ref: 00007FFD65661621
MonitorFromPoint.USER32 ref: 00007FFD6566163B
GetMonitorInfoW.USER32 ref: 00007FFD65661649
FindWindowExW.USER32 ref: 00007FFD65661662
MonitorFromWindow.USER32 ref: 00007FFD65661673
GetMonitorInfoW.USER32 ref: 00007FFD65661681
GetWindowRect.USER32 ref: 00007FFD65661692

Strings

(, xrefs: 00007FFD656615E4
Shell_TrayWnd, xrefs: 00007FFD65661657
Shell_SecondaryTrayWnd, xrefs: 00007FFD65661604

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Monitor$Window$From$FindInfoPoint$Rect
String ID: ($Shell_SecondaryTrayWnd$Shell_TrayWnd
API String ID: 1776394408-174554928
Opcode ID: df920bce5273e1608d508747b8fe0297b18f257e25a8b55d9d9880311595257d
Instruction ID: 98463b67a55ea79d380847db65e715981768eab39769e43c590678dfd554d4aa
Opcode Fuzzy Hash: df920bce5273e1608d508747b8fe0297b18f257e25a8b55d9d9880311595257d
Instruction Fuzzy Hash: 22410F75B1DE4AC6EB608BA1E92477A63A1EB88F90F144131DD4E87B44DE3DE8C1CB41

Function 00007FFD6567D4A0 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 334registryCOMMON

Download Yara Rule

APIs

RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD6567D505
RegGetValueW.ADVAPI32 ref: 00007FFD6567D664
RegGetValueW.ADVAPI32 ref: 00007FFD6567D6BA
RegGetValueW.ADVAPI32 ref: 00007FFD6567D70A
RegGetValueW.ADVAPI32 ref: 00007FFD6567D7C0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFD6567D9AF

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Start, xrefs: 00007FFD6567D64B, 00007FFD6567D6A1, 00007FFD6567D6F7, 00007FFD6567D7B4
ShowRecentList, xrefs: 00007FFD6567D68A
WindowsInternal.Shell.CDSProperties.StartGlobalProperties, xrefs: 00007FFD6567D4CF
ShowFrequentList, xrefs: 00007FFD6567D634
VisiblePlaces, xrefs: 00007FFD6567D6DD, 00007FFD6567D7A1

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Value$ActivationFactory_invalid_parameter_noinfo_noreturn
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Start$ShowFrequentList$ShowRecentList$VisiblePlaces$WindowsInternal.Shell.CDSProperties.StartGlobalProperties
API String ID: 3131312478-3545454060
Opcode ID: 2fc7de9be2258553e5e4356f05f1f3693b5da9eac1552d1f13d45b0a0d89c943
Instruction ID: 657480427481fe0ce5676fdc5fb25b3e358d6f0497e206e5321c89c3717d4242
Opcode Fuzzy Hash: 2fc7de9be2258553e5e4356f05f1f3693b5da9eac1552d1f13d45b0a0d89c943
Instruction Fuzzy Hash: A0F13832B09E0ADAEB109FA1E4603AC33B5FB48B98F404636DA4D53B98DF38D595C340

Function 00007FFD656696B0 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 126registryCOMMON

Download Yara Rule

APIs

#328.COMCTL32 ref: 00007FFD656697B3
OpenThemeDataForDpi.UXTHEME ref: 00007FFD656697C9
#334.COMCTL32 ref: 00007FFD65669805
RegGetValueW.ADVAPI32 ref: 00007FFD65669855
OpenThemeDataForDpi.UXTHEME ref: 00007FFD656698A9

Strings

TaskbarPearl, xrefs: 00007FFD656696E9
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FFD65669842
TaskbarShowDesktop, xrefs: 00007FFD65669719
TrayNotifyFlyout, xrefs: 00007FFD6566986E
Taskband2, xrefs: 00007FFD65669760
TaskbarSD, xrefs: 00007FFD6566982B

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: DataOpenTheme$#328#334Value
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced$Taskband2$TaskbarPearl$TaskbarSD$TaskbarShowDesktop$TrayNotifyFlyout
API String ID: 1534390305-1782666386
Opcode ID: c7ddb71f4a83ab2f2543ec785e296f09332302bef59eff340a23ee719fc66fa6
Instruction ID: f4a880cc5b500b99e3d33ff0b46976401d53446a1644fb6f8dd2a4a2c1e2696f
Opcode Fuzzy Hash: c7ddb71f4a83ab2f2543ec785e296f09332302bef59eff340a23ee719fc66fa6
Instruction Fuzzy Hash: CA517165B08D4AC2EBA89F95D42037972B1EF54F68F844535EE4D466E4EF3CA8C1C302

Function 00007FFD656842B0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 90COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FFD656842D4
RoInitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD656842DF
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656842FB
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65684318
RoActivateInstance.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD65684339
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656843F0
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD656843FB

Strings

%s:%d:: RoActivateInstance = %d, xrefs: 00007FFD656843DF
String2IXMLDocument, xrefs: 00007FFD6568438A, 00007FFD656843D2
Windows.Data.Xml.Dom.XmlDocument, xrefs: 00007FFD656842F4
%s:%d:: QueryInterface = %d, xrefs: 00007FFD65684397

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: StringWindows$CreateDeleteInitializeReference$ActivateInstance
String ID: %s:%d:: QueryInterface = %d$%s:%d:: RoActivateInstance = %d$String2IXMLDocument$Windows.Data.Xml.Dom.XmlDocument
API String ID: 2286360050-3498695339
Opcode ID: 521d3f1b8b4cf1f66befddd86d94abcf4bde1879f0b406af681ffbcfccee33e5
Instruction ID: ee89168c13351fd04a1c5ddd027c5a1d89e3128664f019a1509ae4801fa02988
Opcode Fuzzy Hash: 521d3f1b8b4cf1f66befddd86d94abcf4bde1879f0b406af681ffbcfccee33e5
Instruction Fuzzy Hash: 06411F26718E4AC2EB109FA6E4A03696770FB88F99F404132DE8E47764DF7DD589C700

Function 00007FFD65659560 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 86synchronizationwindowCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FFD65659596
QueryPerformanceFrequency.KERNEL32 ref: 00007FFD656595D1
QueryPerformanceCounter.KERNEL32 ref: 00007FFD656595E0
GetTickCount.KERNEL32 ref: 00007FFD656595FB
QueryPerformanceFrequency.KERNEL32 ref: 00007FFD65659610
QueryPerformanceCounter.KERNEL32 ref: 00007FFD6565961F
GetTickCount.KERNEL32 ref: 00007FFD65659637
IsWindowVisible.USER32 ref: 00007FFD65659655
DwmSetWindowAttribute.DWMAPI ref: 00007FFD65659677
WaitForSingleObject.KERNEL32 ref: 00007FFD65659689

Strings

[sws] Delayed showing by %lld ms due to: user configuration., xrefs: 00007FFD65659642

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: PerformanceQuery$CountCounterFrequencyObjectSingleTickWaitWindow$AttributeVisible
String ID: [sws] Delayed showing by %lld ms due to: user configuration.
API String ID: 3340259983-850836316
Opcode ID: 60a22c30f773cdf64ed5086f3dc5362e028d3ad9448525f1eee846b433465a00
Instruction ID: 33abee205288bb165d388bfd46da1de58a847b9e77d7b88a4fb81b131b54ba71
Opcode Fuzzy Hash: 60a22c30f773cdf64ed5086f3dc5362e028d3ad9448525f1eee846b433465a00
Instruction Fuzzy Hash: 48313D62B08E4AC6FB509FA5E46432973B4EF94F98F540135EA4E466A4EF3CE4D5C700

Function 00007FFD6565F6F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 137registrywindowtimeCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32 ref: 00007FFD6565F747
GetMessagePos.USER32 ref: 00007FFD6565F765
MonitorFromPoint.USER32 ref: 00007FFD6565F784
GetMonitorInfoW.USER32 ref: 00007FFD6565F7AC
RegGetValueW.ADVAPI32 ref: 00007FFD6565F881
RegSetKeyValueW.ADVAPI32 ref: 00007FFD6565F8BB
SetTimer.USER32 ref: 00007FFD6565F8DB

Strings

TaskbarAl, xrefs: 00007FFD6565F851, 00007FFD6565F8A3
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FFD6565F868, 00007FFD6565F8AD
(, xrefs: 00007FFD6565F7A5

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: MonitorValue$ClientFromInfoMessagePointScreenTimer
String ID: ($SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$TaskbarAl
API String ID: 2953988541-3876653080
Opcode ID: 8f5c143c421f264fdeb3e6b0909a287875635cf8cd460ed4f2bf51121d7b3ea3
Instruction ID: 543d540698597cfe57ccd5a2da5e267d03a0e0bfb0c7e85d24a3b12d72a653d6
Opcode Fuzzy Hash: 8f5c143c421f264fdeb3e6b0909a287875635cf8cd460ed4f2bf51121d7b3ea3
Instruction Fuzzy Hash: 45518C72F19A16CAF750CBA4E4A47BC73B5BB44B58F500136DA1A57A88DF3CA9C5C700

Function 00007FFD65693070 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 126windowCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 00007FFD656930CA
GetLastError.KERNEL32 ref: 00007FFD656930E0
FormatMessageA.KERNEL32 ref: 00007FFD65693114
VirtualFree.KERNEL32 ref: 00007FFD65693205
GetLastError.KERNEL32 ref: 00007FFD6569320F

Strings

Unknown Error, xrefs: 00007FFD65693120
Failed to decommit page %p (base=%p(used=%d), idx=%llu, size=%llu, error=%lu(%s)), xrefs: 00007FFD65693162
release memory %p (size=%llu), xrefs: 00007FFD65693259
Failed to release memory %p (size=%llu, error=%lu(%s)), xrefs: 00007FFD65693230
decommit page %p (base=%p(used=%d), idx=%llu, size=%llu), xrefs: 00007FFD656931AD

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ErrorFreeLastVirtual$FormatMessage
String ID: decommit page %p (base=%p(used=%d), idx=%llu, size=%llu)$ release memory %p (size=%llu)$Failed to decommit page %p (base=%p(used=%d), idx=%llu, size=%llu, error=%lu(%s))$Failed to release memory %p (size=%llu, error=%lu(%s))$Unknown Error
API String ID: 2809503268-3332624631
Opcode ID: edb279614e357427b3b822d91c61073d4f5e3929ed789ed6ea45d3a914b49dc7
Instruction ID: 9a47e01e5d84e03a3db52683fae9863340a747b8a618acbe998eb2203f0c1971
Opcode Fuzzy Hash: edb279614e357427b3b822d91c61073d4f5e3929ed789ed6ea45d3a914b49dc7
Instruction Fuzzy Hash: 0F516E31B18F4AC6EB248B96E8603A973A1FB59F84F044135DA4D437A4DF3CD194CB00

Function 00007FFD656933D0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FFD65693406
GetMappedFileNameA.PSAPI ref: 00007FFD6569341D
GetModuleHandleExA.KERNEL32 ref: 00007FFD656934AD
GetCurrentProcess.KERNEL32 ref: 00007FFD6569353C

Strings

indirect jump to addresss at %p, xrefs: 00007FFD65693482
func %p is in %.*s, xrefs: 00007FFD65693433
-> func %p in %.*s, xrefs: 00007FFD6569356C
%, xrefs: 00007FFD65693474
relative jump to %p, xrefs: 00007FFD65693450
-> func %p, xrefs: 00007FFD65693580

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CurrentProcess$FileHandleMappedModuleName
String ID: -> func %p$ -> func %p in %.*s$ func %p is in %.*s$ indirect jump to addresss at %p$ relative jump to %p$%
API String ID: 3110908827-1828122181
Opcode ID: 4f4fd1c33d259b27fb525bbc7952158004242cf8a32218f632c79e322e8538d3
Instruction ID: ff5e26db2da649bb8662d3df5ae4ee5889e96393e594c0d9260d468fcda35b14
Opcode Fuzzy Hash: 4f4fd1c33d259b27fb525bbc7952158004242cf8a32218f632c79e322e8538d3
Instruction Fuzzy Hash: 5E517161B09E8BC1FF609B95E8603B967A1BF6AF88F484031DA4D47785DF2DE985C700

Function 00007FFD656840F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 110COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FFD65684115
RoInitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD65684120
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6568413A
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD65684175

Strings

Windows.UI.Notifications.ToastNotification, xrefs: 00007FFD656841E4
Windows.UI.Notifications.ToastNotificationManager, xrefs: 00007FFD6568416E
Microsoft.Windows.Explorer, xrefs: 00007FFD65684133

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CreateInitializeReferenceStringWindows
String ID: Microsoft.Windows.Explorer$Windows.UI.Notifications.ToastNotification$Windows.UI.Notifications.ToastNotificationManager
API String ID: 3973075819-205246331
Opcode ID: 61fe052dac5bbf871d41a08c977f99300e810394ad62dcf125acb6468106a64f
Instruction ID: d16f7aeab2e1e0c9ea10b997cef4a2cf04e8230a74146d2df25542169a9359d0
Opcode Fuzzy Hash: 61fe052dac5bbf871d41a08c977f99300e810394ad62dcf125acb6468106a64f
Instruction Fuzzy Hash: 9751D526B08E0AC6EB10DBE5D4A43AD23B4EB88F89F400532CE4E57B58DF79D589C350

Function 00007FFD65690120 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 82processCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32 ref: 00007FFD65690165

Part of subcall function 00007FFD656A7C0C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7C35

SHGetFolderPathW.SHELL32 ref: 00007FFD656901B6
CreateProcessW.KERNEL32 ref: 00007FFD65690261
CloseHandle.KERNEL32 ref: 00007FFD65690270
CloseHandle.KERNEL32 ref: 00007FFD6569027B

Strings

",ZZGUI, xrefs: 00007FFD656901D1
Launching : %s, xrefs: 00007FFD656901EA
\ExplorerPatcher\ep_gui.dll, xrefs: 00007FFD656901BC
h, xrefs: 00007FFD656901F9
\rundll32.exe" ", xrefs: 00007FFD6569016B

