Edit tour

Windows Analysis Report
1wrLmYiC62.exe

Overview

General Information

Sample name:	1wrLmYiC62.exe renamed because original name is a hash value
Original sample name:	dd53ac67d905defd4bd1f2b9b413dfc679e7c076e92792be650c38659e1557c5.exe
Analysis ID:	1586714
MD5:	9c540950f5a8981844ff33bfc55d2f36
SHA1:	8c70f2bcb995ce313843cf7103c659c12eb263dc
SHA256:	dd53ac67d905defd4bd1f2b9b413dfc679e7c076e92792be650c38659e1557c5
Tags:	exeuser-crep1x
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Writes to foreign memory regions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w10x64

1wrLmYiC62.exe (PID: 5640 cmdline: "C:\Users\user\Desktop\1wrLmYiC62.exe" MD5: 9C540950F5A8981844FF33BFC55D2F36)

1wrLmYiC62.exe (PID: 5440 cmdline: "C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe" -burn.clean.room="C:\Users\user\Desktop\1wrLmYiC62.exe" -burn.filehandle.attached=512 -burn.filehandle.self=532 MD5: 9C540950F5A8981844FF33BFC55D2F36)

AdobeSync.exe (PID: 6504 cmdline: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe MD5: F778E9136AB0DB9DE9802A7043DE50A7)

AdobeSync.exe (PID: 4764 cmdline: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe MD5: F778E9136AB0DB9DE9802A7043DE50A7)

cmd.exe (PID: 6088 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

LocalCtrl_alpha_v3.exe (PID: 6020 cmdline: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe MD5: 967F4470627F823F4D7981E511C9824F)

AdobeSync.exe (PID: 5764 cmdline: "C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe" MD5: F778E9136AB0DB9DE9802A7043DE50A7)

cmd.exe (PID: 3836 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

LocalCtrl_alpha_v3.exe (PID: 4696 cmdline: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe MD5: 967F4470627F823F4D7981E511C9824F)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\lrx	ReversingLabs: Detection: 24%
Source: C:\Users\user\AppData\Local\Temp\ykvbphfmiswk	ReversingLabs: Detection: 24%
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AXE8SharedExpat.dll	ReversingLabs: Detection: 30%
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	ReversingLabs: Detection: 44%
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AXE8SharedExpat.dll	ReversingLabs: Detection: 30%

Multi AV Scanner detection for submitted file

Source: 1wrLmYiC62.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ykvbphfmiswk	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\lrx	Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006BA0BB DecryptFileW,	0_2_006BA0BB
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006DFA62 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	0_2_006DFA62
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006B9E9E DecryptFileW,DecryptFileW,	0_2_006B9E9E
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_000FA0BB DecryptFileW,	2_2_000FA0BB
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_0011FA62 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	2_2_0011FA62
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_000F9E9E DecryptFileW,DecryptFileW,	2_2_000F9E9E
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Code function: 3_2_00DB00D0 CryptProtectData,_CxxThrowException,	3_2_00DB00D0
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Code function: 3_2_00DB0070 CryptUnprotectData,_CxxThrowException,	3_2_00DB0070

Source: 1wrLmYiC62.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP

Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe

File opened: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\msvcr90.dll

Jump to behavior

Source: 1wrLmYiC62.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: 1wrLmYiC62.exe, 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmp, 1wrLmYiC62.exe, 00000000.00000000.2088510327.00000000006EB000.00000002.00000001.01000000.00000003.sdmp, 1wrLmYiC62.exe, 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmp, 1wrLmYiC62.exe, 00000002.00000000.2091786444.000000000012B000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SharePoint.pdb source: 1wrLmYiC62.exe, 00000002.00000002.2398352677.000000006E10A000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: ntdll.pdb source: LocalCtrl_alpha_v3.exe, 00000009.00000002.3735280523.0000000003CFF000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3739914380.00000000068F3000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3735017380.0000000003AF2000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3739325763.00000000064F6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3736922640.0000000004CF5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3735842117.00000000042F0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3740386774.0000000006CF9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3738249170.0000000005AF5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3740589192.0000000006EF6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3736066746.00000000044FC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3738085331.00000000058F5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3736745778.0000000004AFD000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3735451913.0000000003EFA000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3739089042.00000000062F5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3736350401.00000000046FE000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3738402909.0000000005CF8000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733614841.00000000021CB000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3737147515.0000000004EF1000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3737746599.00000000054F9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3737548667.00000000052FD000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3737338787.00000000050F0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3739594027.00000000066FC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3734283066.0000000002B40000.00000004.00001000.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3736547216.00000000048F9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3735637524.00000000040F7000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3737925173.00000000056F0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3740765853.00000000070FA000.
Source:	Binary string: wntdll.pdbUGP source: AdobeSync.exe, 00000003.00000002.2120188190.000000000A37B000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2120444050.000000000A6D0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179514291.0000000009C70000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179687294.000000000A02E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179374059.0000000009912000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2493353114.000000000504B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494602431.0000000005920000.00000004.00001000.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2556104227.000000000A0DF000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2556333081.000000000A430000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2556660307.000000000A7E9000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2781659235.0000000005B60000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780490812.000000000529D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: LocalCtrl_alpha_v3.exe, 00000009.00000002.3735280523.0000000003CFF000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3739914380.00000000068F3000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3735017380.0000000003AF2000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3739325763.00000000064F6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3736922640.0000000004CF5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3735842117.00000000042F0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3740386774.0000000006CF9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3738249170.0000000005AF5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3740589192.0000000006EF6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3736066746.00000000044FC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3738085331.00000000058F5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3736745778.0000000004AFD000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3735451913.0000000003EFA000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3739089042.00000000062F5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3736350401.00000000046FE000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3738402909.0000000005CF8000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733614841.00000000021CB000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3737147515.0000000004EF1000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3737746599.00000000054F9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3737548667.00000000052FD000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3737338787.00000000050F0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3739594027.00000000066FC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3734283066.0000000002B40000.00000004.00001000.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3736547216.00000000048F9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3735637524.00000000040F7000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3737925173.00000000056F0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3740765853.00000000070FA0
Source:	Binary string: wntdll.pdb source: AdobeSync.exe, 00000003.00000002.2120188190.000000000A37B000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2120444050.000000000A6D0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179514291.0000000009C70000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179687294.000000000A02E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179374059.0000000009912000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2493353114.000000000504B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494602431.0000000005920000.00000004.00001000.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2556104227.000000000A0DF000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2556333081.000000000A430000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2556660307.000000000A7E9000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2781659235.0000000005B60000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780490812.000000000529D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SharePoint.pdb* source: 1wrLmYiC62.exe, 00000002.00000002.2398352677.000000006E10A000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: BIB.pdb` source: AdobeSync.exe, 00000003.00000003.2112278219.0000000001450000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2121429415.000000006E591000.00000002.00000001.01000000.0000000A.sdmp, AdobeSync.exe, 00000004.00000002.2180304574.000000006C591000.00000002.00000001.01000000.0000000F.sdmp, AdobeSync.exe, 0000000B.00000002.2558256148.0000000074641000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: AdobeCollabSync.pdb source: AdobeSync.exe, 00000003.00000000.2096781321.0000000000DED000.00000002.00000001.01000000.00000008.sdmp, AdobeSync.exe, 00000003.00000003.2112056252.0000000001477000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2115097095.0000000000DED000.00000002.00000001.01000000.00000008.sdmp, AdobeSync.exe, 00000004.00000000.2114654049.00000000000ED000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 00000004.00000002.2175411897.00000000000ED000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 0000000B.00000000.2480452495.00000000000ED000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 0000000B.00000002.2551205293.00000000000ED000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: AXE8SharedExpat.pdb source: AdobeSync.exe, 00000003.00000002.2120947838.000000006E0D0000.00000002.00000001.01000000.00000009.sdmp, AdobeSync.exe, 00000003.00000003.2112108949.0000000001450000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2180416265.000000006E0A0000.00000002.00000001.01000000.0000000E.sdmp, AdobeSync.exe, 0000000B.00000002.2558100541.000000006E540000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: AXE8SharedExpat.pdbppTn source: AdobeSync.exe, 0000000B.00000002.2558100541.000000006E540000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: BIB.pdb source: AdobeSync.exe, 00000003.00000003.2112278219.0000000001450000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2121429415.000000006E591000.00000002.00000001.01000000.0000000A.sdmp, AdobeSync.exe, 00000004.00000002.2180304574.000000006C591000.00000002.00000001.01000000.0000000F.sdmp, AdobeSync.exe, 0000000B.00000002.2558256148.0000000074641000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: AXE8SharedExpat.pdbpp source: AdobeSync.exe, 00000003.00000002.2120947838.000000006E0D0000.00000002.00000001.01000000.00000009.sdmp, AdobeSync.exe, 00000003.00000003.2112108949.0000000001450000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2180416265.000000006E0A0000.00000002.00000001.01000000.0000000E.sdmp

Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006A3CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	0_2_006A3CC4
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006E4440 FindFirstFileW,FindClose,	0_2_006E4440
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006B9B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	0_2_006B9B43
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006D7B87 FindFirstFileExW,	0_2_006D7B87
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_00124440 FindFirstFileW,FindClose,	2_2_00124440
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_000F9B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	2_2_000F9B43
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_00117B87 FindFirstFileExW,	2_2_00117B87
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_000E3CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	2_2_000E3CC4
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_6E0EDCB0 GetWindowsDirectoryW,lstrcmpW,lstrlenW,lstrlenW,FindFirstFileW,lstrlenW,DeleteFileW,FindNextFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_6E0EDCB0
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_6E0FDB36 FindFirstFileExW,	2_2_6E0FDB36
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Code function: 3_2_00D6CE10 FindFirstFileW,	3_2_00D6CE10

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\	Jump to behavior

Source: unknown

DNS traffic detected: query: tataragirld.site replaycode: Name error (3)

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe

Code function: 3_2_00D64970 HttpSendRequestA,printf,_CxxThrowException,HttpSendRequestA,InternetReadFile,_CxxThrowException,HttpEndRequestA,

3_2_00D64970

Source: global traffic

DNS traffic detected: DNS query: tataragirld.site

Source: 1wrLmYiC62.exe	String found in binary or memory: http://appsyndication.org/2006/appsyn
Source: 1wrLmYiC62.exe, 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmp, 1wrLmYiC62.exe, 00000000.00000000.2088510327.00000000006EB000.00000002.00000001.01000000.00000003.sdmp, 1wrLmYiC62.exe, 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmp, 1wrLmYiC62.exe, 00000002.00000000.2091786444.000000000012B000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3741565561.00000001401E0000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.???.xx/?search=%s
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: AdobeSync.exe, 00000003.00000002.2119480902.0000000008650000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007BF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053AD000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.00000000025CE000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.00000000083BA000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.00000000055F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3741565561.00000001401E0000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.softwareok.com
Source: LocalCtrl_alpha_v3.exe, 00000009.00000000.2413435727.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000002.3946528871.00000001401F4000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://www.softwareok.com/?Download=Find.Same.Images.OK
Source: LocalCtrl_alpha_v3.exe, 00000009.00000000.2413435727.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000002.3946528871.00000001401F4000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://www.softwareok.com/?Freeware/Find.Same.Images.OK
Source: LocalCtrl_alpha_v3.exe, 00000009.00000000.2413435727.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000002.3946528871.00000001401F4000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://www.softwareok.com/?Freeware/Find.Same.Images.OK/History
Source: LocalCtrl_alpha_v3.exe, 00000009.00000000.2413435727.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000002.3946528871.00000001401F4000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://www.softwareok.com/?seite=faq-Find.Same.Images.OK&faq=0
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3741565561.00000001401E0000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.softwareok.de
Source: LocalCtrl_alpha_v3.exe, 00000009.00000000.2413435727.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000002.3946528871.00000001401F4000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://www.softwareok.de/?Download=Find.Same.Images.OK
Source: LocalCtrl_alpha_v3.exe, 00000009.00000000.2413435727.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000002.3946528871.00000001401F4000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://www.softwareok.de/?Freeware/Find.Same.Images.OK
Source: LocalCtrl_alpha_v3.exe, 00000009.00000000.2413435727.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000002.3946528871.00000001401F4000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://www.softwareok.de/?Freeware/Find.Same.Images.OK/History
Source: LocalCtrl_alpha_v3.exe, 00000009.00000000.2413435727.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000002.3946528871.00000001401F4000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://www.softwareok.de/?seite=faq-Find.Same.Images.OK&faq=0
Source: cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.surfok.de/
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: LocalCtrl_alpha_v3.exe, 0000000E.00000003.3297283306.00000000004C4000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3206723699.00000000004C6000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3569058174.00000000004BE000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3569136089.00000000004C8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3842004816.00000000004CA000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3478635056.00000000004CA000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3750803387.00000000004C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/
Source: LocalCtrl_alpha_v3.exe, 0000000E.00000003.3842004816.00000000004CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/#
Source: LocalCtrl_alpha_v3.exe, 00000009.00000003.3374697259.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3375051072.000000000056A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/$t
Source: LocalCtrl_alpha_v3.exe, 00000009.00000003.3374697259.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3375051072.000000000056A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/(t
Source: LocalCtrl_alpha_v3.exe, 00000009.00000002.3733229961.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3647712222.000000000055E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/0t
Source: LocalCtrl_alpha_v3.exe, 0000000E.00000003.3206723699.00000000004A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/2009_New_England_Patriots_season?omlxpbik85mer=%2BBA7Gis1n3XVmJgLCG%2BgLgGV
Source: LocalCtrl_alpha_v3.exe, 00000009.00000002.3733229961.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3647712222.000000000055E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/4t
Source: LocalCtrl_alpha_v3.exe, 0000000E.00000003.3297283306.00000000004C4000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3206723699.00000000004C6000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3478635056.00000000004CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/C
Source: LocalCtrl_alpha_v3.exe, 0000000E.00000003.3569058174.00000000004BE000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3569136089.00000000004C8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3750803387.00000000004C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/G
Source: LocalCtrl_alpha_v3.exe, 00000009.00000003.2921096864.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3011647384.000000000055E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/Lt
Source: LocalCtrl_alpha_v3.exe, 00000009.00000003.3466041227.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3102576742.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3102237598.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3011963405.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3466241274.000000000056A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/Pt
Source: LocalCtrl_alpha_v3.exe, 00000009.00000003.3193363622.000000000056A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3193243380.000000000055E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/Tt
Source: LocalCtrl_alpha_v3.exe, 00000009.00000003.3556740509.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3556872591.000000000056A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/Xt
Source: LocalCtrl_alpha_v3.exe, 0000000E.00000003.3842004816.00000000004CA000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3750803387.00000000004C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/_
Source: LocalCtrl_alpha_v3.exe, 00000009.00000003.3193363622.000000000056A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3193243380.000000000055E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/dt
Source: LocalCtrl_alpha_v3.exe, 00000009.00000003.3374697259.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3375051072.000000000056A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/ht
Source: LocalCtrl_alpha_v3.exe, 0000000E.00000003.3842004816.00000000004CA000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3750803387.00000000004C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/k
Source: LocalCtrl_alpha_v3.exe, 00000009.00000003.3283935129.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3374697259.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3374470346.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3375051072.000000000056A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site/xt
Source: LocalCtrl_alpha_v3.exe, 00000009.00000002.3733507550.0000000000595000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3011647384.0000000000542000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3647537126.0000000000591000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.2830377438.0000000000542000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3647633975.0000000000594000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.2921096864.0000000000542000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3388102212.00000000004D2000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3750803387.00000000004D2000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3569058174.00000000004D2000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3478540910.00000000004D2000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000002.3938079354.00000000004D2000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3932851789.00000000004D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site:443
Source: LocalCtrl_alpha_v3.exe, 00000009.00000003.3556953483.0000000000594000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733507550.0000000000595000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3556649826.0000000000591000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3647537126.0000000000591000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3647633975.0000000000594000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3647206478.0000000000591000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site:443$
Source: LocalCtrl_alpha_v3.exe, 0000000E.00000003.3750803387.00000000004D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tataragirld.site:443N
Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: C:\Users\user\Desktop\1wrLmYiC62.exe

File deleted: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe

Jump to behavior

Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006D001D	0_2_006D001D
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006C41EA	0_2_006C41EA
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006A62AA	0_2_006A62AA
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006CC332	0_2_006CC332
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006D03D5	0_2_006D03D5
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006DA560	0_2_006DA560
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006D07AA	0_2_006D07AA
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006AA8F1	0_2_006AA8F1
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006DAA0E	0_2_006DAA0E
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006D0B6F	0_2_006D0B6F
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006CFB89	0_2_006CFB89
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006D2C18	0_2_006D2C18
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006DEE7C	0_2_006DEE7C
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006D2E47	0_2_006D2E47
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_0011001D	2_2_0011001D
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_001041EA	2_2_001041EA
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_000E62AA	2_2_000E62AA
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_0010C332	2_2_0010C332
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_001103D5	2_2_001103D5
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_0011A560	2_2_0011A560
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_001107AA	2_2_001107AA
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_000EA8F1	2_2_000EA8F1
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_0011AA0E	2_2_0011AA0E
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_00110B6F	2_2_00110B6F
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_0010FB89	2_2_0010FB89
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_00112C18	2_2_00112C18
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_00112E47	2_2_00112E47
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_0011EE7C	2_2_0011EE7C
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_6E0E4EA0	2_2_6E0E4EA0
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_6E102F42	2_2_6E102F42
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_6E0FBF89	2_2_6E0FBF89
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_6E0F64E0	2_2_6E0F64E0
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_6E0E3570	2_2_6E0E3570
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_6E0F5255	2_2_6E0F5255
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_6E0FF3DF	2_2_6E0FF3DF
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_6E0FB3DB	2_2_6E0FB3DB
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_6E103062	2_2_6E103062
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_6E0F21B0	2_2_6E0F21B0
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Code function: 3_2_00DB4500	3_2_00DB4500
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Code function: 3_2_00DB49A0	3_2_00DB49A0
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Code function: 3_2_00DB53A0	3_2_00DB53A0

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe B22BF1210B5FD173A210EBFA9092390AA0513C41E1914CBE161EB547F049EF91

Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: String function: 006E0237 appears 683 times
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: String function: 006E0726 appears 34 times
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: String function: 006A1F13 appears 54 times
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: String function: 006A3821 appears 501 times
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: String function: 006E32F3 appears 82 times
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: String function: 00120237 appears 683 times
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: String function: 001232F3 appears 83 times
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: String function: 6E0F0F70 appears 47 times
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: String function: 000E1F13 appears 54 times
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: String function: 000E3821 appears 501 times
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: String function: 00120726 appears 34 times
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Code function: String function: 00D68490 appears 549 times
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Code function: String function: 00D16970 appears 40 times
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Code function: String function: 00DB5F10 appears 76 times
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Code function: String function: 00D34080 appears 39 times
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Code function: String function: 00D15A10 appears 79 times
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Code function: String function: 00D759E0 appears 33 times
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Code function: String function: 00DD7696 appears 117 times

Source: LocalCtrl_alpha_v3.exe.5.dr

Static PE information: Resource name: ZIP type: Zip archive data (empty)

Source: lrx.5.dr	Static PE information: Number of sections : 12 > 10
Source: ykvbphfmiswk.12.dr	Static PE information: Number of sections : 12 > 10

Source: 1wrLmYiC62.exe, 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegallon.exe4 vs 1wrLmYiC62.exe
Source: 1wrLmYiC62.exe, 00000002.00000002.2398386480.000000006E11D000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameSharePoint.dllF vs 1wrLmYiC62.exe
Source: 1wrLmYiC62.exe, 00000002.00000003.2096008945.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite.dllX vs 1wrLmYiC62.exe
Source: 1wrLmYiC62.exe, 00000002.00000000.2091845692.000000000014D000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamegallon.exe4 vs 1wrLmYiC62.exe

Source: 1wrLmYiC62.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP

Source: classification engine

Classification label: mal84.evad.winEXE@18/26@13/0

Source: C:\Users\user\Desktop\1wrLmYiC62.exe

Code function: 0_2_006DFE21 FormatMessageW,GetLastError,LocalFree,

0_2_006DFE21

Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006A45EE GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,		0_2_006A45EE
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_000E45EE GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,		2_2_000E45EE

Source: C:\Users\user\Desktop\1wrLmYiC62.exe

Code function: 0_2_006E304F GetModuleHandleA,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CoCreateInstance,ExitProcess,

0_2_006E304F

Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe

Code function: 2_2_6E0E7F40 LoadResource,LockResource,SizeofResource,

2_2_6E0E7F40

Source: C:\Users\user\Desktop\1wrLmYiC62.exe

Code function: 0_2_006C6B88 ChangeServiceConfigW,GetLastError,

0_2_006C6B88

Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe

File created: C:\Users\user\AppData\Roaming\PatchReaderWCF

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1976:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6380:120:WilError_03