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CloseHandle$CreateDirectoryFolderPathProcessSystem_invalid_parameter_noinfo
String ID: ",ZZGUI$Launching : %s$\ExplorerPatcher\ep_gui.dll$\rundll32.exe" "$h
API String ID: 3541607598-809932297
Opcode ID: 7766f0c82fe214f4cdd2185d49f277cc42f8bdc2b13b7a9c7478ae368f575a96
Instruction ID: 53132c013b966ef28889cd7e09896ed1f134a43b74425409a8cdb51d42b03d13
Opcode Fuzzy Hash: 7766f0c82fe214f4cdd2185d49f277cc42f8bdc2b13b7a9c7478ae368f575a96
Instruction Fuzzy Hash: EF416D22F18E85C6EB10DBA0E8603EE7370F798718F405236DA5D52AA9EF3CD185CB40

Function 00007FFD65669DA0 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 65COMMON

Download Yara Rule

APIs

CompareStringOrdinal.KERNEL32 ref: 00007FFD65669E25
CompareStringOrdinal.KERNEL32 ref: 00007FFD65669E72

Strings

::{D450A8A1-9568-45C7-9C0E-B4F9FB4537BD}, xrefs: 00007FFD65669DC9
::{7B81BE6A-CE2B-4676-A29E-EB907A5126C5}, xrefs: 00007FFD65669DB4
Advanced, xrefs: 00007FFD65669E00
::{17CD9488-1228-4B2F-88CE-4298E93E0966}, xrefs: 00007FFD65669DDB
::{A8A91A66-3A7D-4424-8D24-04E180695C7A}, xrefs: 00007FFD65669E0B
::{7007ACC7-3202-11D1-AAD2-00805FC1270E}, xrefs: 00007FFD65669DF5
::{8E908FC9-BECC-40F6-915B-F4CA0E70D03D}, xrefs: 00007FFD65669DEA
::{BB06C0E4-D293-4F75-8A90-CB05B6477EEE}, xrefs: 00007FFD65669DC2

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CompareOrdinalString
String ID: ::{17CD9488-1228-4B2F-88CE-4298E93E0966}$::{7007ACC7-3202-11D1-AAD2-00805FC1270E}$::{7B81BE6A-CE2B-4676-A29E-EB907A5126C5}$::{8E908FC9-BECC-40F6-915B-F4CA0E70D03D}$::{A8A91A66-3A7D-4424-8D24-04E180695C7A}$::{BB06C0E4-D293-4F75-8A90-CB05B6477EEE}$::{D450A8A1-9568-45C7-9C0E-B4F9FB4537BD}$Advanced
API String ID: 2409332303-3644713213
Opcode ID: 0bddf4f8cf2fe53f5b2b67e9ca6550e7cca2cebb951c42f5df0ff5165daec25b
Instruction ID: 8d4a338a2cf27ec182461c4f4b1a69c74a0e3feecd89aebe7a40062ff487a87e
Opcode Fuzzy Hash: 0bddf4f8cf2fe53f5b2b67e9ca6550e7cca2cebb951c42f5df0ff5165daec25b
Instruction Fuzzy Hash: AA315836B08F86C5EB618F40E4553A933B9FB48B94F550235CA9C17750DF39E996C740

Function 00007FFD65661DF0 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FFD65661E10

Part of subcall function 00007FFD6565D290: GetModuleHandleExW.KERNEL32 ref: 00007FFD6565D2C6
Part of subcall function 00007FFD6565D290: ImageDirectoryEntryToDataEx.DBGHELP ref: 00007FFD6565D2F9
Part of subcall function 00007FFD6565D290: FreeLibrary.KERNEL32 ref: 00007FFD6565D32F

GetCurrentProcess.KERNEL32 ref: 00007FFD65661E3E
K32GetModuleInformation.KERNEL32 ref: 00007FFD65661E55

Strings

xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xxx????xxx, xrefs: 00007FFD65661E5F
sndvolsso.dll, xrefs: 00007FFD65661E09
api-ms-win-core-registry-l1-1-0.dll, xrefs: 00007FFD65661EC0
Setup sndvolsso functions done, xrefs: 00007FFD65661ECC
RegGetValueW, xrefs: 00007FFD65661EB9
TrackPopupMenuEx, xrefs: 00007FFD65661E20
user32.dll, xrefs: 00007FFD65661E2A

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: LibraryModule$CurrentDataDirectoryEntryFreeHandleImageInformationLoadProcess
String ID: RegGetValueW$Setup sndvolsso functions done$TrackPopupMenuEx$api-ms-win-core-registry-l1-1-0.dll$sndvolsso.dll$user32.dll$xxxxxxxxxxxxxxxxx????xxx????xxx????xxxxxx????xxx????xxx
API String ID: 2511907732-965438320
Opcode ID: 6091a5929a8867be7760a9ffc442e769f486868466c859942fbdfda13ba5893d
Instruction ID: 0639caa3b0dc84bce2a0c801bf2ae09233feed5d5967c25a585b44ade25d1a68
Opcode Fuzzy Hash: 6091a5929a8867be7760a9ffc442e769f486868466c859942fbdfda13ba5893d
Instruction Fuzzy Hash: 39211B65B49E4FD0FA10EBA1E8712F92361AF8AF94F444132D95E06765DE3CE1C5C380

Function 00007FFD6568A5C0 Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 383COMMON

Download Yara Rule

Strings

HorizontalAlign, xrefs: 00007FFD6568A796
TwinUIPatches.cpp, xrefs: 00007FFD6568A62D, 00007FFD6568A700, 00007FFD6568A814, 00007FFD6568A911, 00007FFD6568AA2C, 00007FFD6568AA57
Position, xrefs: 00007FFD6568A679
VerticalAlign, xrefs: 00007FFD6568A897

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID: HorizontalAlign$Position$TwinUIPatches.cpp$VerticalAlign
API String ID: 0-1987525340
Opcode ID: f192e1d4ce6da24b30661df487f12e9c0c9414033a8a0d4c05a3f75df6258f84
Instruction ID: b0d356c0bcaf96b56a9eea48134d425b9d9d661c818714518005b035ab476644
Opcode Fuzzy Hash: f192e1d4ce6da24b30661df487f12e9c0c9414033a8a0d4c05a3f75df6258f84
Instruction Fuzzy Hash: 25F13036B19E4ACAE710CBF5D4607AD2375AB88F98F110176DE0DA7B98DE38D486C350

Function 00007FFD6567E2F0 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 226COMMON

Download Yara Rule

APIs

WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567E335
RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD6567E352

Strings

Start.TileGrid, xrefs: 00007FFD6567E3D7
StartPin, xrefs: 00007FFD6567E46F
StartMenuSettings.cpp, xrefs: 00007FFD6567E365, 00007FFD6567E3A1, 00007FFD6567E406, 00007FFD6567E441, 00007FFD6567E50F
WindowsInternal.Shell.UnifiedTile.CuratedTileCollections.CuratedTileCollectionManager, xrefs: 00007FFD6567E32E

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ActivationCreateFactoryReferenceStringWindows
String ID: Start.TileGrid$StartMenuSettings.cpp$StartPin$WindowsInternal.Shell.UnifiedTile.CuratedTileCollections.CuratedTileCollectionManager
API String ID: 1966789792-2245281551
Opcode ID: 24cb947f763ff59791ca9592d9dc97002b8e30dae2ff7bacea21f3c6b787a711
Instruction ID: fb95729b110a5f46a50b247f78fa627be9be50410b7c1e27f67227bc99074aab
Opcode Fuzzy Hash: 24cb947f763ff59791ca9592d9dc97002b8e30dae2ff7bacea21f3c6b787a711
Instruction Fuzzy Hash: F3910A26B14E4BC6FB108BB5D8A06ED2770BB48F98B541532DE4DA3B64DE79D989C300

Function 00007FFD6567C790 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FFD6567C7B1

Strings

wil, xrefs: 00007FFD6567C7C1, 00007FFD6567C812, 00007FFD6567C877, 00007FFD6567C8D2, 00007FFD6567C904

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ObjectSingleWait
String ID: wil
API String ID: 24740636-1589926490
Opcode ID: 6cb99dce32a31d1732828c6e927fb19117e6b334bfb23547af7556cf32aa526d
Instruction ID: b6afb3af6fc5b7bcaffa28fcf275e1bd9e2a0808109101744e980af34573a648
Opcode Fuzzy Hash: 6cb99dce32a31d1732828c6e927fb19117e6b334bfb23547af7556cf32aa526d
Instruction Fuzzy Hash: BC414371B1CE4BC2FBA09BA5E4203BA67A1EF84F94F504132E94F86695DE3CE5C5C601

Function 00007FFD656541E0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57windowregistryCOMMON

Download Yara Rule

APIs

RegisterWindowMessageW.USER32 ref: 00007FFD6565420E
FindWindowW.USER32 ref: 00007FFD6565421F
RegisterWindowMessageW.USER32 ref: 00007FFD65654246
FindWindowW.USER32 ref: 00007FFD65654257
PostMessageW.USER32 ref: 00007FFD656542AD

Strings

SHELLHOOK, xrefs: 00007FFD65654207, 00007FFD6565423F, 00007FFD65654281
SimpleWindowSwitcher_{BEA057BB-66C7-4758-A610-FAE6013E9F98}, xrefs: 00007FFD65654216, 00007FFD6565424E, 00007FFD65654290

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Window$Message$FindRegister$Post
String ID: SHELLHOOK$SimpleWindowSwitcher_{BEA057BB-66C7-4758-A610-FAE6013E9F98}
API String ID: 806771716-2759489877
Opcode ID: 3e11536cf82fe94f4e0ef2b57cea84fb7ed16f0d289556e78c200ca9780dae0a
Instruction ID: 697d8d4b1ccbd286d812e061248a94db0f6c5b7c88b332a9e7c682b179db0523
Opcode Fuzzy Hash: 3e11536cf82fe94f4e0ef2b57cea84fb7ed16f0d289556e78c200ca9780dae0a
Instruction Fuzzy Hash: DF210B24F5CE1AC1FF649BE1EA6477512A1BF58F82F884075C84F46A94DEACA4E4C340

Function 00007FFD656A8DA8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A8DEB
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A91D8
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A9474

Strings

p, xrefs: 00007FFD656A8E9D
p, xrefs: 00007FFD656A8F15
-, xrefs: 00007FFD656A8E81
f, xrefs: 00007FFD656A8F0D
:, xrefs: 00007FFD656A8FA4

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 0fac80845ca2206c325da4620558c9a9b35b740b33f0e8549cdded86d03224de
Instruction ID: ec9730055922c5b23b0094da4108e129a38430c2e6035c62d44ec945f4981efa
Opcode Fuzzy Hash: 0fac80845ca2206c325da4620558c9a9b35b740b33f0e8549cdded86d03224de
Instruction Fuzzy Hash: E1129031F0C95BC6FB245A94D0683BA76A5EB40F58FA44131E68A466D8DF3FE9C4CB10

Function 00007FFD6569F848 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD6569F888
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD6569FC50
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD6569FEEF

Strings

f, xrefs: 00007FFD6569FAD5
f, xrefs: 00007FFD6569F920
p, xrefs: 00007FFD6569F92D
p, xrefs: 00007FFD6569F992
f, xrefs: 00007FFD6569F98A

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: bc113c6e72820b98e318c63d88f467cb3010e0423711e0b0b4a3decac008c911
Instruction ID: 210c3926c94d162d5351998c48bfc613b785120fd8666e8035c9c7ae645c3115
Opcode Fuzzy Hash: bc113c6e72820b98e318c63d88f467cb3010e0423711e0b0b4a3decac008c911
Instruction Fuzzy Hash: 8B129F62B0C98BC6FB615E95E0643BAF251FB62B54F954036F699466C8DF3CE4C0CB40

Function 00007FFD65654CF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 214COMMON

Download Yara Rule

APIs

StretchDIBits.GDI32 ref: 00007FFD65654E0C
StretchDIBits.GDI32 ref: 00007FFD65654E68
StretchDIBits.GDI32 ref: 00007FFD65654EC2
StretchDIBits.GDI32 ref: 00007FFD65654F69
StretchDIBits.GDI32 ref: 00007FFD65654FC3
StretchDIBits.GDI32 ref: 00007FFD65655015
StretchDIBits.GDI32 ref: 00007FFD65655065

Strings

, xrefs: 00007FFD6565501B

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: BitsStretch
String ID:
API String ID: 350495539-3916222277
Opcode ID: 16169dae19ceeb75348473d394cbf06ec6f314e1e1cb273dfbed35b0081e99fd
Instruction ID: b688b0cf2c4c361611f3f61e5e8e3b7f57a6abd5e3a8b0c23f6eaa839fc51349
Opcode Fuzzy Hash: 16169dae19ceeb75348473d394cbf06ec6f314e1e1cb273dfbed35b0081e99fd
Instruction Fuzzy Hash: 10A142B2618BC08ED7108F65F48475EBBB4F789798F205229EA8963B58DB7DD055CF00

Function 00007FFD656617A0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 196windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD6565D750: QueryPerformanceFrequency.KERNEL32 ref: 00007FFD6565D768
Part of subcall function 00007FFD6565D750: QueryPerformanceCounter.KERNEL32 ref: 00007FFD6565D777

GetClassNameW.USER32 ref: 00007FFD65661818
WindowFromPoint.USER32 ref: 00007FFD656618AA
GetClassNameW.USER32 ref: 00007FFD656618C1
GetCursorPos.USER32 ref: 00007FFD6566193D
EnumPropsA.USER32 ref: 00007FFD65661A34
TrackPopupMenuEx.USER32 ref: 00007FFD65661A84

Strings

Shell_TrayWnd, xrefs: 00007FFD65661842
Shell_SecondaryTrayWnd, xrefs: 00007FFD65661825, 00007FFD656618CF

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ClassNamePerformanceQuery$CounterCursorEnumFrequencyFromMenuPointPopupPropsTrackWindow
String ID: Shell_SecondaryTrayWnd$Shell_TrayWnd
API String ID: 1660317238-1433838494
Opcode ID: 128fb20ece10c7a3924be445a59ad679d9d991228480f978e37881e9e63ea3d7
Instruction ID: 53bafaa403091197f1c39f719f643afbbb0edfce3c5af6723c95b87856f8928e
Opcode Fuzzy Hash: 128fb20ece10c7a3924be445a59ad679d9d991228480f978e37881e9e63ea3d7
Instruction Fuzzy Hash: 6B917276B48A4AC6EB609F85E46037973A1FB85F90F844136EE4D126A4DF3CE8C5C742

Function 00007FFD65672270 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 131comserviceCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD6565E130), ref: 00007FFD656722BE
IUnknown_QueryService.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD6565E130), ref: 00007FFD656722F1
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD6565E130), ref: 00007FFD65672364
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD6565E130), ref: 00007FFD65672428