Source: C:\Users\user\Desktop\1wrLmYiC62.exe

File created: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\

Jump to behavior

Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Command line argument: cabinet.dll	0_2_006A1070
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Command line argument: msi.dll	0_2_006A1070
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Command line argument: version.dll	0_2_006A1070
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Command line argument: wininet.dll	0_2_006A1070
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Command line argument: comres.dll	0_2_006A1070
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Command line argument: msasn1.dll	0_2_006A1070
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Command line argument: crypt32.dll	0_2_006A1070
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Command line argument: feclient.dll	0_2_006A1070
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Command line argument: cabinet.dll	0_2_006A1070
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Command line argument: cabinet.dll	2_2_000E1070
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Command line argument: msi.dll	2_2_000E1070
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Command line argument: version.dll	2_2_000E1070
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Command line argument: wininet.dll	2_2_000E1070
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Command line argument: comres.dll	2_2_000E1070
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Command line argument: clbcatq.dll	2_2_000E1070
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Command line argument: msasn1.dll	2_2_000E1070
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Command line argument: crypt32.dll	2_2_000E1070
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Command line argument: feclient.dll	2_2_000E1070
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Command line argument: cabinet.dll	2_2_000E1070

Source: 1wrLmYiC62.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\cmd.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\1wrLmYiC62.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1wrLmYiC62.exe, 00000002.00000002.2398352677.000000006E10A000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: SELECT `Text` FROM `UIText` WHERE `Key` = '%s'tmp;.\\?\\\?\UNC\\\invalid string position\ *AI_WSP_LISTAI_WSP_FEATURES_LIST[AI_WSP_URL]AI_SHAREPOINT_LOGAI_GLOBAL_WSPAI_LOCAL_WSPAI_NOT_VITAL_WSPAI_DEPLOY_WSP_CADATAAI_DEPLOY_WSP_CADATA_64AI_SHAREPOINT_STRINGS,\|$^.cab.wspSharePoint.log-url [AI_WSP_URL] -allcontenturls-immediate-time-local-allowgacdeployment-allowcaspolicies-force-idSPAdminSPAdminV4SPTimerV3SPTimerV4
Source: 1wrLmYiC62.exe, 00000002.00000003.2096008945.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2120833793.000000006CAA3000.00000002.00000001.01000000.0000000B.sdmp, AdobeSync.exe, 00000003.00000003.2113214566.0000000001450000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2180237315.000000006C573000.00000002.00000001.01000000.00000010.sdmp, AdobeSync.exe, 0000000B.00000002.2557952585.000000006E123000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 1wrLmYiC62.exe, 00000002.00000003.2096008945.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2120833793.000000006CAA3000.00000002.00000001.01000000.0000000B.sdmp, AdobeSync.exe, 00000003.00000003.2113214566.0000000001450000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2180237315.000000006C573000.00000002.00000001.01000000.00000010.sdmp, AdobeSync.exe, 0000000B.00000002.2557952585.000000006E123000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: 1wrLmYiC62.exe, 00000002.00000003.2096008945.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2120833793.000000006CAA3000.00000002.00000001.01000000.0000000B.sdmp, AdobeSync.exe, 00000003.00000003.2113214566.0000000001450000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2180237315.000000006C573000.00000002.00000001.01000000.00000010.sdmp, AdobeSync.exe, 0000000B.00000002.2557952585.000000006E123000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM ' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: 1wrLmYiC62.exe, 00000002.00000003.2096008945.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2120833793.000000006CAA3000.00000002.00000001.01000000.0000000B.sdmp, AdobeSync.exe, 00000003.00000003.2113214566.0000000001450000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2180237315.000000006C573000.00000002.00000001.01000000.00000010.sdmp, AdobeSync.exe, 0000000B.00000002.2557952585.000000006E123000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: 1wrLmYiC62.exe, 00000002.00000003.2096008945.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2120833793.000000006CAA3000.00000002.00000001.01000000.0000000B.sdmp, AdobeSync.exe, 00000003.00000003.2113214566.0000000001450000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2180237315.000000006C573000.00000002.00000001.01000000.00000010.sdmp, AdobeSync.exe, 0000000B.00000002.2557952585.000000006E123000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM ' \|\| quote(name) \|\| ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: 1wrLmYiC62.exe, 00000002.00000003.2096008945.0000000000FA6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2120833793.000000006CAA3000.00000002.00000001.01000000.0000000B.sdmp, AdobeSync.exe, 00000003.00000003.2113214566.0000000001450000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2180237315.000000006C573000.00000002.00000001.01000000.00000010.sdmp, AdobeSync.exe, 0000000B.00000002.2557952585.000000006E123000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: 1wrLmYiC62.exe

ReversingLabs: Detection: 44%

Source: 1wrLmYiC62.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: 1wrLmYiC62.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls

Source: C:\Users\user\Desktop\1wrLmYiC62.exe

File read: C:\Users\user\Desktop\1wrLmYiC62.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\1wrLmYiC62.exe "C:\Users\user\Desktop\1wrLmYiC62.exe"
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Process created: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe "C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe" -burn.clean.room="C:\Users\user\Desktop\1wrLmYiC62.exe" -burn.filehandle.attached=512 -burn.filehandle.self=532
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Process created: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Process created: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe "C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe"
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Process created: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe "C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe" -burn.clean.room="C:\Users\user\Desktop\1wrLmYiC62.exe" -burn.filehandle.attached=512 -burn.filehandle.self=532	Jump to behavior
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Process created: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Jump to behavior
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Process created: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Jump to behavior

Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Section loaded: axe8sharedexpat.dll	Jump to behavior
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Section loaded: bib.dll	Jump to behavior
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Section loaded: sensapi.dll	Jump to behavior
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Section loaded: sqlite.dll	Jump to behavior
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: axe8sharedexpat.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: bib.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: sensapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: sqlite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: axe8sharedexpat.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: bib.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: sensapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: sqlite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\1wrLmYiC62.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\InProcServer32

Jump to behavior

Source: tgiwin.5.dr

LNK file: ..\..\Roaming\PatchReaderWCF\AdobeSync.exe

Source: 1wrLmYiC62.exe

Static file information: File size 6305325 > 1048576

Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe

File opened: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\msvcr90.dll

Jump to behavior

Source: 1wrLmYiC62.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 1wrLmYiC62.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 1wrLmYiC62.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 1wrLmYiC62.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 1wrLmYiC62.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 1wrLmYiC62.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 1wrLmYiC62.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 1wrLmYiC62.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: 1wrLmYiC62.exe, 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmp, 1wrLmYiC62.exe, 00000000.00000000.2088510327.00000000006EB000.00000002.00000001.01000000.00000003.sdmp, 1wrLmYiC62.exe, 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmp, 1wrLmYiC62.exe, 00000002.00000000.2091786444.000000000012B000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SharePoint.pdb source: 1wrLmYiC62.exe, 00000002.00000002.2398352677.000000006E10A000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: ntdll.pdb source: LocalCtrl_alpha_v3.exe, 00000009.00000002.3735280523.0000000003CFF000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3739914380.00000000068F3000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3735017380.0000000003AF2000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3739325763.00000000064F6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3736922640.0000000004CF5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3735842117.00000000042F0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3740386774.0000000006CF9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3738249170.0000000005AF5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3740589192.0000000006EF6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3736066746.00000000044FC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3738085331.00000000058F5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3736745778.0000000004AFD000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3735451913.0000000003EFA000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3739089042.00000000062F5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3736350401.00000000046FE000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3738402909.0000000005CF8000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733614841.00000000021CB000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3737147515.0000000004EF1000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3737746599.00000000054F9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3737548667.00000000052FD000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3737338787.00000000050F0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3739594027.00000000066FC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3734283066.0000000002B40000.00000004.00001000.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3736547216.00000000048F9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3735637524.00000000040F7000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3737925173.00000000056F0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3740765853.00000000070FA000.
Source:	Binary string: wntdll.pdbUGP source: AdobeSync.exe, 00000003.00000002.2120188190.000000000A37B000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2120444050.000000000A6D0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179514291.0000000009C70000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179687294.000000000A02E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179374059.0000000009912000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2493353114.000000000504B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494602431.0000000005920000.00000004.00001000.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2556104227.000000000A0DF000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2556333081.000000000A430000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2556660307.000000000A7E9000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2781659235.0000000005B60000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780490812.000000000529D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: LocalCtrl_alpha_v3.exe, 00000009.00000002.3735280523.0000000003CFF000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3739914380.00000000068F3000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3735017380.0000000003AF2000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3739325763.00000000064F6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3736922640.0000000004CF5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3735842117.00000000042F0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3740386774.0000000006CF9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3738249170.0000000005AF5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3740589192.0000000006EF6000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3736066746.00000000044FC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3738085331.00000000058F5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3736745778.0000000004AFD000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3735451913.0000000003EFA000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3739089042.00000000062F5000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3736350401.00000000046FE000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3738402909.0000000005CF8000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733614841.00000000021CB000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3737147515.0000000004EF1000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3737746599.00000000054F9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3737548667.00000000052FD000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3737338787.00000000050F0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3739594027.00000000066FC000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3734283066.0000000002B40000.00000004.00001000.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3736547216.00000000048F9000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3735637524.00000000040F7000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3737925173.00000000056F0000.00000004.00000001.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3740765853.00000000070FA0
Source:	Binary string: wntdll.pdb source: AdobeSync.exe, 00000003.00000002.2120188190.000000000A37B000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2120444050.000000000A6D0000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179514291.0000000009C70000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179687294.000000000A02E000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179374059.0000000009912000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2493353114.000000000504B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494602431.0000000005920000.00000004.00001000.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2556104227.000000000A0DF000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2556333081.000000000A430000.00000004.00000800.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2556660307.000000000A7E9000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2781659235.0000000005B60000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780490812.000000000529D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SharePoint.pdb* source: 1wrLmYiC62.exe, 00000002.00000002.2398352677.000000006E10A000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: BIB.pdb` source: AdobeSync.exe, 00000003.00000003.2112278219.0000000001450000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2121429415.000000006E591000.00000002.00000001.01000000.0000000A.sdmp, AdobeSync.exe, 00000004.00000002.2180304574.000000006C591000.00000002.00000001.01000000.0000000F.sdmp, AdobeSync.exe, 0000000B.00000002.2558256148.0000000074641000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: AdobeCollabSync.pdb source: AdobeSync.exe, 00000003.00000000.2096781321.0000000000DED000.00000002.00000001.01000000.00000008.sdmp, AdobeSync.exe, 00000003.00000003.2112056252.0000000001477000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2115097095.0000000000DED000.00000002.00000001.01000000.00000008.sdmp, AdobeSync.exe, 00000004.00000000.2114654049.00000000000ED000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 00000004.00000002.2175411897.00000000000ED000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 0000000B.00000000.2480452495.00000000000ED000.00000002.00000001.01000000.0000000D.sdmp, AdobeSync.exe, 0000000B.00000002.2551205293.00000000000ED000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: AXE8SharedExpat.pdb source: AdobeSync.exe, 00000003.00000002.2120947838.000000006E0D0000.00000002.00000001.01000000.00000009.sdmp, AdobeSync.exe, 00000003.00000003.2112108949.0000000001450000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2180416265.000000006E0A0000.00000002.00000001.01000000.0000000E.sdmp, AdobeSync.exe, 0000000B.00000002.2558100541.000000006E540000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: AXE8SharedExpat.pdbppTn source: AdobeSync.exe, 0000000B.00000002.2558100541.000000006E540000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: BIB.pdb source: AdobeSync.exe, 00000003.00000003.2112278219.0000000001450000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000003.00000002.2121429415.000000006E591000.00000002.00000001.01000000.0000000A.sdmp, AdobeSync.exe, 00000004.00000002.2180304574.000000006C591000.00000002.00000001.01000000.0000000F.sdmp, AdobeSync.exe, 0000000B.00000002.2558256148.0000000074641000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: AXE8SharedExpat.pdbpp source: AdobeSync.exe, 00000003.00000002.2120947838.000000006E0D0000.00000002.00000001.01000000.00000009.sdmp, AdobeSync.exe, 00000003.00000003.2112108949.0000000001450000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2180416265.000000006E0A0000.00000002.00000001.01000000.0000000E.sdmp