Strings

Windows.Internal.ShellExperience.TrayBatteryFlyout, xrefs: 00007FFD6567232D
Windows.Internal.ShellExperience.NetworkFlyout, xrefs: 00007FFD6567233F
Windows.Internal.ShellExperience.MtcUvc, xrefs: 00007FFD65672324
Windows.Internal.ShellExperience.TrayClockFlyout, xrefs: 00007FFD65672336

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CreateStringWindows$DeleteInstanceQueryReferenceServiceUnknown_
String ID: Windows.Internal.ShellExperience.MtcUvc$Windows.Internal.ShellExperience.NetworkFlyout$Windows.Internal.ShellExperience.TrayBatteryFlyout$Windows.Internal.ShellExperience.TrayClockFlyout
API String ID: 3704749038-3268901682
Opcode ID: b73c0e7a01cbb78688efa312c8a3ac757f1c225743d08ed0fb6fe31fed24a1df
Instruction ID: d70a23393ebe3b9362559a79f19d73670f25a252ba603298a3ac94ce43d83957
Opcode Fuzzy Hash: b73c0e7a01cbb78688efa312c8a3ac757f1c225743d08ed0fb6fe31fed24a1df
Instruction Fuzzy Hash: F0510E72B08E4BC2EB508BA9E8A036967B1FB84FA0F504132DA4E57764DF7DD589C700

Function 00007FFD6567FE10 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 125synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FFD6567FE3F
CreateMutexExW.KERNEL32 ref: 00007FFD6567FE7C
CloseHandle.KERNEL32 ref: 00007FFD6567FE9E
WaitForSingleObjectEx.KERNEL32 ref: 00007FFD6567FEE5
ReleaseMutex.KERNEL32 ref: 00007FFD6567FFAE

Part of subcall function 00007FFD6567C1C0: GetLastError.KERNEL32 ref: 00007FFD6567C1CB

Strings

wil, xrefs: 00007FFD6567FF32, 00007FFD6567FF4E, 00007FFD6567FF6A, 00007FFD6567FFE8
x, xrefs: 00007FFD6567FE4D
Local\SM0:%lu:%lu:%hs, xrefs: 00007FFD6567FE55

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Mutex$CloseCreateCurrentErrorHandleLastObjectProcessReleaseSingleWait
String ID: Local\SM0:%lu:%lu:%hs$wil$x
API String ID: 908355122-984673096
Opcode ID: d964f013290470198f31b6882e51c7cbeb86e784c1be97d68529b4bb9367cec1
Instruction ID: 46844a033f85a9522525447618c38a1d6458bdb567b928b3f19c5a714be2a215
Opcode Fuzzy Hash: d964f013290470198f31b6882e51c7cbeb86e784c1be97d68529b4bb9367cec1
Instruction Fuzzy Hash: 6551922171DE8BC1FB609B95E4647BAA360EF84F90F540532EA8E87B95DE3CD485C700

Function 00007FFD6566B110 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 108registrywindowCOMMON

Download Yara Rule

APIs

GetClassWord.USER32 ref: 00007FFD6566B166
RegisterWindowMessageW.USER32 ref: 00007FFD6566B176
GetClassWord.USER32 ref: 00007FFD6566B188
RegisterWindowMessageW.USER32 ref: 00007FFD6566B198
SetWindowCompositionAttribute.USER32 ref: 00007FFD6566B2B8

Strings

Shell_TrayWnd, xrefs: 00007FFD6566B16C
Shell_SecondaryTrayWnd, xrefs: 00007FFD6566B18E

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Window$ClassMessageRegisterWord$AttributeComposition
String ID: Shell_SecondaryTrayWnd$Shell_TrayWnd
API String ID: 2307794763-1433838494
Opcode ID: e154c394c6d2fd9063cc1ccc694e1db74e76edb28decd2560635fdc285ff3f39
Instruction ID: a4626a754cf3c58207702bc9c730f09af240deeaaadafed8ccbdddc26b4f1b1c
Opcode Fuzzy Hash: e154c394c6d2fd9063cc1ccc694e1db74e76edb28decd2560635fdc285ff3f39
Instruction Fuzzy Hash: D3417E61F48E4AC7FB649B91D82433D63A6AF81F98F184135E94E066A4CF3CE8D5CB01

Function 00007FFD65690410 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 59windowCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00007FFD656904C1
SysFreeString.OLEAUT32 ref: 00007FFD656904CC
SysFreeString.OLEAUT32 ref: 00007FFD656904D7
SysFreeString.OLEAUT32 ref: 00007FFD656904E2
SysFreeString.OLEAUT32 ref: 00007FFD656904ED
MessageBoxW.USER32 ref: 00007FFD6569050A

Strings

%sLine %u: %s%s, xrefs: 00007FFD65690494
Error, xrefs: 00007FFD656904F9

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: FreeString$Messagewsprintf
String ID: %sLine %u: %s%s$Error
API String ID: 1127142505-3766919743
Opcode ID: 7e5e450b7c3d9d25ce32135dab633d936c69a5a0caca5d45b25486a9b0defd27
Instruction ID: 6d0a4f624e88d957fd5ac4a34f3f4897eea13fb46628e68a79625159208e7fda
Opcode Fuzzy Hash: 7e5e450b7c3d9d25ce32135dab633d936c69a5a0caca5d45b25486a9b0defd27
Instruction Fuzzy Hash: A131F862A18F8AC2DB10DB51F4647AAA370FBD9B84F445132DA8E47B28DF7CD194CB40

Function 00007FFD65671280 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 222registrymemorylibraryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32 ref: 00007FFD656712AE
RegCloseKey.ADVAPI32 ref: 00007FFD656712C0
LoadLibraryW.KERNEL32 ref: 00007FFD656712CD
VirtualProtect.KERNEL32 ref: 00007FFD656715C9
VirtualProtect.KERNEL32 ref: 00007FFD656715E6

Strings

Control Panel\Quick Actions\Control Center\QuickActionsStateCapture\ExplorerPatcher, xrefs: 00007FFD656712A7
Windows.UI.QuickActions.dll, xrefs: 00007FFD656712C6

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ProtectVirtual$CloseLibraryLoadOpen
String ID: Control Panel\Quick Actions\Control Center\QuickActionsStateCapture\ExplorerPatcher$Windows.UI.QuickActions.dll
API String ID: 833317941-2238621791
Opcode ID: 40093c2c2d411dc051a55da60c8ab614ed19546aff4c4f70f436c8de76865bda
Instruction ID: 8802bdadc1caa0fffd776cdcbaebe1d7de234d72e72bca28ba98bbdd5c4c0ef7
Opcode Fuzzy Hash: 40093c2c2d411dc051a55da60c8ab614ed19546aff4c4f70f436c8de76865bda
Instruction Fuzzy Hash: 1B917D62B18A8AC6EB548FA1D4703B977A5FB44F88F444136CE4E5BB98DE3CE585C700

Function 00007FFD6567A2D0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567A323
RoGetActivationFactory.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD6567A33C
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567A543

Strings

[Positioning] Changed settings for monitor: %p : %d, xrefs: 00007FFD6567A4AE
WindowsUdk.UI.Shell.TaskbarLayout, xrefs: 00007FFD6567A313
[Positioning] Removed settings for monitor: %p, xrefs: 00007FFD6567A4F5
[Positioning] Added settings for monitor %p : %d, xrefs: 00007FFD6567A43B

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: StringWindows$ActivationCreateDeleteFactoryReference
String ID: WindowsUdk.UI.Shell.TaskbarLayout$[Positioning] Added settings for monitor %p : %d$[Positioning] Changed settings for monitor: %p : %d$[Positioning] Removed settings for monitor: %p
API String ID: 2243136672-1634499889
Opcode ID: cfd15b76b2e5a53c4c930bc2ca916c6c4de9213d4916d509ac99a2c5a72be6eb
Instruction ID: 12dbfa50c108904896cb14cd62f8a667e0209a17cffdc0629964e0ce921694ef
Opcode Fuzzy Hash: cfd15b76b2e5a53c4c930bc2ca916c6c4de9213d4916d509ac99a2c5a72be6eb
Instruction Fuzzy Hash: 74810672B08E1AC6EB148FA5D8A42AD33B1FB44F98B544536DE0E57B68DF39E495C300

Function 00007FFD65661330 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 163windowCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FFD656613A1
EnumPropsA.USER32 ref: 00007FFD6566150C
TrackPopupMenu.USER32 ref: 00007FFD65661571

Strings

SHELLDLL_DefView, xrefs: 00007FFD656614A7
Shell_TrayWnd, xrefs: 00007FFD656613AE
Shell_SecondaryTrayWnd, xrefs: 00007FFD656613E8
SysTreeView32, xrefs: 00007FFD656614D7

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ClassEnumMenuNamePopupPropsTrack
String ID: SHELLDLL_DefView$Shell_SecondaryTrayWnd$Shell_TrayWnd$SysTreeView32
API String ID: 3301139559-1312006807
Opcode ID: ecd20350560e8102a5445a1d547cb7e323caede6247b8b32d0e71a1653219032
Instruction ID: c319b9ab1049d33f8ba5c2866ecc6dd4e9490e9484a47f63f189ada86f60da84
Opcode Fuzzy Hash: ecd20350560e8102a5445a1d547cb7e323caede6247b8b32d0e71a1653219032
Instruction Fuzzy Hash: 1061B266B4894AC2EB648B96D4303B973A1FB54FA4F844232DD4E076A8DF7CE8D5C701

Function 00007FFD656802E0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 159libraryloaderCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00007FFD65680318
LoadLibraryW.KERNEL32 ref: 00007FFD6568035F
GetProcAddress.KERNEL32 ref: 00007FFD6568036E
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FFD65680497
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FFD656804A2

Strings

combase.dll, xrefs: 00007FFD65680358
RoGetAgileReference, xrefs: 00007FFD65680367

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ExclusiveLock$Release$AcquireAddressLibraryLoadProc
String ID: RoGetAgileReference$combase.dll
API String ID: 1925124437-3498391780
Opcode ID: 2d25d96308d6576da6ea71630913badf15274bc04d8172f370e9f48a57ab2006
Instruction ID: 8110eeeef21b28144801a94386956954e59b32be40f36be136b2b69debb32c9e
Opcode Fuzzy Hash: 2d25d96308d6576da6ea71630913badf15274bc04d8172f370e9f48a57ab2006
Instruction Fuzzy Hash: 07611722B0AF1AC5EB10DBA1D8603BC23A4AF44F98F484976DE1D57765DF38D995C310

Function 00007FFD656740F0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 127COMMON

Download Yara Rule

APIs

FindWindowW.USER32 ref: 00007FFD6567413C
MonitorFromWindow.USER32 ref: 00007FFD6567415D
GetDpiForMonitor.API-MS-WIN-SHCORE-SCALING-L1-1-1 ref: 00007FFD65674172
GetWindowRect.USER32 ref: 00007FFD656741A8

Strings

Shell_TrayWnd, xrefs: 00007FFD65674129
`, xrefs: 00007FFD65674152
`, xrefs: 00007FFD65674147

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Window$Monitor$FindFromRect
String ID: Shell_TrayWnd$`$`
API String ID: 1754679160-909703354
Opcode ID: 3c810de8b388980eaee915de0c67787d9286607261a614068ed218275ba57dbb
Instruction ID: a8ce56c891570e0e09f367fd2f78db595953a5e77e95218f896e979e87b0ada2
Opcode Fuzzy Hash: 3c810de8b388980eaee915de0c67787d9286607261a614068ed218275ba57dbb
Instruction Fuzzy Hash: 1151B332A1CE46CAE762CB65E46433AB3A1EF59B85F108731E55E92664DF3CE491CB00

Function 00007FFD6566D5F0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FFD6566D75A
VirtualProtect.KERNEL32 ref: 00007FFD6566D780
VirtualProtect.KERNEL32 ref: 00007FFD6566D79A
VirtualProtect.KERNEL32 ref: 00007FFD6566D7C3

Strings

[SSO] pssoEntryTarget = %llX, xrefs: 00007FFD6566D723
[SSO] pguidTarget = %llX, xrefs: 00007FFD6566D6C9
.rdata, xrefs: 00007FFD6566D66B

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ProtectVirtual
String ID: .rdata$[SSO] pguidTarget = %llX$[SSO] pssoEntryTarget = %llX
API String ID: 544645111-3803262335
Opcode ID: 3da57a61b8d03f903389d7fcf90102e1d8f131a3839927f75438aff2c155269f
Instruction ID: 688d4cc487d363e4abd28c0c95baee1a4f007b74c400c620bb9e121c661c4ab7
Opcode Fuzzy Hash: 3da57a61b8d03f903389d7fcf90102e1d8f131a3839927f75438aff2c155269f
Instruction Fuzzy Hash: A951AD22B08E4AC6EB608FA1E460379A7B0FB54F98F108131DA4D47698EF3CE5D5C742

Function 00007FFD656514C0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 83COMMON

Download Yara Rule

Strings

General failure, xrefs: 00007FFD656515D6
====================================An error occured in the application.Error number: 0x%x, xrefs: 00007FFD6565150E
Here is the stack trace:, xrefs: 00007FFD65651611
Description: %s, xrefs: 00007FFD656515EA
====================================, xrefs: 00007FFD65651622

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID:
String ID: ====================================$====================================An error occured in the application.Error number: 0x%x$Description: %s$General failure$Here is the stack trace:
API String ID: 0-2550951133
Opcode ID: 247e535ffdaea2d948cfc772308ba7d5c326806172b63b5b1f06f032a2458995
Instruction ID: c47b9dc0f9f1ad85700d62e8ba8628787aef9f1af9bcb6edd47d2a6d99be8f9e
Opcode Fuzzy Hash: 247e535ffdaea2d948cfc772308ba7d5c326806172b63b5b1f06f032a2458995
Instruction Fuzzy Hash: D7314F31F48E4AC2FA10DB95E4713796261AF95B80F940135EA4E47795EF3DE9D1C700

Function 00007FFD65660060 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 81windowregistrytimeCOMMON

Download Yara Rule

APIs

RegisterWindowMessageW.USER32 ref: 00007FFD656600C0
FindWindowW.USER32 ref: 00007FFD656600D1
PostMessageW.USER32 ref: 00007FFD656600E2
GetDoubleClickTime.USER32 ref: 00007FFD65660149

Part of subcall function 00007FFD6565FBE0: CoCreateInstance.OLE32 ref: 00007FFD6565FC85
Part of subcall function 00007FFD6565FBE0: GetClassNameW.USER32 ref: 00007FFD6565FD74
Part of subcall function 00007FFD6565FBE0: IsWindow.USER32 ref: 00007FFD6565FD7F

CallNextHookEx.USER32 ref: 00007FFD65660192

Strings

Shell_TrayWnd, xrefs: 00007FFD656600C8
Windows11ContextMenu_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}, xrefs: 00007FFD656600AF

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Window$Message$CallClassClickCreateDoubleFindHookInstanceNameNextPostRegisterTime
String ID: Shell_TrayWnd$Windows11ContextMenu_{D17F1E1A-5919-4427-8F89-A1A8503CA3EB}
API String ID: 1587758685-4164012455
Opcode ID: d3235a081cff106ef0dbb9e6b14df50ae6edffb1406e9cb2185b88d2b9e7f724
Instruction ID: ea94b9de363c20971d624f7a1c800cabd783263b325f2ba6fff30e63508d6dc0
Opcode Fuzzy Hash: d3235a081cff106ef0dbb9e6b14df50ae6edffb1406e9cb2185b88d2b9e7f724
Instruction Fuzzy Hash: AB31F225F4CE4BD6FB609BE1E87433562A6AF84F94F040135E94E42695DE7CA4C1CB42

Function 00007FFD6567E690 Relevance: 12.1, APIs: 8, Instructions: 76COMMON

Download Yara Rule

APIs

WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567E721
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567E735
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567E749
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567E75D
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567E76E
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567E77C
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567E78A
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0 ref: 00007FFD6567E798

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: DeleteStringWindows
String ID:
API String ID: 3152741638-0
Opcode ID: 220ed1f342998a80439a4c618c8cb02c5339f846fd9f4f2c159e7e9e8fb559cd
Instruction ID: 138e17d8d787ba5f1eb296c851a4657fe413ac514f5e7014869962ff82618121
Opcode Fuzzy Hash: 220ed1f342998a80439a4c618c8cb02c5339f846fd9f4f2c159e7e9e8fb559cd
Instruction Fuzzy Hash: 1631C336B14E4AC5EB10AF71E8643692375FB85F88F544136DA4E4BB69CF39E896C300

Function 00007FFD6569B564 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FFD6569B5C1

Part of subcall function 00007FFD6569D8C8: __GetUnwindTryBlock.LIBCMT ref: 00007FFD6569D90B
Part of subcall function 00007FFD6569D8C8: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FFD6569D930

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFD6569B699
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FFD6569B8E7

Strings

csm, xrefs: 00007FFD6569B5DB
csm, xrefs: 00007FFD6569B642
csm, xrefs: 00007FFD6569B6BC

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchState
String ID: csm$csm$csm
API String ID: 1826822863-393685449
Opcode ID: e2a4c342c4d421d5c73be41df65f2b5ec1998bf278118c1d66828454b570aa30
Instruction ID: 1cc810a8a9cdc78129992220cab61e75b1248460474eef5c84c61f0f3f5989a8
Opcode Fuzzy Hash: e2a4c342c4d421d5c73be41df65f2b5ec1998bf278118c1d66828454b570aa30
Instruction Fuzzy Hash: FED17132B18B4BCAEB609BA5D5503AD77A0FB66B98F140135EA8D57765CF38E0C1C701

Function 00007FFD656B0DC8 Relevance: 10.8, APIs: 7, Instructions: 290COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD656B11F5

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b52de193dcd97822f851048e7139e83e243a94adfbbac5a678cd008b0d4c604a
Instruction ID: 6d1a1f49f5bc9f90dc7379d329559eefa7f88930d8d9f0dc9b8b8a56c8b17b72
Opcode Fuzzy Hash: b52de193dcd97822f851048e7139e83e243a94adfbbac5a678cd008b0d4c604a
Instruction Fuzzy Hash: C7C1A322B0CE8ED5EB609B95D4203BA7BA5EB81F90F554131DA4D07392DE7DE8E5C700

Function 00007FFD6568A380 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 154COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32 ref: 00007FFD6568A3B1
GetMonitorInfoW.USER32 ref: 00007FFD6568A3F8

Strings

(, xrefs: 00007FFD6568A3DA
TwinUIPatches.cpp, xrefs: 00007FFD6568A3C4, 00007FFD6568A406, 00007FFD6568A442, 00007FFD6568A490, 00007FFD6568A4D3, 00007FFD6568A51E, 00007FFD6568A54B

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Monitor$FromInfoPoint
String ID: ($TwinUIPatches.cpp
API String ID: 1349325158-3972200677
Opcode ID: e054066f941461976d5cc2d576777dffaa520b6b6f2a9a6a1f556f6559503beb
Instruction ID: bcb200128641f0bae4aab20f32b56d83f040c1d427724e38931cd194a50ddb79
Opcode Fuzzy Hash: e054066f941461976d5cc2d576777dffaa520b6b6f2a9a6a1f556f6559503beb
Instruction Fuzzy Hash: 6C613A22B05F4AC5FB118BE1D8607A92760FB98FA8F148632DE0D97B94DE38D5C9C351

Function 00007FFD65664090 Relevance: 10.6, APIs: 7, Instructions: 142COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FFD656640CC
GetWindowRect.USER32 ref: 00007FFD656640E5

Part of subcall function 00007FFD656615C0: MonitorFromPoint.USER32 ref: 00007FFD656615F4
Part of subcall function 00007FFD656615C0: FindWindowExW.USER32 ref: 00007FFD65661610
Part of subcall function 00007FFD656615C0: MonitorFromWindow.USER32 ref: 00007FFD65661621
Part of subcall function 00007FFD656615C0: FindWindowExW.USER32 ref: 00007FFD65661662
Part of subcall function 00007FFD656615C0: MonitorFromWindow.USER32 ref: 00007FFD65661673
Part of subcall function 00007FFD656615C0: GetMonitorInfoW.USER32 ref: 00007FFD65661681
Part of subcall function 00007FFD656615C0: GetWindowRect.USER32 ref: 00007FFD65661692

MonitorFromPoint.USER32 ref: 00007FFD6566413E
GetMonitorInfoW.USER32 ref: 00007FFD6566415B
MonitorFromPoint.USER32 ref: 00007FFD656641D3
GetMonitorInfoW.USER32 ref: 00007FFD656641EC
SetWindowPos.USER32 ref: 00007FFD65664240

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: MonitorWindow$From$InfoPointRect$Find
String ID:
API String ID: 2969468792-0
Opcode ID: 28d520fd46e6a450a8f3d6f9ca3a2d7ccd785e937793381680aa9034f5109025
Instruction ID: 6d9a49d36a6e91cfa6cd023673365618b37ac6207d2049c9d1412a2566e832a0
Opcode Fuzzy Hash: 28d520fd46e6a450a8f3d6f9ca3a2d7ccd785e937793381680aa9034f5109025
Instruction Fuzzy Hash: 88516A32B18906DFE724CFB8D8A46AC37B5FB84B48B154534DE48A7B48CE78E945CB40

Function 00007FFD6569DE1C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FFD6569E023,?,?,?,00007FFD6569AB36,?,?,?,00007FFD6569AAF1), ref: 00007FFD6569DEA1
GetLastError.KERNEL32(?,?,00000000,00007FFD6569E023,?,?,?,00007FFD6569AB36,?,?,?,00007FFD6569AAF1), ref: 00007FFD6569DEAF
LoadLibraryExW.KERNEL32(?,?,00000000,00007FFD6569E023,?,?,?,00007FFD6569AB36,?,?,?,00007FFD6569AAF1), ref: 00007FFD6569DED9
FreeLibrary.KERNEL32(?,?,00000000,00007FFD6569E023,?,?,?,00007FFD6569AB36,?,?,?,00007FFD6569AAF1), ref: 00007FFD6569DF47
GetProcAddress.KERNEL32(?,?,00000000,00007FFD6569E023,?,?,?,00007FFD6569AB36,?,?,?,00007FFD6569AAF1), ref: 00007FFD6569DF53

Strings

api-ms-, xrefs: 00007FFD6569DEC1

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 395a31ccfc8d9580cbc22548a9da8417bb1a8a367a659b40465e7ae359179efb
Instruction ID: 61b5a2667b969d4534baaa3addd42f4275e62186cccc8cba725e9bfb6f7b3ea0
Opcode Fuzzy Hash: 395a31ccfc8d9580cbc22548a9da8417bb1a8a367a659b40465e7ae359179efb
Instruction Fuzzy Hash: F731AF21B0AE4AD1EF119B82E82037923A4FF56FA4F594535DE5D0B790EE3CE480C340

Function 00007FFD656661C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68windowCOMMON

Download Yara Rule

APIs

#412.COMCTL32 ref: 00007FFD656661F9
#413.COMCTL32 ref: 00007FFD6566620A
#413.COMCTL32 ref: 00007FFD65666230
PostMessageW.USER32 ref: 00007FFD656662AF

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FFD6566627E
TaskbarSd, xrefs: 00007FFD65666267

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: #413$#412MessagePost
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$TaskbarSd
API String ID: 691879527-1316455474
Opcode ID: e8ef062d3e4db97a608914cd394fefc2310a31697b317585529f458907ed4c07
Instruction ID: 5162112be36ab0e3bb5c2264984431a186456c1a6e77296ca00b3a69ea133b81
Opcode Fuzzy Hash: e8ef062d3e4db97a608914cd394fefc2310a31697b317585529f458907ed4c07
Instruction Fuzzy Hash: 7C216021B29E4AC5FB608B95F8A077962A4AF98F98F441035DA4E07B55DF3CE485C701

Function 00007FFD656B0080 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFD656B008F
FlsGetValue.KERNEL32 ref: 00007FFD656B00A4
FlsSetValue.KERNEL32 ref: 00007FFD656B00C5
FlsSetValue.KERNEL32 ref: 00007FFD656B00F2
FlsSetValue.KERNEL32 ref: 00007FFD656B0103
FlsSetValue.KERNEL32 ref: 00007FFD656B0114
SetLastError.KERNEL32 ref: 00007FFD656B012F

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: b6ce57b59bb366973f69267a6622476f5082e6942641958cea62566d32bfade2
Instruction ID: d51d010a83b0abb1e110b798c0d5a6ad085298ba3c4924c0646285f24deb4d69
Opcode Fuzzy Hash: b6ce57b59bb366973f69267a6622476f5082e6942641958cea62566d32bfade2
Instruction Fuzzy Hash: F1213924B0DE8AC1FB68A3E1E67137966A29F44FF0F144734D92E066D6EE2DA4D1C200

Function 00007FFD656B9288 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FFD656B92B9
GetLastError.KERNEL32 ref: 00007FFD656B92C5
CloseHandle.KERNEL32 ref: 00007FFD656B92DD
CreateFileW.KERNEL32 ref: 00007FFD656B9308
WriteConsoleW.KERNEL32 ref: 00007FFD656B9327

Strings

CONOUT$, xrefs: 00007FFD656B92E9

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 7e15efb84d2b9ba58ea895313166d56808b3acfb4739f2d2abd5ad9eaa873fb7
Instruction ID: 54902b260d11324f3daceec3fc4fff6b08ec1eb4acb65cfe0ef36327cc13e799
Opcode Fuzzy Hash: 7e15efb84d2b9ba58ea895313166d56808b3acfb4739f2d2abd5ad9eaa873fb7
Instruction Fuzzy Hash: C9118131B18E45C6EB508B92E86432972B0FB98FE4F040234EA1D87794DF3DD594C780

Function 00007FFD6567C0B0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FFD6567C0C4
HeapAlloc.KERNEL32 ref: 00007FFD6567C0D5
GetModuleHandleW.KERNEL32 ref: 00007FFD6567C0F9
GetProcAddress.KERNEL32 ref: 00007FFD6567C10E

Strings

RtlDisownModuleHeapAllocation, xrefs: 00007FFD6567C104
ntdll.dll, xrefs: 00007FFD6567C0F2

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Heap$AddressAllocHandleModuleProcProcess
String ID: RtlDisownModuleHeapAllocation$ntdll.dll
API String ID: 3242894177-704576883
Opcode ID: e12e3b4424fb9b3e7be58cb83f494a023fa11a41684acafc1630beb2eb937718
Instruction ID: f02fa7b64af0bd6e76c07958932305aec38cca16429492c9b4a4d3b1a477b178
Opcode Fuzzy Hash: e12e3b4424fb9b3e7be58cb83f494a023fa11a41684acafc1630beb2eb937718
Instruction Fuzzy Hash: 0701F724F09F8AC1FE949B92F86436463A1AF48F88F485836C96E47364DE3CE4D1C300

Function 00007FFD656552E0 Relevance: 10.5, APIs: 7, Instructions: 34COMMON

Download Yara Rule

APIs

UnregisterHotKey.USER32 ref: 00007FFD656552F2
UnregisterHotKey.USER32 ref: 00007FFD65655301
UnregisterHotKey.USER32 ref: 00007FFD65655310
UnregisterHotKey.USER32 ref: 00007FFD6565531F
UnregisterHotKey.USER32 ref: 00007FFD65655337
UnregisterHotKey.USER32 ref: 00007FFD65655346
UnregisterHotKey.USER32 ref: 00007FFD65655355

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Unregister
String ID:
API String ID: 315482161-0
Opcode ID: 766d3c97c3d8b32cdde17675f46af760bfa5e6629d966a02d5b8d8db012bcc67
Instruction ID: af866b8586a2c906d7b5c0835a226d5d11abd7aa326af72d4b6c32012eee2977
Opcode Fuzzy Hash: 766d3c97c3d8b32cdde17675f46af760bfa5e6629d966a02d5b8d8db012bcc67
Instruction Fuzzy Hash: DF01A966B04D05C2EB459BA1D8653292325EB98F6DF104231CE2E463D9CF7CD8E5D290

Function 00007FFD65687C60 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

SetWindowLongPtrW.USER32 ref: 00007FFD65687CB5
DefWindowProcW.USER32 ref: 00007FFD65687CC6