Source: 1wrLmYiC62.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 1wrLmYiC62.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 1wrLmYiC62.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 1wrLmYiC62.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 1wrLmYiC62.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: 1wrLmYiC62.exe	Static PE information: real checksum: 0x0 should be: 0x60e0b6
Source: Quadruple.dll.2.dr	Static PE information: real checksum: 0x4dc7e should be: 0x4a7b1
Source: lrx.5.dr	Static PE information: real checksum: 0x27e8a5 should be: 0x27697f
Source: 1wrLmYiC62.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x60e0b6
Source: ykvbphfmiswk.12.dr	Static PE information: real checksum: 0x27e8a5 should be: 0x27697f
Source: AXE8SharedExpat.dll.3.dr	Static PE information: real checksum: 0x32631 should be: 0x361f1
Source: AXE8SharedExpat.dll.2.dr	Static PE information: real checksum: 0x32631 should be: 0x361f1

Source: 1wrLmYiC62.exe	Static PE information: section name: .wixburn
Source: 1wrLmYiC62.exe.0.dr	Static PE information: section name: .wixburn
Source: LocalCtrl_alpha_v3.exe.5.dr	Static PE information: section name: Shared
Source: lrx.5.dr	Static PE information: section name: .xdata
Source: lrx.5.dr	Static PE information: section name: ubpux
Source: ykvbphfmiswk.12.dr	Static PE information: section name: .xdata
Source: ykvbphfmiswk.12.dr	Static PE information: section name: ubpux

Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006CEAD6 push ecx; ret	0_2_006CEAE9
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_0010EAD6 push ecx; ret	2_2_0010EAE9
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_6E0F0FB4 push ecx; ret	2_2_6E0F0FC6
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Code function: 3_2_00DD8249 push ecx; ret	3_2_00DD825C
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Code function: 3_2_00DD8B07 push ecx; ret	3_2_00DD8B1A

Source: msvcr90.dll.2.dr	Static PE information: section name: .text entropy: 6.9217598022130655
Source: msvcr90.dll.3.dr	Static PE information: section name: .text entropy: 6.9217598022130655

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\ykvbphfmiswk	Jump to dropped file
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	File created: C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcr90.dll	Jump to dropped file
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	File created: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\msvcp90.dll	Jump to dropped file
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	File created: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AXE8SharedExpat.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Jump to dropped file
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	File created: C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcp90.dll	Jump to dropped file
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	File created: C:\Users\user\AppData\Roaming\PatchReaderWCF\BIB.dll	Jump to dropped file
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	File created: C:\Users\user\AppData\Roaming\PatchReaderWCF\sqlite.dll	Jump to dropped file
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	File created: C:\Users\user\AppData\Roaming\PatchReaderWCF\AXE8SharedExpat.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	File created: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Jump to dropped file
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	File created: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\msvcr90.dll	Jump to dropped file
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	File created: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\sqlite.dll	Jump to dropped file
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	File created: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Jump to dropped file
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	File created: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\Quadruple.dll	Jump to dropped file
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	File created: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Jump to dropped file
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	File created: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\BIB.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\lrx	Jump to dropped file

Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	File created: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\msvcp90.dll	Jump to dropped file
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	File created: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AXE8SharedExpat.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	File created: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Jump to dropped file
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	File created: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\msvcr90.dll	Jump to dropped file
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	File created: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\sqlite.dll	Jump to dropped file
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	File created: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\Quadruple.dll	Jump to dropped file
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	File created: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Jump to dropped file
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	File created: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\BIB.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\lrx			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\ykvbphfmiswk			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\cmd.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\LRX
Source: C:\Windows\SysWOW64\cmd.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\YKVBPHFMISWK

Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe

Code function: 2_2_6E0EFBC5 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_6E0EFBC5

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	API/Special instruction interceptor: Address: 6C627C44
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	API/Special instruction interceptor: Address: 6C627C44
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	API/Special instruction interceptor: Address: 6C627945
Source: C:\Windows\SysWOW64\cmd.exe	API/Special instruction interceptor: Address: 6C623B54

Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ykvbphfmiswk	Jump to dropped file
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcr90.dll	Jump to dropped file
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Dropped PE file which has not been started: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\msvcp90.dll	Jump to dropped file
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcp90.dll	Jump to dropped file
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Dropped PE file which has not been started: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\msvcr90.dll	Jump to dropped file
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Dropped PE file which has not been started: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\Quadruple.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\lrx	Jump to dropped file

Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Evaded block: after key decision
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Evaded block: after key decision

Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe

Evasive API call chain: GetLocalTime,DecisionNodes

Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe

API coverage: 9.7 %

Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe TID: 1396	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe TID: 1892	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe TID: 1892	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe TID: 1976	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe TID: 1976	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006DFEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 006DFF61h	0_2_006DFEC6
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006DFEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 006DFF5Ah	0_2_006DFEC6
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_0011FEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 0011FF61h	2_2_0011FEC6
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_0011FEC6 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 0011FF5Ah	2_2_0011FEC6

Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006A3CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	0_2_006A3CC4
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006E4440 FindFirstFileW,FindClose,	0_2_006E4440
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006B9B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	0_2_006B9B43
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006D7B87 FindFirstFileExW,	0_2_006D7B87
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_00124440 FindFirstFileW,FindClose,	2_2_00124440
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_000F9B43 FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	2_2_000F9B43
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_00117B87 FindFirstFileExW,	2_2_00117B87
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_000E3CC4 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	2_2_000E3CC4
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_6E0EDCB0 GetWindowsDirectoryW,lstrcmpW,lstrlenW,lstrlenW,FindFirstFileW,lstrlenW,DeleteFileW,FindNextFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_6E0EDCB0
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_6E0FDB36 FindFirstFileExW,	2_2_6E0FDB36
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Code function: 3_2_00D6CE10 FindFirstFileW,	3_2_00D6CE10

Source: C:\Users\user\Desktop\1wrLmYiC62.exe

Code function: 0_2_006E97A5 VirtualQuery,GetSystemInfo,

0_2_006E97A5

Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe

Thread delayed: delay time: 30000

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Roaming\	Jump to behavior

Source: cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: LocalCtrl_alpha_v3.exe, 00000009.00000002.3733063620.00000000004FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\|\|wJP

Source: C:\Users\user\Desktop\1wrLmYiC62.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\1wrLmYiC62.exe

Code function: 0_2_006CE88A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_006CE88A

Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe

Code function: 3_2_00D11412 OutputDebugStringA,GetLastError,

3_2_00D11412

Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006D48D8 mov eax, dword ptr fs:[00000030h]	0_2_006D48D8
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_001148D8 mov eax, dword ptr fs:[00000030h]	2_2_001148D8
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_6E0FD82F mov eax, dword ptr fs:[00000030h]	2_2_6E0FD82F
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_6E0F72E9 mov eax, dword ptr fs:[00000030h]	2_2_6E0F72E9

Source: C:\Users\user\Desktop\1wrLmYiC62.exe

Code function: 0_2_006A394F GetProcessHeap,RtlAllocateHeap,

0_2_006A394F

Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006CE3D8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_006CE3D8
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006CE88A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006CE88A
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006CE9DC SetUnhandledExceptionFilter,	0_2_006CE9DC
Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Code function: 0_2_006D3C76 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006D3C76
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_0010E3D8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0010E3D8
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_0010E88A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0010E88A
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_0010E9DC SetUnhandledExceptionFilter,	2_2_0010E9DC
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_00113C76 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00113C76
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_6E0F3EDE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6E0F3EDE
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_6E0F0C6C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6E0F0C6C
Source: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	Code function: 2_2_6E0F03FB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6E0F03FB
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	Code function: 3_2_00DD82A6 SetUnhandledExceptionFilter,	3_2_00DD82A6