Part of subcall function 00007FFD6565C200: GetCursorPos.USER32 ref: 00007FFD6565C25F
Part of subcall function 00007FFD6565C200: GetForegroundWindow.USER32 ref: 00007FFD6565C265
Part of subcall function 00007FFD6565C200: SetForegroundWindow.USER32 ref: 00007FFD6565C273
Part of subcall function 00007FFD6565C200: CreatePopupMenu.USER32 ref: 00007FFD6565C279
Part of subcall function 00007FFD6565C200: PathUnquoteSpacesW.SHLWAPI ref: 00007FFD6565C2BC
Part of subcall function 00007FFD6565C200: PathRemoveExtensionW.SHLWAPI ref: 00007FFD6565C2C6
Part of subcall function 00007FFD6565C200: PathStripPathW.SHLWAPI ref: 00007FFD6565C2D0
Part of subcall function 00007FFD6565C200: wsprintfW.USER32 ref: 00007FFD6565C2E8
Part of subcall function 00007FFD6565C200: InsertMenuW.USER32 ref: 00007FFD6565C30B
Part of subcall function 00007FFD6565C200: InsertMenuW.USER32 ref: 00007FFD6565C32E
Part of subcall function 00007FFD6565C200: TrackPopupMenu.USER32 ref: 00007FFD6565C388
Part of subcall function 00007FFD6565C200: SetForegroundWindow.USER32 ref: 00007FFD6565C3A8

DefWindowProcW.USER32 ref: 00007FFD65687CDF

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Window$MenuPath$Foreground$InsertPopupProc$CreateCursorExtensionLongRemoveSpacesStripTrackUnquotewsprintf
String ID:
API String ID: 1129523998-0
Opcode ID: 5536128b1daad23b82ad7d33954240776bfc4c408024a79fe10b42f1552ac7ac
Instruction ID: bcfc59520e12fdb56d44dcc3e8bde71a961e9daf92810a5cbd1ccade27c6e5c7
Opcode Fuzzy Hash: 5536128b1daad23b82ad7d33954240776bfc4c408024a79fe10b42f1552ac7ac
Instruction Fuzzy Hash: 5431A025B09F5AC2FA208B96E42077963A4BF85FD0F584435DE4E177A4DE3DE582C310

Function 00007FFD656896C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 130memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD656893F0: CoCreateInstance.OLE32 ref: 00007FFD65689467

VirtualProtect.KERNEL32 ref: 00007FFD6568983E
VirtualProtect.KERNEL32 ref: 00007FFD65689860
VirtualProtect.KERNEL32 ref: 00007FFD65689887
VirtualProtect.KERNEL32 ref: 00007FFD656898A9

Strings

xxxx, xrefs: 00007FFD656897C5, 00007FFD65689800

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ProtectVirtual$CreateInstance
String ID: xxxx
API String ID: 1177339427-1813341303
Opcode ID: cc53c8e5df5110962256a560091cd936376db5225e5abca9e0302b8971e7620c
Instruction ID: 3f96c15af3a6c051da32f233a6342630f68ce29168c689cfbe65f6df213675c8
Opcode Fuzzy Hash: cc53c8e5df5110962256a560091cd936376db5225e5abca9e0302b8971e7620c
Instruction Fuzzy Hash: 1F51AF31B18E5AC5EB508F92E8607A963A5EB85FA8F540136DA1C47BD0CF3DD985C700

Function 00007FFD6565ED40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

RoInitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD6565EDF2
EnumDisplayMonitors.USER32 ref: 00007FFD6565EEA2
RoUninitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FFD6565EEB2

Strings

TaskbarAl, xrefs: 00007FFD6565ED9E
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00007FFD6565EDB5

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: DisplayEnumInitializeMonitorsUninitialize
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$TaskbarAl
API String ID: 3377822461-945323219
Opcode ID: 478e00b8775ee4d72d0e0fe872277ce1c2615b7ab29c70126ad11a32c3cf8a0d
Instruction ID: 9e53b1fe2a2d9991863fc37513aed4ae066e25c3437e3efa86b763317db87f71
Opcode Fuzzy Hash: 478e00b8775ee4d72d0e0fe872277ce1c2615b7ab29c70126ad11a32c3cf8a0d
Instruction Fuzzy Hash: 44417136B18F46C6EB508F94E4A436AB3A1FF84B54F540139E68E47694CF7CE885CB40

Function 00007FFD6566B300 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 00007FFD6566B397
RegCreateKeyExW.ADVAPI32 ref: 00007FFD6566B42A
RegCreateKeyExW.ADVAPI32 ref: 00007FFD6566B48E

Part of subcall function 00007FFD656A7DF4: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7E11

Strings

Software\Classes\CLSID\{2cc5ca98-6485-489a-920e-b3e88a6ccce3}, xrefs: 00007FFD6566B337
ShellFolder, xrefs: 00007FFD6566B3C9

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Create$_invalid_parameter_noinfo
String ID: ShellFolder$Software\Classes\CLSID\{2cc5ca98-6485-489a-920e-b3e88a6ccce3}
API String ID: 219255893-1186126643
Opcode ID: 160c85a51d7c2f97c26d74edd1f3fccc5c3839cbffdbea94e1dd0d9b430a8246
Instruction ID: 5f3a6a61792854c71bc754fe2a01845f05542ba1655ffa164f7333c518b2142f
Opcode Fuzzy Hash: 160c85a51d7c2f97c26d74edd1f3fccc5c3839cbffdbea94e1dd0d9b430a8246
Instruction Fuzzy Hash: 6441E936B18B85C6DB60CF56E45076AB3A5FB88B94F444235EA8D83B69DF3CD094CB00

Function 00007FFD65672140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69comserviceCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD6565E15D), ref: 00007FFD6567217F
IUnknown_QueryService.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD6565E15D), ref: 00007FFD656721AA
WindowsCreateStringReference.API-MS-WIN-CORE-WINRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD6565E15D), ref: 00007FFD656721D6
WindowsDeleteString.API-MS-WIN-CORE-WINRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFD6565E15D), ref: 00007FFD6567223D

Strings

Windows.Internal.ShellExperience.ControlCenter, xrefs: 00007FFD656721CF

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CreateStringWindows$DeleteInstanceQueryReferenceServiceUnknown_
String ID: Windows.Internal.ShellExperience.ControlCenter
API String ID: 3704749038-1077972374
Opcode ID: 647ffeee28e4ad72aba8ac356ef0e6df38d2e9cd0da0b1fa311292e12554823d
Instruction ID: 2214ece7f7c73c7b94171470b99f04f9d49cbbd2d30eb35b647c86d91441e6b5
Opcode Fuzzy Hash: 647ffeee28e4ad72aba8ac356ef0e6df38d2e9cd0da0b1fa311292e12554823d
Instruction Fuzzy Hash: 3631E766719E4AC2EB40CFA5E46026AB370FB88F80F544432EA8E47B24CF7DD489C700

Function 00007FFD65660DB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32 ref: 00007FFD65660DE7
GetMenuItemInfoW.USER32 ref: 00007FFD65660E20
SetMenuItemInfoW.USER32 ref: 00007FFD65660E4C

Strings

P, xrefs: 00007FFD65660E05
[ROD]: Level %d Position %d/%d Status %d, xrefs: 00007FFD65660E55

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ItemMenu$Info$Count
String ID: P$[ROD]: Level %d Position %d/%d Status %d
API String ID: 4286743509-735391699
Opcode ID: f987482cfbea4847a29c21928f707ae859c3977e92baad314a07106812621335
Instruction ID: e705a8977972d860a88e56edfbad323c191d2780194529e99cabaee6779e0444
Opcode Fuzzy Hash: f987482cfbea4847a29c21928f707ae859c3977e92baad314a07106812621335
Instruction Fuzzy Hash: C9218071B18A46C6EB508F66E4A076A77A0FB89FD4F404034EA8E87745DF3DE485CB40

Function 00007FFD6565F170 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FFD6565F190
K32GetModuleInformation.KERNEL32 ref: 00007FFD6565F1A7
VirtualProtect.KERNEL32 ref: 00007FFD6565F1F5
VirtualProtect.KERNEL32 ref: 00007FFD6565F214

Strings

x?xx?x?x????xxx, xrefs: 00007FFD6565F1B5

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ProtectVirtual$CurrentInformationModuleProcess
String ID: x?xx?x?x????xxx
API String ID: 2643150895-841012870
Opcode ID: 0bd666689177ef10576290b0ee6228079ccc92fb039e1f91643e8c0ba8999389
Instruction ID: 93a4817021729b0838be0b38008edce35dbda44c800f03bc9c48ef77a80ebfe0
Opcode Fuzzy Hash: 0bd666689177ef10576290b0ee6228079ccc92fb039e1f91643e8c0ba8999389
Instruction Fuzzy Hash: 76118F65B58A4AC1FB609FA1E4247A67760EB88F94F844031EA4E07795DE3DE1C5CB00

Function 00007FFD656A8778 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FFD656A879D
GetProcAddress.KERNEL32 ref: 00007FFD656A87B3
FreeLibrary.KERNEL32 ref: 00007FFD656A87DA

Strings

CorExitProcess, xrefs: 00007FFD656A87AC
mscoree.dll, xrefs: 00007FFD656A8794

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: cab22331426e636fbbe918391b0261f4ead487ada66e5c9c54806ba359c7b5ed
Instruction ID: 99134855cb50b251520cf7452924b2522ff832c02f168665061f5a1d052c484d
Opcode Fuzzy Hash: cab22331426e636fbbe918391b0261f4ead487ada66e5c9c54806ba359c7b5ed
Instruction Fuzzy Hash: A7F0CD21B08E0AC2EF148BA0E86437A2370EF89FA1F500235CA6E4A6F4DF2DD0D4C700

Function 00007FFD6569AE34 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FFD6569AF57
__AdjustPointer.LIBCMT ref: 00007FFD6569AFA2

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: dbfc47f3c3864c2e196648dc36e94fb640cbc95c6c031ea35a22b63f29b1c6fd
Instruction ID: 7e8a31fde9b5101b5bb6c3e9250c8d74c991a829f552a75b767ab94e1dec8118
Opcode Fuzzy Hash: dbfc47f3c3864c2e196648dc36e94fb640cbc95c6c031ea35a22b63f29b1c6fd
Instruction Fuzzy Hash: 85B19F22F0EE4BC1EA659B95D5A0339A3D0EF66F84F098539DA5D077A5DE2CE4C2D300

Function 00007FFD656807E0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD6567C0B0: GetProcessHeap.KERNEL32 ref: 00007FFD6567C0C4
Part of subcall function 00007FFD6567C0B0: HeapAlloc.KERNEL32 ref: 00007FFD6567C0D5
Part of subcall function 00007FFD6567C0B0: GetModuleHandleW.KERNEL32 ref: 00007FFD6567C0F9
Part of subcall function 00007FFD6567C0B0: GetProcAddress.KERNEL32 ref: 00007FFD6567C10E

CloseHandle.KERNEL32 ref: 00007FFD65680926
CloseHandle.KERNEL32 ref: 00007FFD6568093D
GetProcessHeap.KERNEL32 ref: 00007FFD65680951
HeapFree.KERNEL32 ref: 00007FFD6568095F

Part of subcall function 00007FFD6567C430: ReleaseMutex.KERNEL32 ref: 00007FFD6567C45C

Part of subcall function 00007FFD6567C430: CreateSemaphoreExW.KERNEL32 ref: 00007FFD6567C5C0

Strings

wil, xrefs: 00007FFD65680839, 00007FFD65680884

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Heap$Handle$CloseProcess$AddressAllocCreateFreeModuleMutexProcReleaseSemaphore
String ID: wil
API String ID: 3215620834-1589926490
Opcode ID: a29d3fe7bb71c2c65fe5e28e0561425ce3c6b24ace175b7d8d8cc9ed5e2b8374
Instruction ID: 7d2a381c36c5f024f4bdac9251c65d00aca52d90f01e62c86255e5e9dec3b7f1
Opcode Fuzzy Hash: a29d3fe7bb71c2c65fe5e28e0561425ce3c6b24ace175b7d8d8cc9ed5e2b8374
Instruction Fuzzy Hash: C051A122B19B86C6EB208F61D56037A63A0FB98B94F045635DE8D43B55EF3CE0E0C700

Function 00007FFD65652D20 Relevance: 7.6, APIs: 5, Instructions: 73windowtimeCOMMON

Download Yara Rule

APIs

GetShellWindow.USER32 ref: 00007FFD65652D39
SendMessageTimeoutW.USER32 ref: 00007FFD65652D98
SendMessageTimeoutW.USER32 ref: 00007FFD65652DD7
SendMessageTimeoutW.USER32 ref: 00007FFD65652E09
SendMessageTimeoutW.USER32 ref: 00007FFD65652E33

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: MessageSendTimeout$ShellWindow
String ID:
API String ID: 1795729329-0
Opcode ID: 8cb80d24ea8f3896bc2fb9eb5dbe75fbf6513dd04a35cf45ae4084f419bbd67d
Instruction ID: aecbeb6bf571502be8641038a284e387796b76f82de0ffc83580183df6491fe1
Opcode Fuzzy Hash: 8cb80d24ea8f3896bc2fb9eb5dbe75fbf6513dd04a35cf45ae4084f419bbd67d
Instruction Fuzzy Hash: E2312832618B8583E7608B54F85071EB6A5FB89B74F541335E6AD46AE8CF7CD581CB00

Function 00007FFD656647E0 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

TryEnterCriticalSection.KERNEL32 ref: 00007FFD65664806
LeaveCriticalSection.KERNEL32 ref: 00007FFD6566486A
MulDiv.KERNEL32 ref: 00007FFD656648A5
LeaveCriticalSection.KERNEL32 ref: 00007FFD656648B8
LeaveCriticalSection.KERNEL32 ref: 00007FFD656648DB

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: d3125fde60b9e8771b2d5ec27363712c6d896e149078600850c9f6d35f10f85b
Instruction ID: 4eb34fdaf202a0aeafdd26d7265a4d16bb8132464c48fd1db8ec042ecc7b113f
Opcode Fuzzy Hash: d3125fde60b9e8771b2d5ec27363712c6d896e149078600850c9f6d35f10f85b
Instruction Fuzzy Hash: DE314025F1CE4AC2EB948F96E8F433567A1EB84F45F040039DA8D476A4DEADE8C4C741

Function 00007FFD656B96D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FFD656B9700
_set_statfp.LIBCMT ref: 00007FFD656B971B
_set_statfp.LIBCMT ref: 00007FFD656B9737
_set_statfp.LIBCMT ref: 00007FFD656B9773

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: f1fef38eed7822132c65c0d5b3f8fd80fb17575c8d7dc87da3932b33c48f2150
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 18114F36F6CE0F81FE5419A4D5763752284AF79B6CE148634EA6E063D6CE2CA8E1C204

Function 00007FFD656B02C0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FFD656ABA17,?,?,00000000,00007FFD656ABCB2,?,?,?,?,?,00007FFD656ABC3E), ref: 00007FFD656B02DF
FlsSetValue.KERNEL32(?,?,?,00007FFD656ABA17,?,?,00000000,00007FFD656ABCB2,?,?,?,?,?,00007FFD656ABC3E), ref: 00007FFD656B02FE
FlsSetValue.KERNEL32(?,?,?,00007FFD656ABA17,?,?,00000000,00007FFD656ABCB2,?,?,?,?,?,00007FFD656ABC3E), ref: 00007FFD656B0326
FlsSetValue.KERNEL32(?,?,?,00007FFD656ABA17,?,?,00000000,00007FFD656ABCB2,?,?,?,?,?,00007FFD656ABC3E), ref: 00007FFD656B0337
FlsSetValue.KERNEL32(?,?,?,00007FFD656ABA17,?,?,00000000,00007FFD656ABCB2,?,?,?,?,?,00007FFD656ABC3E), ref: 00007FFD656B0348

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: aaf86403c34e9556f308d35539dd04d29e1e9eae5800eb4d06ec95bafccd7f27
Instruction ID: 5f3f95c133a4b99e08f7deacab9f44db57cd764befb63f25f53e39f765283988
Opcode Fuzzy Hash: aaf86403c34e9556f308d35539dd04d29e1e9eae5800eb4d06ec95bafccd7f27
Instruction Fuzzy Hash: 21111A60F0DE4AC2FB5893A6E6A537965926F44FB0F084734EC2D066D6DE3DA4D2C600

Function 00007FFD656B0154 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FFD656B0165
FlsSetValue.KERNEL32 ref: 00007FFD656B0184
FlsSetValue.KERNEL32 ref: 00007FFD656B01AC
FlsSetValue.KERNEL32 ref: 00007FFD656B01BD
FlsSetValue.KERNEL32 ref: 00007FFD656B01CE

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 69fcf99ce4a02013613f39e3c2fe04a609e869aab94c3d15a8f7eb1b780ce5d5
Instruction ID: b7fc8340c738f4b566218b13bdcaca1035bfb11acf8244231cc1d33cfd3138c7
Opcode Fuzzy Hash: 69fcf99ce4a02013613f39e3c2fe04a609e869aab94c3d15a8f7eb1b780ce5d5
Instruction Fuzzy Hash: A911F564F09A4EC1FA5DA2E5D9723B921565F45BB0E184B34DC2E0A2C2DD2DB4D1C200

Function 00007FFD65671FD0 Relevance: 7.5, APIs: 5, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD65671F40: FindWindowExW.USER32 ref: 00007FFD65671F59
Part of subcall function 00007FFD65671F40: FindWindowExW.USER32 ref: 00007FFD65671F77
Part of subcall function 00007FFD65671F40: FindWindowExW.USER32 ref: 00007FFD65671FAD

GetParent.USER32 ref: 00007FFD65671FEA
SendMessageW.USER32 ref: 00007FFD65672009
SendMessageW.USER32 ref: 00007FFD65672021
SendMessageW.USER32 ref: 00007FFD65672038
SendMessageW.USER32 ref: 00007FFD65672053

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: MessageSend$FindWindow$Parent
String ID:
API String ID: 2087735068-0
Opcode ID: f9ebecd665a18c49aa767cb12b92951465b36a616f935c5b42ecfedfb94529a4
Instruction ID: 1ac23e3dfd7936605255db501f43a8bd94baf2c6cbb278e099271fffb144c616
Opcode Fuzzy Hash: f9ebecd665a18c49aa767cb12b92951465b36a616f935c5b42ecfedfb94529a4
Instruction Fuzzy Hash: 29012DA0B09A47C2FF685BA2FC60B6616A0AF89F85F081035CE0E0BB95DE3DD1D1C704

Function 00007FFD65651592 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 31COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FFD656515FD

Strings

Here is the stack trace:, xrefs: 00007FFD65651611
THIS IS NOT A BUG, A DELIBERATE STACK TRACE REQUEST HAS BEEN MADE, xrefs: 00007FFD65651592
Description: %s, xrefs: 00007FFD656515EA
====================================, xrefs: 00007FFD65651622

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: FreeLocal
String ID: ====================================$Description: %s$Here is the stack trace:$THIS IS NOT A BUG, A DELIBERATE STACK TRACE REQUEST HAS BEEN MADE
API String ID: 2826327444-1300954401
Opcode ID: 9935de65d3387abca4e96d201960c607a2d8a9e80ce1cc01ad4143c0e6beef0b
Instruction ID: b1522cc528f07dbd6cefbd771b1e1e707180943942ab9aec4700bd60a1d9c14b
Opcode Fuzzy Hash: 9935de65d3387abca4e96d201960c607a2d8a9e80ce1cc01ad4143c0e6beef0b
Instruction Fuzzy Hash: 4E01BB21F4CD4BD1FA54EBA5E4313B96260AF95F80F880131EA4E47296EF2DE9C5C700

Function 00007FFD65651582 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 31COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FFD656515FD

Strings

Here is the stack trace:, xrefs: 00007FFD65651611
Description: %s, xrefs: 00007FFD656515EA
One or more of the parameters supplied is invalid, xrefs: 00007FFD65651582
====================================, xrefs: 00007FFD65651622

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: FreeLocal
String ID: ====================================$Description: %s$Here is the stack trace:$One or more of the parameters supplied is invalid
API String ID: 2826327444-753373920
Opcode ID: 9acb2dae790181f818bbe4b672f8462fddb5c2b354fd1e3e1433d059da9829e7
Instruction ID: 014e87a4ad9d226bf4b9857d72b43bb4181e8ff9ec353c99e3a77f41ae96e001
Opcode Fuzzy Hash: 9acb2dae790181f818bbe4b672f8462fddb5c2b354fd1e3e1433d059da9829e7
Instruction Fuzzy Hash: B401A821F48D4BD1FA14EBA5E4353B96260AF91F80F880131EA4E46296EE3DE9C4C600

Function 00007FFD65651570 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 31COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FFD656515FD

Strings

The requested procedure was not found, xrefs: 00007FFD65651570
Here is the stack trace:, xrefs: 00007FFD65651611
Description: %s, xrefs: 00007FFD656515EA
====================================, xrefs: 00007FFD65651622

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: FreeLocal
String ID: ====================================$Description: %s$Here is the stack trace:$The requested procedure was not found
API String ID: 2826327444-1242647813
Opcode ID: 8d32ed0a3010ef7037d5ca19a3624a73681774dc3c4a1e7fb654fad612395195
Instruction ID: 904ffab99c3a330727f782daf6b081a7b707d8b2abae1b97d5977ffbebf81d90
Opcode Fuzzy Hash: 8d32ed0a3010ef7037d5ca19a3624a73681774dc3c4a1e7fb654fad612395195
Instruction Fuzzy Hash: 4601A821F48D4BD2FA14EBA5E4353B96260AF91F80F890131EA4E47296EE2DE9C4C610

Function 00007FFD65651579 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 31COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FFD656515FD

Strings

Here is the stack trace:, xrefs: 00007FFD65651611
Unable to set the requested DPI awareness context, xrefs: 00007FFD65651579
Description: %s, xrefs: 00007FFD656515EA
====================================, xrefs: 00007FFD65651622

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: FreeLocal
String ID: ====================================$Description: %s$Here is the stack trace:$Unable to set the requested DPI awareness context
API String ID: 2826327444-4207243742
Opcode ID: 70fb9272e445c90bc8f8d3190402ae1bc4de90be4858217cc58789e4e0655a68
Instruction ID: 6a329d57bbe6647b73ec3ddebdd1dc677f3b883c64f17f4ab6cafbb0d0ae93ff
Opcode Fuzzy Hash: 70fb9272e445c90bc8f8d3190402ae1bc4de90be4858217cc58789e4e0655a68
Instruction Fuzzy Hash: F601A821F49D4BD1FA54EBA5E4313B96260AF95F80F880131EA4E46296EE2DE9C4C600

Function 00007FFD6565155E Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 31COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FFD656515FD

Strings

Here is the stack trace:, xrefs: 00007FFD65651611
Description: %s, xrefs: 00007FFD656515EA
Functionality is not initialized, xrefs: 00007FFD6565155E
====================================, xrefs: 00007FFD65651622

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: FreeLocal
String ID: ====================================$Description: %s$Functionality is not initialized$Here is the stack trace:
API String ID: 2826327444-176991105
Opcode ID: 2dc4ebf9e699fa44fb34d3104885ac7ef17f76a3c241014000f06cd076083ec6
Instruction ID: 4a8b22573d43c60b7f1451ee8eae58e7314a31dc1227fbf88d5814d0c49b63a1
Opcode Fuzzy Hash: 2dc4ebf9e699fa44fb34d3104885ac7ef17f76a3c241014000f06cd076083ec6
Instruction Fuzzy Hash: DA01A821F48D4BD2FA14EBA5E4353B96260AF91F90F880131EA4E47296EE2DE9C5C610

Function 00007FFD65651567 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 31COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FFD656515FD

Strings

Here is the stack trace:, xrefs: 00007FFD65651611
The requested library is not available, xrefs: 00007FFD65651567
Description: %s, xrefs: 00007FFD656515EA
====================================, xrefs: 00007FFD65651622

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: FreeLocal
String ID: ====================================$Description: %s$Here is the stack trace:$The requested library is not available
API String ID: 2826327444-2487367941
Opcode ID: bf4a10bf6ebd6902b0d26f8649040d593c8226f065061233dff5b9b408b5c68b
Instruction ID: 9f96b80360c9ad073f019aa4d525a793ad54185c6ba500d4fa76712136d70bd9
Opcode Fuzzy Hash: bf4a10bf6ebd6902b0d26f8649040d593c8226f065061233dff5b9b408b5c68b
Instruction Fuzzy Hash: 4801BB21F4CD4BD2FA54EBA5E4313B96260AF91F80F880131EA4E47296EF2DE9C4C700

Function 00007FFD65651555 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 31COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FFD656515FD

Strings

Insufficient memory. Please close some applications and try again, xrefs: 00007FFD65651555
Here is the stack trace:, xrefs: 00007FFD65651611
Description: %s, xrefs: 00007FFD656515EA
====================================, xrefs: 00007FFD65651622

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: FreeLocal
String ID: ====================================$Description: %s$Here is the stack trace:$Insufficient memory. Please close some applications and try again
API String ID: 2826327444-3218687599
Opcode ID: ce7f46ac78bc5d69090b6eefcc8d9dab21bcf7cd960718e50db7847a484f3db0
Instruction ID: 549b574b477cab2c089d38c437118e3cc164c1900e7f616c8f6739b500161bf1
Opcode Fuzzy Hash: ce7f46ac78bc5d69090b6eefcc8d9dab21bcf7cd960718e50db7847a484f3db0
Instruction Fuzzy Hash: 4901A821F48D4BD2FA54EBA5E4313B96260AF91F80F880131EA4E46296EE2DE9D4C600

Function 00007FFD65651549 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 31COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FFD656515FD

Strings

A generic error has occured, xrefs: 00007FFD65651549
Here is the stack trace:, xrefs: 00007FFD65651611
Description: %s, xrefs: 00007FFD656515EA
====================================, xrefs: 00007FFD65651622

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: FreeLocal
String ID: ====================================$A generic error has occured$Description: %s$Here is the stack trace:
API String ID: 2826327444-2479978688
Opcode ID: e7cbb35f1ef09930126593368c0f15811d1152c054dc7665b9eede55fb0842f7
Instruction ID: b9c895f17ad5050ddb606f45968b82bae38f20d0bf57f0686cc2fa2600f114af
Opcode Fuzzy Hash: e7cbb35f1ef09930126593368c0f15811d1152c054dc7665b9eede55fb0842f7
Instruction Fuzzy Hash: 2D01A821F48D4BD2FA54EBA5E4313B96260AF91F80F880131EA4E46296EE2DE9D4C600

Function 00007FFD656AA664 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD656AA943

Part of subcall function 00007FFD656ABFF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656AC00D

Strings

UTF-8, xrefs: 00007FFD656AA8C2
ccs, xrefs: 00007FFD656AA87E
UTF-16LEUNICODE, xrefs: 00007FFD656AA8E1

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 039c3f1fe8e93366c3df745e1d82cca0f290aaad0d53f647cbcc453f401cfce4
Instruction ID: e12e78933667b67f2833aa6ce3bb0c979847ca0a277ca0c1b7588330deaee165
Opcode Fuzzy Hash: 039c3f1fe8e93366c3df745e1d82cca0f290aaad0d53f647cbcc453f401cfce4
Instruction Fuzzy Hash: 9481AD76F08A4AC9FAA54FA5C17037D36A0EF11F48F558036CA4A57294DB2FE8C2D702

Function 00007FFD656AA3A0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD656AA649

Part of subcall function 00007FFD656B285C: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656B2879

Strings

UTF-16LEUNICODE, xrefs: 00007FFD656AA5ED
UTF-8, xrefs: 00007FFD656AA5CC
ccs, xrefs: 00007FFD656AA595

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: f6940c8d1d933eeda2c201bf02cfe38d995b17d80780a40a957b7f878ce835ce
Instruction ID: d5d9be1547445ca6b4a6f1a9113f17b37a79d011fe15e27654fb32dbfb4d8ff6
Opcode Fuzzy Hash: f6940c8d1d933eeda2c201bf02cfe38d995b17d80780a40a957b7f878ce835ce
Instruction Fuzzy Hash: 9B81A032F0CA4ACAF7A54EA8C2743783AD19F16F48F549037DA0E46695CE1FA8C2D705

Function 00007FFD6569C1A8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FFD6569C218
_CallSETranslator.LIBVCRUNTIME ref: 00007FFD6569C263

Strings

RCC, xrefs: 00007FFD6569C234
MOC, xrefs: 00007FFD6569C22C

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: edec2ee3303cf4d55f6f5952e775069c69c5d6bae5956a51bbbd40814079c7eb
Instruction ID: 6f9a4ab46b9eac92049c3f5b481ce78167587d441c31a258ca0b33644d741fac
Opcode Fuzzy Hash: edec2ee3303cf4d55f6f5952e775069c69c5d6bae5956a51bbbd40814079c7eb
Instruction Fuzzy Hash: 24918073B08B8ACAE710CBA5D8503AD7BA0F756B88F144126EA8D57B55DF38D195C700