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtQueryValueKey: Direct from: 0x14011D93E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtReadVirtualMemory: Direct from: 0x7FF656842F76	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtClose: Direct from: 0x7FF6598B79D7
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtProtectVirtualMemory: Direct from: 0x7FF65685299E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtSetInformationThread: Direct from: 0x7FF6598C09E4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtQueryValueKey: Direct from: 0x7FF659769DFE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtProtectVirtualMemory: Direct from: 0x7FF6598C2A76	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtQueryInformationProcess: Direct from: 0x7FF6566D1CB2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtClose: Indirect: 0x14012000F
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtQueryValueKey: Direct from: 0x7FF6566FA7D4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtProtectVirtualMemory: Direct from: 0x7FF8C88A26A1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF656651ECF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtClose: Direct from: 0x7FF6598B79E5
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtQuerySystemInformation: Direct from: 0x7FF6597C0DAD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF659748D09	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtQuerySystemInformation: Direct from: 0x7FF659741CB2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtCreateFile: Direct from: 0x7FF6568454B3	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6596B3E52	Jump to behavior
Source: C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	NtProtectVirtualMemory: Direct from: 0x76EE7B2E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtQueryInformationProcess: Direct from: 0x7FF6566DF9FF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtSetInformationProcess: Direct from: 0x7FF6566E02F7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6566D7F4B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF65664FD88	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtQueryInformationToken: Direct from: 0x7FF659796678	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x14011D808	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtQueryValueKey: Direct from: 0x7FF6566F9DFE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtReadFile: Direct from: 0x7FF6566D8D66	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtClose: Direct from: 0x7FF6568479E5
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtReadFile: Direct from: 0x7FF659748D66	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF65664991D	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtProtectVirtualMemory: Direct from: 0x7FF656852A76	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6596B991D	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtClose: Direct from: 0x7FF6598B79C3
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtProtectVirtualMemory: Direct from: 0x7FF656846342	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtProtectVirtualMemory: Direct from: 0x7FF6566C4EF6	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtSetInformationProcess: Direct from: 0x7FF6597502F7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtQueryInformationProcess: Direct from: 0x7FF65974F9FF	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6568509E4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtClose: Direct from: 0x7FF6566DFBFD
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtQuerySystemInformation: Direct from: 0x7FF659747F4B	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtSetInformationProcess: Direct from: 0x7FF6566DF270	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtClose: Direct from: 0x7FF6568479D7
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtQueryValueKey: Direct from: 0x7FF65976AAD6	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtClose: Direct from: 0x7FF6568479C3
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6598B6770	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6596BFD88	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF656643E52	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtClose: Direct from: 0x14011D864
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtProtectVirtualMemory: Direct from: 0x7FF6566CDD22	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF65664B119	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtSetInformationProcess: Direct from: 0x7FF65974F270	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF656729090	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtQueryInformationToken: Direct from: 0x7FF659766EED	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtQueryInformationProcess: Direct from: 0x7FF656750DAD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtProtectVirtualMemory: Direct from: 0x7FF6566C4E3A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtCreateFile: Direct from: 0x7FF6566D8C13	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtReadVirtualMemory: Direct from: 0x7FF6598B2F76	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtCreateFile: Direct from: 0x7FF659748C13	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF656726678	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtQueryValueKey: Direct from: 0x7FF6566FAAD6	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtQueryValueKey: Direct from: 0x7FF659769EED	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtProtectVirtualMemory: Direct from: 0x7FF6566DD226	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtClose: Direct from: 0x7FF65974FBFD
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtProtectVirtualMemory: Direct from: 0x7FF6598C299E	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtCreateFile: Direct from: 0x7FF6598B325D	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtClose: Direct from: 0x7FF6598B54D1
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtProtectVirtualMemory: Direct from: 0x7FF659734EF6	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6566F6EED	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	NtSetInformationThread: Direct from: 0x6E522240	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtProtectVirtualMemory: Direct from: 0x7FF659734E3A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtOpenKeyEx: Direct from: 0x7FF6597697BD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtCreateThreadEx: Direct from: 0x7FF6596B41F8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6566D8D09	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtCreateThreadEx: Direct from: 0x7FF6596B3FB7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF65974838A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtReadFile: Direct from: 0x14011D832	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF6566DA90D	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtQueryInformationProcess: Direct from: 0x7FF6566DF369	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtQueryValueKey: Direct from: 0x7FF6566F9EED	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF8C88C4B5E	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	NtQuerySystemInformation: Direct from: 0x76EE63E1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF65665187A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtCreateFile: Direct from: 0x7FF65684325D	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtQueryInformationProcess: Direct from: 0x7FF65974F369	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtProtectVirtualMemory: Direct from: 0x7FF6566CD940	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtProtectVirtualMemory: Direct from: 0x7FF65974D226	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF659799090	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF65974A90D	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtCreateFile: Direct from: 0x14011D7A4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtQueryValueKey: Direct from: 0x7FF65976A7D4	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtClose: Direct from: 0x7FF6568454D1
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtCreateThreadEx: Direct from: 0x7FF656643FB7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtProtectVirtualMemory: Direct from: 0x7FF6598B6342	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtCreateThreadEx: Direct from: 0x7FF6566441F8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	NtSetInformationThread: Direct from: 0x6E082240	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtOpenKeyEx: Direct from: 0x7FF6566F97BD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtQuerySystemInformation: Direct from: 0x7FF65973D940	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x140120A3C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtAllocateVirtualMemory: Direct from: 0x7FF656846770	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtProtectVirtualMemory: Direct from: 0x7FF65973DD22	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	NtCreateFile: Direct from: 0x7FF6598B54B3	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe protection: read write	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe base: 14011BC08	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe base: 37A010	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe base: 14011BC08	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe base: 2FF010	Jump to behavior

Source: C:\Users\user\Desktop\1wrLmYiC62.exe	Process created: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe "C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe" -burn.clean.room="C:\Users\user\Desktop\1wrLmYiC62.exe" -burn.filehandle.attached=512 -burn.filehandle.self=532	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	Jump to behavior

Source: C:\Users\user\Desktop\1wrLmYiC62.exe

Code function: 0_2_006E1719 InitializeSecurityDescriptor,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,SetEntriesInAclA,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,SetSecurityDescriptorDacl,GetLastError,CoInitializeSecurity,LocalFree,

0_2_006E1719

Source: C:\Users\user\Desktop\1wrLmYiC62.exe

Code function: 0_2_006E3A5F AllocateAndInitializeSid,CheckTokenMembership,

0_2_006E3A5F

Source: AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: )[%d] Shell_TrayWndTrayNotifyWnd

Source: C:\Users\user\Desktop\1wrLmYiC62.exe

Code function: 0_2_006CEC07 cpuid

0_2_006CEC07

Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\1wrLmYiC62.exe

Code function: 0_2_006B4EDF ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateNamedPipeW,GetLastError,CreateNamedPipeW,GetLastError,CloseHandle,LocalFree,

0_2_006B4EDF

Source: C:\Users\user\Desktop\1wrLmYiC62.exe

Code function: 0_2_006A6037 GetSystemTime,GetDateFormatW,GetLastError,GetLastError,GetDateFormatW,GetLastError,

0_2_006A6037

Source: C:\Users\user\Desktop\1wrLmYiC62.exe

Code function: 0_2_006A61DF GetUserNameW,GetLastError,

0_2_006A61DF

Source: C:\Users\user\Desktop\1wrLmYiC62.exe

Code function: 0_2_006E887B GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,

0_2_006E887B

Source: C:\Users\user\Desktop\1wrLmYiC62.exe

Code function: 0_2_006A5195 GetModuleHandleW,CoInitializeEx,GetVersionExW,GetLastError,CoUninitialize,

0_2_006A5195

Source: C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Native API	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 Windows Service	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Windows Service	1 Software Packing	NTDS	135 System Information Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	213 Process Injection	11 DLL Side-Loading	LSA Secrets	231 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Masquerading	DCSync	11 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	213 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1wrLmYiC62.exe	45%	ReversingLabs	Win32.Trojan.Rugmi

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\ykvbphfmiswk	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\lrx	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\lrx	24%	ReversingLabs	Win64.Trojan.Ulise
C:\Users\user\AppData\Local\Temp\ykvbphfmiswk	24%	ReversingLabs	Win64.Trojan.Ulise
C:\Users\user\AppData\Roaming\PatchReaderWCF\AXE8SharedExpat.dll	30%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\PatchReaderWCF\BIB.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcp90.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcr90.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\PatchReaderWCF\sqlite.dll	0%	ReversingLabs
C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe	45%	ReversingLabs	Win32.Trojan.Rugmi
C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AXE8SharedExpat.dll	30%	ReversingLabs	Win32.Trojan.Generic
C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe	0%	ReversingLabs
C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\BIB.dll	0%	ReversingLabs
C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\Quadruple.dll	0%	ReversingLabs
C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\msvcp90.dll	0%	ReversingLabs
C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\msvcr90.dll	0%	ReversingLabs
C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\sqlite.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://tataragirld.site/_	0%	Avira URL Cloud	safe
https://tataragirld.site/#	0%	Avira URL Cloud	safe
https://tataragirld.site:443N	0%	Avira URL Cloud	safe
http://www.softwareok.de/?Download=Find.Same.Images.OK	0%	Avira URL Cloud	safe
https://tataragirld.site/xt	0%	Avira URL Cloud	safe
https://tataragirld.site/ht	0%	Avira URL Cloud	safe
https://tataragirld.site/(t	0%	Avira URL Cloud	safe
https://tataragirld.site/$t	0%	Avira URL Cloud	safe
https://tataragirld.site/0t	0%	Avira URL Cloud	safe
https://tataragirld.site/dt	0%	Avira URL Cloud	safe
http://www.softwareok.de/?Freeware/Find.Same.Images.OK	0%	Avira URL Cloud	safe
https://tataragirld.site/G	0%	Avira URL Cloud	safe
https://tataragirld.site/Lt	0%	Avira URL Cloud	safe
http://www.softwareok.de/?Freeware/Find.Same.Images.OK/History	0%	Avira URL Cloud	safe
https://tataragirld.site/	0%	Avira URL Cloud	safe
http://www.softwareok.de/?seite=faq-Find.Same.Images.OK&faq=0	0%	Avira URL Cloud	safe
https://tataragirld.site/4t	0%	Avira URL Cloud	safe
https://tataragirld.site/C	0%	Avira URL Cloud	safe
https://tataragirld.site/Pt	0%	Avira URL Cloud	safe
https://tataragirld.site:443	0%	Avira URL Cloud	safe
https://tataragirld.site/k	0%	Avira URL Cloud	safe
https://tataragirld.site/Tt	0%	Avira URL Cloud	safe
https://tataragirld.site:443$	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
tataragirld.site	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://tataragirld.site/(t	LocalCtrl_alpha_v3.exe, 00000009.00000003.3374697259.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3375051072.000000000056A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site/ht	LocalCtrl_alpha_v3.exe, 00000009.00000003.3374697259.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3375051072.000000000056A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vmware.com/0	AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.softwareok.com/?Freeware/Find.Same.Images.OK/History	LocalCtrl_alpha_v3.exe, 00000009.00000000.2413435727.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000002.3946528871.00000001401F4000.00000002.00000001.01000000.00000015.sdmp	false		high
https://tataragirld.site/_	LocalCtrl_alpha_v3.exe, 0000000E.00000003.3842004816.00000000004CA000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3750803387.00000000004C9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site:443N	LocalCtrl_alpha_v3.exe, 0000000E.00000003.3750803387.00000000004D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.softwareok.com/?Freeware/Find.Same.Images.OK	LocalCtrl_alpha_v3.exe, 00000009.00000000.2413435727.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000002.3946528871.00000001401F4000.00000002.00000001.01000000.00000015.sdmp	false		high
https://tataragirld.site/#	LocalCtrl_alpha_v3.exe, 0000000E.00000003.3842004816.00000000004CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.softwareok.de/?Download=Find.Same.Images.OK	LocalCtrl_alpha_v3.exe, 00000009.00000000.2413435727.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000002.3946528871.00000001401F4000.00000002.00000001.01000000.00000015.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site/$t	LocalCtrl_alpha_v3.exe, 00000009.00000003.3374697259.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3375051072.000000000056A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site/dt	LocalCtrl_alpha_v3.exe, 00000009.00000003.3193363622.000000000056A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3193243380.000000000055E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vmware.com/0/	AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tataragirld.site/xt	LocalCtrl_alpha_v3.exe, 00000009.00000003.3283935129.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3374697259.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3374470346.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3375051072.000000000056A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.softwareok.com/?seite=faq-Find.Same.Images.OK&faq=0	LocalCtrl_alpha_v3.exe, 00000009.00000000.2413435727.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000002.3946528871.00000001401F4000.00000002.00000001.01000000.00000015.sdmp	false		high
http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor	1wrLmYiC62.exe, 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmp, 1wrLmYiC62.exe, 00000000.00000000.2088510327.00000000006EB000.00000002.00000001.01000000.00000003.sdmp, 1wrLmYiC62.exe, 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmp, 1wrLmYiC62.exe, 00000002.00000000.2091786444.000000000012B000.00000002.00000001.01000000.00000005.sdmp	false		high
http://www.???.xx/?search=%s	AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3741565561.00000001401E0000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tataragirld.site/0t	LocalCtrl_alpha_v3.exe, 00000009.00000002.3733229961.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3647712222.000000000055E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site/4t	LocalCtrl_alpha_v3.exe, 00000009.00000002.3733229961.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3647712222.000000000055E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.softwareok.de/?Freeware/Find.Same.Images.OK	LocalCtrl_alpha_v3.exe, 00000009.00000000.2413435727.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000002.3946528871.00000001401F4000.00000002.00000001.01000000.00000015.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site/	LocalCtrl_alpha_v3.exe, 0000000E.00000003.3297283306.00000000004C4000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3206723699.00000000004C6000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3569058174.00000000004BE000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3569136089.00000000004C8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3842004816.00000000004CA000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3478635056.00000000004CA000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3750803387.00000000004C9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site/Lt	LocalCtrl_alpha_v3.exe, 00000009.00000003.2921096864.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3011647384.000000000055E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tataragirld.site/C	LocalCtrl_alpha_v3.exe, 0000000E.00000003.3297283306.00000000004C4000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3206723699.00000000004C6000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3478635056.00000000004CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.softwareok.de/?seite=faq-Find.Same.Images.OK&faq=0	LocalCtrl_alpha_v3.exe, 00000009.00000000.2413435727.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000002.3946528871.00000001401F4000.00000002.00000001.01000000.00000015.sdmp	false	Avira URL Cloud: safe	unknown
http://www.softwareok.de	AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3741565561.00000001401E0000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tataragirld.site/G	LocalCtrl_alpha_v3.exe, 0000000E.00000003.3569058174.00000000004BE000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3569136089.00000000004C8000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3750803387.00000000004C9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.info-zip.org/	AdobeSync.exe, 00000003.00000002.2119480902.0000000008650000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007BF0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053AD000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.00000000025CE000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.00000000083BA000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.00000000055F3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.softwareok.de/?Freeware/Find.Same.Images.OK/History	LocalCtrl_alpha_v3.exe, 00000009.00000000.2413435727.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000002.3946528871.00000001401F4000.00000002.00000001.01000000.00000015.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site/Xt	LocalCtrl_alpha_v3.exe, 00000009.00000003.3556740509.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3556872591.000000000056A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tataragirld.site/k	LocalCtrl_alpha_v3.exe, 0000000E.00000003.3842004816.00000000004CA000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3750803387.00000000004C9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.softwareok.com/?Download=Find.Same.Images.OK	LocalCtrl_alpha_v3.exe, 00000009.00000000.2413435727.00000001401F4000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000002.3946528871.00000001401F4000.00000002.00000001.01000000.00000015.sdmp	false		high
http://www.surfok.de/	cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tataragirld.site:443	LocalCtrl_alpha_v3.exe, 00000009.00000002.3733507550.0000000000595000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3011647384.0000000000542000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3647537126.0000000000591000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.2830377438.0000000000542000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3647633975.0000000000594000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.2921096864.0000000000542000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3388102212.00000000004D2000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3750803387.00000000004D2000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3569058174.00000000004D2000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3478540910.00000000004D2000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000002.3938079354.00000000004D2000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 0000000E.00000003.3932851789.00000000004D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tataragirld.site/Pt	LocalCtrl_alpha_v3.exe, 00000009.00000003.3466041227.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3102576742.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3102237598.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3011963405.000000000055E000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3466241274.000000000056A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.softwareok.com	AdobeSync.exe, 00000003.00000002.2119480902.00000000086A6000.00000004.00000020.00020000.00000000.sdmp, AdobeSync.exe, 00000004.00000002.2179011035.0000000007C46000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000005.00000002.2494000967.00000000053F6000.00000004.00000800.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3741565561.00000001401E0000.00000002.00000001.01000000.00000015.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733856347.0000000002617000.00000004.00000001.00020000.00000000.sdmp, AdobeSync.exe, 0000000B.00000002.2555590828.0000000008410000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000C.00000002.2780690846.000000000563C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tataragirld.site/Tt	LocalCtrl_alpha_v3.exe, 00000009.00000003.3193363622.000000000056A000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3193243380.000000000055E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://appsyndication.org/2006/appsyn	1wrLmYiC62.exe	false		high
https://tataragirld.site:443$	LocalCtrl_alpha_v3.exe, 00000009.00000003.3556953483.0000000000594000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000002.3733507550.0000000000595000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3556649826.0000000000591000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3647537126.0000000000591000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3647633975.0000000000594000.00000004.00000020.00020000.00000000.sdmp, LocalCtrl_alpha_v3.exe, 00000009.00000003.3647206478.0000000000591000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1586714
Start date and time:	2025-01-09 14:53:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1wrLmYiC62.exe renamed because original name is a hash value
Original Sample Name:	dd53ac67d905defd4bd1f2b9b413dfc679e7c076e92792be650c38659e1557c5.exe
Detection:	MAL
Classification:	mal84.evad.winEXE@18/26@13/0
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 99% Number of executed functions: 114 Number of non-executed functions: 267
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target AdobeSync.exe, PID 6504 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 1wrLmYiC62.exe

Simulations

Behavior and APIs

Time	Type	Description
14:54:35	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BIT87CA.tmp
14:54:48	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\helpmonitorv3.lnk

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe	K3UtwU3CH9.msi	Get hash	malicious	Unknown	Browse
	24EPV9vjc5.exe	Get hash	malicious	Unknown	Browse
	VmjvNTbD5J.exe	Get hash	malicious	Unknown	Browse
	vV5EOx0ipU.exe	Get hash	malicious	Unknown	Browse
	kXzODlqJak.exe	Get hash	malicious	Unknown	Browse
	8Rmoal0v85.exe	Get hash	malicious	Unknown	Browse
	cLm7ThwEvh.msi	Get hash	malicious	Unknown	Browse
	LVkAi4PBv6.exe	Get hash	malicious	Unknown	Browse
	w3245.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2364728
Entropy (8bit):	6.606009669324617
Encrypted:	false
SSDEEP:	49152:lbCT2kOGRpfJMi3kLRQrjYgeeZyTDwMHfDYZNBi:TkOKMiY0BZMHfDYZNBi
MD5:	967F4470627F823F4D7981E511C9824F
SHA1:	416501B096DF80DDC49F4144C3832CF2CADB9CB2
SHA-256:	B22BF1210B5FD173A210EBFA9092390AA0513C41E1914CBE161EB547F049EF91
SHA-512:	8883EAD428C9D4B415046DE9F8398AA1F65AE81FE7945A840C822620E18F6F9930CCE2E10ACFF3B5DA8B9C817ADE3DABC1DE576CBD255087267F77341900A41C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: K3UtwU3CH9.msi, Detection: malicious, Browse Filename: 24EPV9vjc5.exe, Detection: malicious, Browse Filename: VmjvNTbD5J.exe, Detection: malicious, Browse Filename: vV5EOx0ipU.exe, Detection: malicious, Browse Filename: kXzODlqJak.exe, Detection: malicious, Browse Filename: 8Rmoal0v85.exe, Detection: malicious, Browse Filename: cLm7ThwEvh.msi, Detection: malicious, Browse Filename: LVkAi4PBv6.exe, Detection: malicious, Browse Filename: w3245.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:<..To..To..To.:.o..To...o..To.:9o..To.:.o..To.:/o..To..Uoe.To...o\|.To...o..To...o..To...o..ToRich..To................PE..d...^.?e..........#......H.....................@..............................%.....h.$.....................................................XW..,........q...p..$h....#.8)......................................(....................`...............................text...RG.......H.................. ..`.rdata..R/...`...0...L..............@..@.data................\|..............@....pdata..$h...p...j..................@..@Shared...............p..............@....tls.................x..............@....rsrc....q.......r...z..............@..@................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Scabbard_20250109085418.log

Download File

Process:	C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	976
Entropy (8bit):	5.417548003043205
Encrypted:	false
SSDEEP:	24:A8ybAIeLLzjo8cxpF3N8ScP2nxh8ScP2zB8ScP2cD+B8ScP208ScP2W:A80xYU8cxJ8dSxh8d+B8dbqB8df8d1
MD5:	A9C961A693ABB0F9BABD805E0B091BEA
SHA1:	176E1A4DCF18D9C9AC6FF6210ADAE86467346E9B
SHA-256:	8F71F15DA38820E6EA592DD5B14476C202DC54ABA6A089D66ECB9B4843960233
SHA-512:	9961FE17A5C8F8175D1028D7F4700DC11500C4361C02CBD8A92BC90EA369ED4826AF4E5847881ADC4BE37779C9117F216E73CE7140BE4C01EBB4E68F76B5A7EA
Malicious:	false
Preview:	[1540:0574][2025-01-09T08:54:18]i001: Burn v3.11.1.2318, Windows v10.0 (Build 19045: Service Pack 0), path: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe..[1540:0574][2025-01-09T08:54:18]i009: Command Line: '-burn.clean.room=C:\Users\user\Desktop\1wrLmYiC62.exe -burn.filehandle.attached=512 -burn.filehandle.self=532'..[1540:0574][2025-01-09T08:54:18]i000: Setting string variable 'WixBundleOriginalSource' to value 'C:\Users\user\Desktop\1wrLmYiC62.exe'..[1540:0574][2025-01-09T08:54:18]i000: Setting string variable 'WixBundleOriginalSourceFolder' to value 'C:\Users\user\Desktop\'..[1540:0574][2025-01-09T08:54:18]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user\AppData\Local\Temp\Scabbard_20250109085418.log'..[1540:0574][2025-01-09T08:54:18]i000: Setting string variable 'WixBundleName' to value 'Scabbard'..[1540:0574][2025-01-09T08:54:18]i000: Setting string variable 'WixBundleManufacturer' to value 'Ravine'..

C:\Users\user\AppData\Local\Temp\b2747b23

Download File

Process:	C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
File Type:	data
Category:	dropped
Size (bytes):	5661033
Entropy (8bit):	7.71574697919055
Encrypted:	false
SSDEEP:	98304:fKzZt3YwnpfJWgaV5krmIu9aTVoKKx1/wbFayC7dpHNYZE8MPUIY:fKzUw4gaYrmIu9c9aVbZNf8MNY
MD5:	2DED830D4AE5AD04F34212B3A7663F6E
SHA1:	658563768197F71A9E63D91671B9F898B8787899
SHA-256:	136E803148910F1A7F162692BEDD10597FD9BA2B08345BE373CB5D0A40AC3917
SHA-512:	98D4061A8F13D605B94E081C648B50C9964CE581B36D24310E6A2A253E35F189294497C534ED85E778AA059BB8CB6750EBC21E02F3A96CFA1FDAD948397FCEC6
Malicious:	false
Preview:	.\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..=..=... ...................\....................\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|.............\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|...............\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..+..5...1........(..........\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|.N...I..K..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|.

C:\Users\user\AppData\Local\Temp\c83ee8cc

Download File

Process:	C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
File Type:	data
Category:	dropped
Size (bytes):	5661033
Entropy (8bit):	7.715746714038714
Encrypted:	false
SSDEEP:	98304:5KzZt3YwnpfJWgaV5krmIu9aTVoKKx1/wbFayC7dpHNYZE8MPUIY:5KzUw4gaYrmIu9c9aVbZNf8MNY
MD5:	7363A815ADC2B95CD03D0BA9F748B781
SHA1:	3A62C94934427FA3A06FD2E91BE3AF45B86DF9E4
SHA-256:	7872EE8E2DE7ED8A69C0693EBE8377E40E9A53436A489D518C6E73F3B2794341
SHA-512:	53675403F995A63847C9D560667EC7FB05510961A7FA9807226841383B5C27B0138EA4DCAD67E8E87FE36669F5408EACFB7A9BB45253DFDBB74858EFFE40AFE9
Malicious:	false
Preview:	.\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..=..=... ...................\....................\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|.............\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|...............\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..+..5...1........(..........\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|.N...I..K..\|..\|..\|..\|..\|..\|..\|..\|..\|..\|.

C:\Users\user\AppData\Local\Temp\lrx

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2564608
Entropy (8bit):	6.715211244010203
Encrypted:	false
SSDEEP:	49152:JHp7RN0VYNfwgYt2uEHdFcX+oZFQ/IYAXHCo8Fq9VZO3tvZSLLtZ2mhVDKFKRwCL:LwQJc7XHb3742p
MD5:	2B37DF2D59558C43AB3A09B85A42C9D5
SHA1:	7595E1B746FDD08F8F39906EF39DE1B249046D67
SHA-256:	E4D978C57CE320AF357A320024F8B75D0D677501DF1BE715623FAF4DDA061CDE
SHA-512:	CAE560D8FA95224A6E5311E53AB030B4ED627115F324D2EC74DDFB2C195B9B9D47E00091195610BFB8441F365CC6AF7C93400F80F2E5BE14B0FBCA8A8120A3B3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....C.b.................(!...'.....W..........@..............................1.......'...`... ..............................................01......`1.8....P&..t...........p1..............................C&.(...................p11..............................text....'!......(!.................`..`.data........@!......,!.............@....rdata..p9...."..:....!.............@..@.pdata...t...P&..v...0&.............@..@.xdata..hW....&..X....&.............@..@.bss.........0'..........................idata.......01.......&.............@....CRT....0....@1.......'.............@....tls.........P1.......'.............@....rsrc...8....`1.......'.............@..@.reloc.......p1.......'.............@..Bubpux.... ....1.......'.............@...................................................................................................................................

C:\Users\user\AppData\Local\Temp\tgiwin

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Jan 9 12:54:20 2025, mtime=Thu Jan 9 12:54:20 2025, atime=Fri Jan 3 12:50:46 2025, length=1219488, window=hide
Category:	dropped
Size (bytes):	922
Entropy (8bit):	5.040125542919878
Encrypted:	false
SSDEEP:	24:868fd8cZ++UHAeYRqs8AdAyUgHAeYptm:868i9LAeqq4dAmAeA
MD5:	3E5BB041C42C51E6DC07C1B89FF7D4B3
SHA1:	D426C79609467C8CB937CC7AAB73A7194C0C34BE
SHA-256:	9B6C83862DDC9D40D13020952AC350EDE56C838D7E1E08ADEC4A9F254FA47504
SHA-512:	41FC9A55CCBA81C023DE8501C31F32774CA080B94F434411C2F7413D4669B17D7633AAF0CE67C26C6EFEE1241C5F4FE1E3C99E9FB55F230AF4CB236ED3F65D16
Malicious:	false
Preview:	L..................F.... .....#..b....U..b.....}.]............................:..DG..Yr?.D..U..k0.&...&...... M.......t..b..b.y..b......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl)Z.n....B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....)Z.n..Roaming.@......DWSl)Z.n....C.....................z^+.R.o.a.m.i.n.g.....f.1.....)Z.n..PATCHR~1..N......)Z.n)Z.n....Q......................$..P.a.t.c.h.R.e.a.d.e.r.W.C.F.....h.2.....#ZWn .ADOBES~1.EXE..L......)Z.n)Z.n....s.........................A.d.o.b.e.S.y.n.c...e.x.e.......k...............-.......j....................C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe..*.....\.....\.R.o.a.m.i.n.g.\.P.a.t.c.h.R.e.a.d.e.r.W.C.F.\.A.d.o.b.e.S.y.n.c...e.x.e.`.......X.......305090...........hT..CrF.f4... .m.2=.b...,...W..hT..CrF.f4... .m.2=.b...,...W..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Local\Temp\ykvbphfmiswk

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2564608
Entropy (8bit):	6.715211244010203
Encrypted:	false
SSDEEP:	49152:JHp7RN0VYNfwgYt2uEHdFcX+oZFQ/IYAXHCo8Fq9VZO3tvZSLLtZ2mhVDKFKRwCL:LwQJc7XHb3742p
MD5:	2B37DF2D59558C43AB3A09B85A42C9D5
SHA1:	7595E1B746FDD08F8F39906EF39DE1B249046D67
SHA-256:	E4D978C57CE320AF357A320024F8B75D0D677501DF1BE715623FAF4DDA061CDE
SHA-512:	CAE560D8FA95224A6E5311E53AB030B4ED627115F324D2EC74DDFB2C195B9B9D47E00091195610BFB8441F365CC6AF7C93400F80F2E5BE14B0FBCA8A8120A3B3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....C.b.................(!...'.....W..........@..............................1.......'...`... ..............................................01......`1.8....P&..t...........p1..............................C&.(...................p11..............................text....'!......(!.................`..`.data........@!......,!.............@....rdata..p9...."..:....!.............@..@.pdata...t...P&..v...0&.............@..@.xdata..hW....&..X....&.............@..@.bss.........0'..........................idata.......01.......&.............@....CRT....0....@1.......'.............@....tls.........P1.......'.............@....rsrc...8....`1.......'.............@..@.reloc.......p1.......'.............@..Bubpux.... ....1.......'.............@...................................................................................................................................

C:\Users\user\AppData\Roaming\PatchReaderWCF\AXE8SharedExpat.dll

Download File

Process:	C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	168960
Entropy (8bit):	6.635989544957891
Encrypted:	false
SSDEEP:	3072:mm3ITKGHS4tcdKwmcOTw1hOqLKpJzadzwxxYBcdgNqbeBTg4vRPzr4zvRjN:mVTxS4tcdKVw1iB8AxrGqG4J
MD5:	77610CBDCAC173785E2FB18CCB522574
SHA1:	315E7DE9D5DA5C13364D6A5E90C7EFF80A15DA48
SHA-256:	40CE54280DBA1A8F029F4A8AFDD19F5D898CE4A221104ED6F9B0F619D54F912F
SHA-512:	AA81C82F122D75B3DCA6993A69C051779F9E63E1006E1B3AAB3C6E1A82AF66BBB100CF091A160049C6B041E53ADA6AF71033FC23ED1EA8888F9F3C161FA11206
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 30%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r..P.n.P.n.P.n.Yk..D.n.w...S.n.P.o...n.Yk.w.n.Yk...n.Yk..Q.n.NA..Q.n.Yk..Q.n.RichP.n.........PE..L....;.L...........!.................W..............................................1&....@..........................h......Lc..(...................................................................`X..@............................................text...$........................... ..`.rdata..bi.......j..................@..@.data...X#...p.......P..............@....rsrc................f..............@..@.reloc...$.......&...n..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe

Download File

Process:	C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1219488
Entropy (8bit):	6.312582930861741
Encrypted:	false
SSDEEP:	24576:+heavSigvk0vhkzswHD4/V3OQdnYKYc4wXUyuy1:qP710vezrj4dJYFYUyuy1
MD5:	F778E9136AB0DB9DE9802A7043DE50A7
SHA1:	850DCA074534A14FDB9ADA6AFACEEA88558764E0
SHA-256:	90803A583E9F693DE5E7B8A196832436F6F648B27FB82E55904C256F30CC8B3A
SHA-512:	CD6C5C3537F05AD5826D503E38B8E6EF2EAF668616BEC15BA51AD3D81E0337A72779D7CA6AF9E8EBEE12D713891B30C0B73BF34718552BC9F4E7D8909B998156
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................%.l....o...D.....y....p...D.....i.......D.....~......n....k...Rich....................PE..L....oEM.........."..................z............@......................................@.................................T...\|.......h.......................d................................... +..@............................................text............................... ..`.rdata..............................@..@.data...........v..................@....rsrc...h............V..............@..@.reloc..:............p..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\PatchReaderWCF\BIB.dll

Download File

Process:	C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	110472
Entropy (8bit):	6.411600464209584
Encrypted:	false
SSDEEP:	3072:FeQixAO/A/0VSaGHvP5GeBTEpP2t31VrxrcZ0KOKbfQp:uKO+0VSnKOKbop
MD5:	759D71FC9442AB5A9B5749C0F6C0C263
SHA1:	07A68C6922D443EB9D6D445DA18AE8A6D92F7AC6
SHA-256:	109647F58E7E8386A4C025F2C8175A4D638E5C0E62768953390764010EA22A2E
SHA-512:	E3EFE66C76EA81285BA01B1978FDB3E807EB0BF2CFE0373BB6FEF06F2FD7D9DDC3269ACF0D87517CBF9BEA5FA09B2703A03792491DC8265D26B724D7DCA106C7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............T..T..T..rT..TO.wT..T..tT..T..bT...T._.T..T..T...T..eT..T..sT..T..uT..T..pT..TRich..T................PE..L......L...........!.................j..............................................K.....@.............................j....{..<...................................................................(/..@............................................text............................... ..`.rdata..Js.......t..................@..@.data...,............j..............@....rsrc................t..............@..@.reloc...............\|..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\PatchReaderWCF\choirgirl.pdf

Download File

Process:	C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe
File Type:	data
Category:	dropped
Size (bytes):	62969
Entropy (8bit):	4.539146899101455
Encrypted:	false
SSDEEP:	1536:wtVMpSzCLmJZriRxBfJJXWT/5F0Oy+loZ:wvuSJhEHfJJGT/5F0v+SZ
MD5:	9076AB572C60AAB6B113F4F9108A9CC8
SHA1:	1439248640CE9418B5BA13862160DFA00364390B
SHA-256:	1E5750FFBDC77FCE17521A2EF5754A998B002A87E9036B1157FC2A63DD91C30D
SHA-512:	B42B6162930A5CB9B0FEBC5CE1C6FD5EEF7B02AD041C302820541968EE5FFF1B779D60BDC458B5539B9AEF2F9169F493392A8CD819F435F10D71941A55761287
Malicious:	false
Preview:	t..T...N.mJ..L..x...o.sF.y.w.SOZD.....giq.[.hU\g\Aa[i..VOBib...[.Lok.G.oRgl.l..SLcn.L...D.o..tO...Z.m.[]......Bo`]FL.[....MV..d.n^.W..j.X.._.n.\.U..crq..`YJRSTd.s\T.R...p....M..kS[.....I.c..pV.v..b.^.q`........M.tpY..b.j.R.i..x..gtO.n.p..Q.\..ug...aR.v[.Gg^.jWa..lhX.QL.fB....Qu.gZ.EK.....Wl.gi.ndP....E\.UHo.O..E..u...i...LF.iqMdJ.W...xgVjkqT..RWu.B].q...W.P.D..V.L..^\ecT...[Vv..F..pp.Ae...q.Ge.f[Msm.J.S.[S.dDGmp\J.vKB....NA.Eiqfu\B.P.M\.Pdo.......Pg..k.wdf...l.e....QG^.E.P......EAB..g.X.s...Y...VbZWe..`.g.......C..Lp.J..r...K.^.fS...k..Y`V.r...O.p.TY.X.R..C...hhR.wqPA..o_hMR..m...nIwiHqCfYq^.dhD...]^.\A.iW.j..dk.cn...]P\ag..cU..xxuAdS].t....S.wU.T.SA.l.yt...N.Q..b...`tyraG.....Za...cC.\n.xa.A..qw.A.K...Yk...p.E....bo.S..Z..ag[fB.L.t..G..w..jw.N.WN.....Q[T.q.rbQZg.Zxg..g..YplESQZQ^wo..d.u._..g._LqVlKcXSS..aOr.`r...f.is..pa...W..s.lVL..b.......ZOSCyu.m..b.rJ..n..u.tr..aB...x[o..Rp..mX.hRIr...R..G..n.V_.S.D.......jsqks.Nh.bRy.Z..f.Nld.`.HU.......G\_.MR..\...y..nJEd.dhh...SIXA..G..J^..xWej

C:\Users\user\AppData\Roaming\PatchReaderWCF\intermixture.zip

Download File

Process:	C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe
File Type:	data
Category:	dropped
Size (bytes):	4526833
Entropy (8bit):	7.959653744732072
Encrypted:	false
SSDEEP:	98304:9M79mFIVQgIBckuHqM4KVqnl8dAQiORny+fRt:91MQgIBcksVqKdALO9t
MD5:	3085505DB1512B966530B829E136BDCF
SHA1:	C105A4CB691CC2302878C71BE8D375E4018CDB29
SHA-256:	2B85E3A5C3DA072A33AB1372B102EDD4AF6D02D8B74A3E5C949B3F9E628521B7
SHA-512:	5A1FD3C4A534C00246C2A7CB9B92775E70FFB02653B2E2F442852466B5558D7B5D88168284F4EA20E528523B2ADD9907EF37077F20DB79EB27285E045CF13A72
Malicious:	false
Preview:	luC.G..eR.SU..d...\\.m.ZMH....pj]gI..tj.xf.AFD.Xr.tH...J..g.wL.W.myBY..et.\ADg.........JXNvi.`l`.]FD.I..G.d.[...O.UF.p..[.w._..H.bq.Ix...lw].fW...iUri.A.vg.gTZD..f..H.NYcJ`pH.vJi..Pi..i........mwomuu.E.....tjS...FpI..E.Ua..SFl].F.\.^IU....gL]....b..iM`.....O.A.c.K......xt..jwC.`N..Da....mt].C]GA.jL.H.J.....\E..YNg...LK.q....rhg..Wi..MwF..ikT..J...F.h.w..p.GKrDOo...g..uUPU.Zp.]......P.Z.v..fUhmS..WL..o.xC..d.C.YynN.`.XyUHG.`...]eL.m...Z.^.....D..sF..SY.K\..Yn...t.q.W...Yik.v...Fwp...iQ.s..IM.t......Ch..U..JO.V...xtv.b.M.I......uW....K[.i....SK..i.....E.NvaqC........Fe..u.G...dd.T..rf....JLw......W[.H.K.T..\g.oi.....R.La.X..G.o.CBF..ApN..].J.Vk.[.AJ.m....P..h[Vr..Q^h...Ynx...R..Z.j.yo..HZE.....M..F...c....tJ..WK.C....S.S.nF.j.....FJ.G...[q^.M..vMM.....b.Ei.G...o.HW..LD].....thM....J`Kt.L.oL.m.cFn.j.i._..fsR...X.....l.....J.McHim^.x...I.Y.lT.`B....M.].i..Hv.IJv.s.....psL..Y.TY.EN`..ol.^..sl..V......vG...Y...Ni.SOaDCS....v..R.GxE....TtoQ.b...R.YWrXpp..`R^.od.w..i..kt.y...H.xd..Wy.W.w.AO.Vj

C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcp90.dll

Download File

Process:	C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	570496
Entropy (8bit):	6.5259314477231305
Encrypted:	false
SSDEEP:	12288:BpFE340h3e34GVZQACkIPYhUgiW6QR7t5183Ooc8SHkC2eLgAfO:Bph0h3e3vgzPA83Ooc8SHkC2eLgAfO
MD5:	90A32D8E07F7FB3D102EAB1DA28F0723
SHA1:	0903911BBB5D00F68BA51895FA898B38A5453DED
SHA-256:	004ED24507DC7307CEC1A3732FA57EABF19E918C3E1B54561E6CC01F554C0B77
SHA-512:	2C69586D5C5D2B4B5DECF2BF479554C3D0FF5F5A6FBACB01B8583EA8D96D0AE9C850C30A0D43EB2AD1116BE901578D15FE08FCE3E505440C854082C208A79F1A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....i[...........!.....4...p..............P....Hx......................................@..........................P..,....E..<...............................D3...................................%..@............................................text....2.......4.................. ..`.data...t'...P.......8..............@....rsrc................R..............@..@.reloc..HC.......D...V..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcr90.dll

Download File

Process:	C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	653952
Entropy (8bit):	6.885961951552677
Encrypted:	false
SSDEEP:	12288:5hr4UC+Ju/A0BI4yWkoGKJwZ9axKmhYTMAO7wFKjCUmRyyPe:9JfyZFGKJjxKmhSMAB6CUmRyyPe
MD5:	11D49148A302DE4104DED6A92B78B0ED
SHA1:	FD58A091B39ED52611ADE20A782EF58AC33012AF
SHA-256:	CEB0947D898BC2A55A50F092F5ED3F7BE64AC1CD4661022EEFD3EDD4029213B0
SHA-512:	FDC43B3EE38F7BEB2375C953A29DB8BCF66B73B78CCC04B147E26108F3B650C0A431B276853BB8E08167D34A8CC9C6B7918DAEF9EBC0A4833B1534C5AFAC75E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....i[...........!.....\..........@-.......p....Rx.........................0......?T....@..............................\|..P...(................................3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\PatchReaderWCF\sqlite.dll

Download File

Process:	C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	249232
Entropy (8bit):	6.822042592978165
Encrypted:	false
SSDEEP:	6144:hiDoxpdJLEfunorfdoU9nxGIndwR7j0E3/AE6u6J:QDApalrGIdwR7jZ3/B6/J
MD5:	596439B3A9F9EA44FF28E2974F69AB07
SHA1:	A2074CD3D39045902F82A072455420AB7101A036
SHA-256:	8CC91D57D45B46B3439EAA017BF1DEB8E177F15245BA6F18EBCF2BD0A173A4F3
SHA-512:	1DE8D41FEC0844999B88C0CB738AAC71