Function 00007FFD6569A6E4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFD6569A70F
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FFD6569A7A6
RtlUnwindEx.KERNEL32 ref: 00007FFD6569A800

Strings

csm, xrefs: 00007FFD6569A78D

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 6a18b9169671f8b03adf3f6befaec6df78fd3a8f22c2917404d2314da2dd3802
Instruction ID: 303712fc11ad2fc662fad4771e9d554846f427ec2b714a6333b29547e87771c7
Opcode Fuzzy Hash: 6a18b9169671f8b03adf3f6befaec6df78fd3a8f22c2917404d2314da2dd3802
Instruction Fuzzy Hash: 3E519E22F19A0BCAEB548B55D564BB873E1EB65F88F118131DA5A47788DF7CE882C700

Function 00007FFD6569C728 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFD6569C750
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFD6569C838

Strings

csm, xrefs: 00007FFD6569C88A
csm, xrefs: 00007FFD6569C772

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 77f46826cfc93509138ec7aa49e68eedde8716a4db2b7bd8a706ca1eb4480f8e
Instruction ID: 53964d68b4469e168899a4b2087fe715ba5ab36fa95777a66396e8ad11441655
Opcode Fuzzy Hash: 77f46826cfc93509138ec7aa49e68eedde8716a4db2b7bd8a706ca1eb4480f8e
Instruction Fuzzy Hash: 61517F32A08A8BCAFB648FA5D16436877A0EB66F94F144135DA9E47B85CF38E491C700

Function 00007FFD656BB3A9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FFD656BB3F7
SysFreeString.OLEAUT32 ref: 00007FFD656BB4A4

Part of subcall function 00007FFD6567A7B0: GetProcessHeap.KERNEL32(?,?,?,?,?,?,00000000,00007FFD6567B0AF,?,?,?,?,?,00000000,?,00007FFD6567B8AB), ref: 00007FFD6567A7D3

MultiByteToWideChar.KERNEL32 ref: 00007FFD656BB435

Part of subcall function 00007FFD6567FD70: GetProcessHeap.KERNEL32 ref: 00007FFD6567FD94
Part of subcall function 00007FFD6567FD70: HeapFree.KERNEL32 ref: 00007FFD6567FDA1

Strings

W, xrefs: 00007FFD656BB45E

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Heap$ByteCharFreeMultiProcessWide$String
String ID: W
API String ID: 3011908892-655174618
Opcode ID: 2d82b6daf02fe6883948aa1862e9b50e33fa8ed948814a6d9db24e1fdb96eef3
Instruction ID: 572c14eec6f233de3a904c056e775714747ff5c6ccf593c77ac3b010bdb78050
Opcode Fuzzy Hash: 2d82b6daf02fe6883948aa1862e9b50e33fa8ed948814a6d9db24e1fdb96eef3
Instruction Fuzzy Hash: A5318122704E4ACAE710DFA2D8607A96791FB84BE8F144238EA5D47BE9DF78C581C340

Function 00007FFD6565E760 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24windowregistryCOMMON

Download Yara Rule

APIs

GetClassWord.USER32 ref: 00007FFD6565E77A
RegisterWindowMessageW.USER32 ref: 00007FFD6565E78A
PostMessageW.USER32 ref: 00007FFD6565E7A2

Strings

WorkerW, xrefs: 00007FFD6565E780

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Message$ClassPostRegisterWindowWord
String ID: WorkerW
API String ID: 18795929-1267966093
Opcode ID: bfad77c09892389c4485814dd7a8db84c2d6af64fb75877e7e8f6b2b871da546
Instruction ID: def13cf142325f48712c802c92a9a1a1cb47a0f1c8663c68b9e0689007f8d3bd
Opcode Fuzzy Hash: bfad77c09892389c4485814dd7a8db84c2d6af64fb75877e7e8f6b2b871da546
Instruction Fuzzy Hash: 72F03720B08E9AC2FB4447A2F95477A6660EB84FD4F544131ED5E47B98CF2CD5D1C700

Function 00007FFD65652CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

FindWindowExW.USER32 ref: 00007FFD65652CDC
FindWindowExW.USER32 ref: 00007FFD65652CF6

Strings

WorkerW, xrefs: 00007FFD65652CEA
SHELLDLL_DefView, xrefs: 00007FFD65652CCD

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: FindWindow
String ID: SHELLDLL_DefView$WorkerW
API String ID: 134000473-2583568628
Opcode ID: a02ce4a47e3722e1ce5a4372299e297887f462741f6c8008b449c0fe13cb0ebb
Instruction ID: db58da049894204b21a16a118000a4a8fee56f719144e001cc69e1dea88d2357
Opcode Fuzzy Hash: a02ce4a47e3722e1ce5a4372299e297887f462741f6c8008b449c0fe13cb0ebb
Instruction Fuzzy Hash: 8DE030A1B05F46C1FF695BE1FA64BA52361AF48F94F489035C90D06B54DE3CD4D4C300

Function 00007FFD65672D00 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FFD65672D1F
GetProcAddress.KERNEL32 ref: 00007FFD65672D2F

Strings

kernelbase.dll, xrefs: 00007FFD65672D15
RaiseFailFastException, xrefs: 00007FFD65672D28

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RaiseFailFastException$kernelbase.dll
API String ID: 1646373207-919018592
Opcode ID: 33f4f61da59ededdea6aefb74e35cd82206a814675d91858146eca4abc1f1d82
Instruction ID: 897455a387c6dd07823eda861e9280810139c54648818dab8693922b439a2582
Opcode Fuzzy Hash: 33f4f61da59ededdea6aefb74e35cd82206a814675d91858146eca4abc1f1d82
Instruction Fuzzy Hash: 48E06521B18B55C1EB548B52F9A02656360FF4CFC0B449535ED5D07B28CF3CD595C740

Function 00007FFD656B1608 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FFD656B1687
WriteFile.KERNEL32 ref: 00007FFD656B194F
WriteFile.KERNEL32 ref: 00007FFD656B1995
GetLastError.KERNEL32 ref: 00007FFD656B1A4B

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 52c33f0f4fc68b1f3c2a3842e8bed91f01aab6976232962e0bdb7bd8e8fc79e4
Instruction ID: d897243f90a81dd1441e9adf74c52ddda1f9f5e3166368f9a157c46f032f5e44
Opcode Fuzzy Hash: 52c33f0f4fc68b1f3c2a3842e8bed91f01aab6976232962e0bdb7bd8e8fc79e4
Instruction Fuzzy Hash: D1D1D172F18A89D9EB10CFA5D4602AC37B1FB44B98F048235CE5D97B99DE38E596C340

Function 00007FFD656B1FC8 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00007FFD656B1FB3), ref: 00007FFD656B20E4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00007FFD656B1FB3), ref: 00007FFD656B216F

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: af5d92c1cace1781b7f55f6834ddc705f2db52580a797490cce788124f166c46
Instruction ID: 425a60b03c242ef7a6071a366403334891abfca3760013df7877393d22bd99f0
Opcode Fuzzy Hash: af5d92c1cace1781b7f55f6834ddc705f2db52580a797490cce788124f166c46
Instruction Fuzzy Hash: 83919262B18A59C5FF618FA5D8A03BD2BE0AB45F88F544139DE0E67695CE38D4D2C700

Function 00007FFD6567CC90 Relevance: 6.2, APIs: 4, Instructions: 211memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,00000000), ref: 00007FFD6567CD8D
HeapFree.KERNEL32(?,?,?,00000000), ref: 00007FFD6567CD9B
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD6567CE92
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD6567CF06

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Heap_invalid_parameter_noinfo$FreeProcess
String ID:
API String ID: 3364316771-0
Opcode ID: 161acb2dc217c73e48788f21060d856e356ab8a03b65c34d3ecce736ef945018
Instruction ID: 45ab8161963439b45e1ba29f760733713a37bbe0d49631f480f1bb0f00702f5f
Opcode Fuzzy Hash: 161acb2dc217c73e48788f21060d856e356ab8a03b65c34d3ecce736ef945018
Instruction Fuzzy Hash: B0816966B09E8BC5FB558F95E6243796BA6FB04F94F188031CA1E07795CE3DE4A6C300

Function 00007FFD656620A0 Relevance: 6.1, APIs: 4, Instructions: 117windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD6565D750: QueryPerformanceFrequency.KERNEL32 ref: 00007FFD6565D768
Part of subcall function 00007FFD6565D750: QueryPerformanceCounter.KERNEL32 ref: 00007FFD6565D777

GetCursorPos.USER32 ref: 00007FFD6566210F
#410.COMCTL32 ref: 00007FFD656621CA
TrackPopupMenu.USER32 ref: 00007FFD656621F0
#412.COMCTL32 ref: 00007FFD6566221E

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: PerformanceQuery$#410#412CounterCursorFrequencyMenuPopupTrack
String ID:
API String ID: 2611046820-0
Opcode ID: d643d0bd10388fe8a0b7d2f11e0fabd89ccfb895c8e2f6bf83bf6eb96ad11376
Instruction ID: bed7c9680a06c4496ddd28602259c50d538dcd509cbbf1aab0394e4bb381c3ac
Opcode Fuzzy Hash: d643d0bd10388fe8a0b7d2f11e0fabd89ccfb895c8e2f6bf83bf6eb96ad11376
Instruction Fuzzy Hash: AB417376B0CA4AC6EB208B95E86076EA7A1FB85F90F500036DB4D57664CF3CE9C1CB41

Function 00007FFD65662270 Relevance: 6.1, APIs: 4, Instructions: 116windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFD6565D750: QueryPerformanceFrequency.KERNEL32 ref: 00007FFD6565D768
Part of subcall function 00007FFD6565D750: QueryPerformanceCounter.KERNEL32 ref: 00007FFD6565D777

GetCursorPos.USER32 ref: 00007FFD656622DB
#410.COMCTL32 ref: 00007FFD65662394
TrackPopupMenuEx.USER32 ref: 00007FFD656623B2
#412.COMCTL32 ref: 00007FFD656623E0

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: PerformanceQuery$#410#412CounterCursorFrequencyMenuPopupTrack
String ID:
API String ID: 2611046820-0
Opcode ID: 50d29e5d5d4cde36a68881f5cc577f9955b1ade5eb0b0abbcba982c4616bb6fa
Instruction ID: 56726e7f4ba1ef426bcc9c6a991b4d2381615daf03492f681d69af2b096de28e
Opcode Fuzzy Hash: 50d29e5d5d4cde36a68881f5cc577f9955b1ade5eb0b0abbcba982c4616bb6fa
Instruction Fuzzy Hash: 3C416C36F19A4AC6FB608B95E86176973A0FB85F84F500036E98E57654CF3CE9C1CB42

Function 00007FFD6567F790 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00007FFD6567F7B3
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FFD6567F7CA
AcquireSRWLockExclusive.KERNEL32 ref: 00007FFD6567F845
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FFD6567F86E

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID:
API String ID: 17069307-0
Opcode ID: 06dff6111a6ab23d7a8e5ebc3c04aa834feb7d5774efce5f54b4225c2b0d95b7
Instruction ID: 4957897367a36b0032f81e468c96e266f2261dc498c96986b64b1576effc692e
Opcode Fuzzy Hash: 06dff6111a6ab23d7a8e5ebc3c04aa834feb7d5774efce5f54b4225c2b0d95b7
Instruction Fuzzy Hash: DB217F22718B8AC1EB50DB61E5603ADA3A4FB88F84F584531EA8D83B59DF3CD591C700

Function 00007FFD65691CF8 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFD65691D24
GetCurrentThreadId.KERNEL32 ref: 00007FFD65691D32
GetCurrentProcessId.KERNEL32 ref: 00007FFD65691D3E
QueryPerformanceCounter.KERNEL32 ref: 00007FFD65691D4E

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: eaa7e7bcf4fe3d42ae821e93649fc0302fd8afae25b3f1e7eaa4f26d506a1ee0
Instruction ID: 9eb01b75d5a65b9e1ccf308927224c58c940a835b7d293669b5618d579b01977
Opcode Fuzzy Hash: eaa7e7bcf4fe3d42ae821e93649fc0302fd8afae25b3f1e7eaa4f26d506a1ee0
Instruction Fuzzy Hash: 93111C26B15F05CAEB008FA0E8643B833B4F759B58F441A31DA6D467A4DF7CD1A4C340

Function 00007FFD6565158B Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FFD656515FD

Strings

Here is the stack trace:, xrefs: 00007FFD65651611
Description: %s, xrefs: 00007FFD656515EA
====================================, xrefs: 00007FFD65651622

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: FreeLocal
String ID: ====================================$Description: %s$Here is the stack trace:
API String ID: 2826327444-530566993
Opcode ID: f966af5b68ddf13da20e8f214a40d4c55b932213de1f3d731b12c39048192202
Instruction ID: bd4b7fa3745ac30b9052609cf91fc3187543cd1277d8480796c273f2705d8bf1
Opcode Fuzzy Hash: f966af5b68ddf13da20e8f214a40d4c55b932213de1f3d731b12c39048192202
Instruction Fuzzy Hash: 68F0C221F4CE4BC1FA54EB95E4313B96250AF55F40F480131EA8E47296EE2DE9C4C710

Function 00007FFD6569CF9C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFD6569D046
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FFD6569D06F

Strings

csm, xrefs: 00007FFD6569D16F

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 13fd3154715085dd0f014c0e559fa7e9ca83d2e20f6c5694adf46d1fc6ce1f7f
Instruction ID: 0f79ac15e9d9069a3b1af036f2044572a434bbc3b0c6eb9d624aaa9cd5500eae
Opcode Fuzzy Hash: 13fd3154715085dd0f014c0e559fa7e9ca83d2e20f6c5694adf46d1fc6ce1f7f
Instruction Fuzzy Hash: E5512B32B19B4AC6E620AB65E55036E77F4FB9ABA0F140135EB8D07B55CF38E491CB01

Function 00007FFD656B1CA0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FFD656B1DB7
GetLastError.KERNEL32 ref: 00007FFD656B1DD9

Strings

U, xrefs: 00007FFD656B1D63

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4ef2fec41d66e7b0c39bf9e201830508b86a8f97eaffa894a0546182e11c999c
Instruction ID: cc70c244dcc22d9730009962ec265cec2334954575877bb9ad02418d731ec773
Opcode Fuzzy Hash: 4ef2fec41d66e7b0c39bf9e201830508b86a8f97eaffa894a0546182e11c999c
Instruction Fuzzy Hash: B241C332B18E45D2DF208FA5E4643A967A1FB98B94F504031EE4D87798EF3CD491CB40

Function 00007FFD6567B280 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

GetErrorInfo.OLEAUT32(?,?,?,?,?,?,00000000,00007FFD6567B0F7,?,?,?,?,?,00000000,?,00007FFD6567B8AB), ref: 00007FFD6567B2FF

Strings

RoOriginateLanguageException, xrefs: 00007FFD6567B2C1
combase.dll, xrefs: 00007FFD6567B2B2

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ErrorInfo
String ID: RoOriginateLanguageException$combase.dll
API String ID: 3619768924-3996158991
Opcode ID: e60ef14456e3047da3f2c892e6cd504dd856c1c0403d603dd25a02e37ffad9df
Instruction ID: 5f8673b0db0f8b3b2fe7517d7ddf5a2a06a34a701ac582e2bb381eaade6351d8
Opcode Fuzzy Hash: e60ef14456e3047da3f2c892e6cd504dd856c1c0403d603dd25a02e37ffad9df
Instruction Fuzzy Hash: F9315021B19F4AC1EE509F95E4A036A63A1FF88F94F885536E94E43765EF3CE581C700

Function 00007FFD656611D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FFD65661224

Strings

Shell_TrayWnd, xrefs: 00007FFD65661233
Shell_SecondaryTrayWnd, xrefs: 00007FFD6566127B

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ClassName
String ID: Shell_SecondaryTrayWnd$Shell_TrayWnd
API String ID: 1191326365-1433838494
Opcode ID: b22c615c0da057ef35e7aeab3f088705a148a953072d4d545ca362a7cbbeb7c8
Instruction ID: 89e1c6d63d29151aad72f7212524dfb85aa8037c149a8dfa4ba72786dc519e60
Opcode Fuzzy Hash: b22c615c0da057ef35e7aeab3f088705a148a953072d4d545ca362a7cbbeb7c8
Instruction Fuzzy Hash: 9D21C526B09949C2FBA49B96E4247B933A1FB99FA0F848132DD4E42694DF3CD4C5C701

Function 00007FFD656610B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FFD65661104

Strings

Shell_TrayWnd, xrefs: 00007FFD65661113
Shell_SecondaryTrayWnd, xrefs: 00007FFD6566115B

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ClassName
String ID: Shell_SecondaryTrayWnd$Shell_TrayWnd
API String ID: 1191326365-1433838494
Opcode ID: 6f5b0a9fa536abe2cebf4cef4adad2a9baaaccd021e20a6075825a4ab522f35a
Instruction ID: b59dbb82054428c29a92c06ac98038250628c34356b4fe8caa95aab1a380bd8e
Opcode Fuzzy Hash: 6f5b0a9fa536abe2cebf4cef4adad2a9baaaccd021e20a6075825a4ab522f35a
Instruction Fuzzy Hash: FA21F726B19949C2F7A49B95E8247B97361FB99FA0F848132DD4D02794DF3CD4C5C301

Function 00007FFD65660F90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FFD65660FE4

Strings

Shell_TrayWnd, xrefs: 00007FFD65660FF3
Shell_SecondaryTrayWnd, xrefs: 00007FFD6566103B

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ClassName
String ID: Shell_SecondaryTrayWnd$Shell_TrayWnd
API String ID: 1191326365-1433838494
Opcode ID: 7d690eed00541a1a3ff21cdf48d907f9b93627d4f5d46ef50a0d13f3d631b697
Instruction ID: 0f818e6eb682224f6ec77a4f23a4f1282a82a6ad7ea32195df96b4d688ca5715
Opcode Fuzzy Hash: 7d690eed00541a1a3ff21cdf48d907f9b93627d4f5d46ef50a0d13f3d631b697
Instruction Fuzzy Hash: 8D21D726B09989C2FA649B95E4247B93361FB99FA0F848132DD4E02794DF3CD4C5C301

Function 00007FFD6566B4B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32 ref: 00007FFD6566B560

Part of subcall function 00007FFD656A7DF4: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD656A7E11

SHFlushSFCache.SHELL32 ref: 00007FFD6566B527

Strings

Attributes, xrefs: 00007FFD6566B4F9

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: CacheFlushValue_invalid_parameter_noinfo
String ID: Attributes
API String ID: 3611136396-2126945696
Opcode ID: 61f8949d13c83116c11eca864c0a5fa46b1603fb9721b1164daadc07d62b2ca3
Instruction ID: c1e1d8bf6ebfcd819711d36879f90fe3f5d893763d35e43329dd30d163bb9474
Opcode Fuzzy Hash: 61f8949d13c83116c11eca864c0a5fa46b1603fb9721b1164daadc07d62b2ca3
Instruction Fuzzy Hash: AF115C36B09E89C6EB60DF55E86076677A0AB48F98F440035ED4D47B65EF3CE491CB00

Function 00007FFD65668590 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00007FFD65668624
VirtualProtect.KERNEL32 ref: 00007FFD65668664

Part of subcall function 00007FFD65652890: GetModuleHandleW.KERNEL32 ref: 00007FFD656528AF
Part of subcall function 00007FFD65652890: GetProcAddress.KERNEL32 ref: 00007FFD656528C8
Part of subcall function 00007FFD65652890: RegOpenKeyExW.KERNELBASE ref: 00007FFD6565293F
Part of subcall function 00007FFD65652890: RegQueryValueExW.KERNELBASE ref: 00007FFD6565296F

Strings

xx????xxx????xxxxx, xrefs: 00007FFD656685EB

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ProtectVirtual$AddressHandleModuleOpenProcQueryValue
String ID: xx????xxx????xxxxx
API String ID: 1029361184-12075917
Opcode ID: 84be14ec43e9f9d8511ac0f712018cbc1a22bb8046b369e59bee89df6206f83a
Instruction ID: f8f39e54f8d03d50bf856ebc05f9bf0d8b14234df70fd33c80910feea64dca9f
Opcode Fuzzy Hash: 84be14ec43e9f9d8511ac0f712018cbc1a22bb8046b369e59bee89df6206f83a
Instruction Fuzzy Hash: A4214A24F09E8AC6FB60DFA1E42576623A1BF96F48F444035D94D426A4DF3CE5C4CB02

Function 00007FFD6566FCB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FFD6566FD00
RegOpenKeyExW.ADVAPI32 ref: 00007FFD6566FD25

Strings

$start.tilegrid$windows.data.curatedtilecollection.tilecollection\Current, xrefs: 00007FFD6566FCCE

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Open
String ID: $start.tilegrid$windows.data.curatedtilecollection.tilecollection\Current
API String ID: 71445658-2485209836
Opcode ID: 31070c82b62bc71c7a479a78f4de297f3264b8cf6f54855808b177f40f462745
Instruction ID: adbe4ea92ef1ebb3cb911cb96d04ebb402d941494750503cfdc7a0ab005052c8
Opcode Fuzzy Hash: 31070c82b62bc71c7a479a78f4de297f3264b8cf6f54855808b177f40f462745
Instruction Fuzzy Hash: D8010526B18F89C1DB148B42F85012AB3A5FB89FC4F540125EE8D47B69DF3DE491CB00

Function 00007FFD6566D7F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32registrystringCOMMON

Download Yara Rule

APIs

RegGetValueW.ADVAPI32 ref: 00007FFD6566D823
lstrcmpW.KERNEL32 ref: 00007FFD6566D835

Strings

ReplaceVan, xrefs: 00007FFD6566D829

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Valuelstrcmp
String ID: ReplaceVan
API String ID: 372169353-130473729
Opcode ID: a9a3f3f434d355c5e894d57583558c5d7c681a3fa1c53be222b2ad6a79273646
Instruction ID: a1a8af065ad6205876ded68e5921f2cecb9cfaab41eda7c4da6d47ac000b4f48
Opcode Fuzzy Hash: a9a3f3f434d355c5e894d57583558c5d7c681a3fa1c53be222b2ad6a79273646
Instruction Fuzzy Hash: DAF0D632B08B85C2EB508B5AF44021AA7A4F788BD4F584125EB8D47B28DF7CD496CB04

Function 00007FFD6565F230 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27registryCOMMON

Download Yara Rule

APIs

RegGetValueW.ADVAPI32 ref: 00007FFD6565F287

Strings

XamlSounds, xrefs: 00007FFD6565F257
Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher, xrefs: 00007FFD6565F26A

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Value
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerPatcher$XamlSounds
API String ID: 3702945584-1822384862
Opcode ID: 2f85c276816b64db271d63056cae849b9d62bd88adbcb79f71df07118e0746e8
Instruction ID: d98282f908737604b48b7f1e62a099ebc16abaadb11998b1362a86ff50e4456e
Opcode Fuzzy Hash: 2f85c276816b64db271d63056cae849b9d62bd88adbcb79f71df07118e0746e8
Instruction Fuzzy Hash: 73F03C72618A45C6EB108F54F49429A73B4FB89B54FD0023AE79D06B58DF3DD595CB00

Function 00007FFD656902A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20windowCOMMON

Download Yara Rule

APIs

SHAppBarMessage.SHELL32 ref: 00007FFD656902C5
SHAppBarMessage.SHELL32 ref: 00007FFD656902ED

Strings

0, xrefs: 00007FFD656902B8

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Message
String ID: 0
API String ID: 2030045667-4108050209
Opcode ID: 011ec22fce94ba3ff84e82e6c18522a1931c76968a3f17c017fed1cbe9ec85c1
Instruction ID: 21e6ffc7a4397bc56f91b90a203407bc7a4ae2cb50fc97bf6c9d2dfa3aefbe32
Opcode Fuzzy Hash: 011ec22fce94ba3ff84e82e6c18522a1931c76968a3f17c017fed1cbe9ec85c1
Instruction Fuzzy Hash: 2DF01C71B18B46C2EB249B94F46532AB3B0FB89B58F900125D68D0A754DFBDD195CB00

Function 00007FFD6565F6B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FFD6565F6B6
GetModuleHandleW.KERNEL32 ref: 00007FFD6565F6CB

Part of subcall function 00007FFD6565F170: GetCurrentProcess.KERNEL32 ref: 00007FFD6565F190
Part of subcall function 00007FFD6565F170: K32GetModuleInformation.KERNEL32 ref: 00007FFD6565F1A7
Part of subcall function 00007FFD6565F170: VirtualProtect.KERNEL32 ref: 00007FFD6565F1F5
Part of subcall function 00007FFD6565F170: VirtualProtect.KERNEL32 ref: 00007FFD6565F214

Strings

Windows.UI.Xaml.dll, xrefs: 00007FFD6565F6C4

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: ModuleProtectVirtual$CurrentHandleInformationLibraryLoadProcess
String ID: Windows.UI.Xaml.dll
API String ID: 3223347177-2173645706
Opcode ID: 83c6e07b6ed7201ee886327af6e0a44253c6d043d4bfed3b76930e47fd0731fe
Instruction ID: 8ee10834175152093c76e517d024b9ed5e7580d4fafae5a00b4b65558c25e920
Opcode Fuzzy Hash: 83c6e07b6ed7201ee886327af6e0a44253c6d043d4bfed3b76930e47fd0731fe
Instruction Fuzzy Hash: BAD06251F5AE0EC1FE255791D87537551619F59F51B481034C91E0D3A1EE2CE4D5C610

Function 00007FFD6565E7C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14threadCOMMON

Download Yara Rule

APIs

FindWindowExW.USER32 ref: 00007FFD6565E7D2
GetWindowThreadProcessId.USER32 ref: 00007FFD6565E7DD

Strings

ApplicationManager_ImmersiveShellWindow, xrefs: 00007FFD6565E7C7

Memory Dump Source

Source File: 0000000C.00000002.11955328548.00007FFD65651000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFD65650000, based on PE: true

Associated: 0000000C.00000002.11955300961.00007FFD65650000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955389788.00007FFD656BD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955418560.00007FFD656EA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955439245.00007FFD656EB000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955462765.00007FFD656F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955489974.00007FFD656F2000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955507911.00007FFD656F8000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000C.00000002.11955527575.00007FFD656FB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffd65650000_explorer.jbxd

Similarity

API ID: Window$FindProcessThread
String ID: ApplicationManager_ImmersiveShellWindow
API String ID: 3928697162-213675812
Opcode ID: 785884996038eb07269ece9f2aac681ad31a3c997a130d15eced3052a72fa19b
Instruction ID: b0f63f2fa541404c19534632fd65684f97e9c8cf1fe9603530ff011aad8619f1
Opcode Fuzzy Hash: 785884996038eb07269ece9f2aac681ad31a3c997a130d15eced3052a72fa19b
Instruction Fuzzy Hash: BFD01265F09F06C2FB18ABB2E8607751672AB89B40F808435C80F06654DE3C91D5C300

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system. References to various COM objects are stored in the Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ep_setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll

C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll

C:\Program Files\ExplorerPatcher\StartUI\Assets\Fonts\BitMDL2.ttf

C:\Program Files\ExplorerPatcher\StartUI\Assets\Fonts\SkypeUISymbol-Regular.ttf

C:\Program Files\ExplorerPatcher\StartUI\Assets\officehub150x150.png

C:\Program Files\ExplorerPatcher\StartUI\Assets\officehub71x71.png

C:\Program Files\ExplorerPatcher\StartUI\Assets\onenote150x150.png

C:\Program Files\ExplorerPatcher\StartUI\Assets\onenote71x71.png

C:\Program Files\ExplorerPatcher\WebView2Loader.dll

C:\Program Files\ExplorerPatcher\Windows.UI.ShellCommon.pri

C:\Program Files\ExplorerPatcher\ep_dwm.exe

C:\Program Files\ExplorerPatcher\ep_gui.dll

C:\Program Files\ExplorerPatcher\ep_setup.exe

C:\Program Files\ExplorerPatcher\ep_setup.exe:Zone.Identifier

C:\Program Files\ExplorerPatcher\ep_taskbar.2.dll

C:\Program Files\ExplorerPatcher\ep_weather_host.dll

C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll

C:\Program Files\ExplorerPatcher\pris\Windows.UI.ShellCommon.en-US.pri

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ExplorerPatcher\Properties (ExplorerPatcher).lnk

Windows Analysis Report
ep_setup.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre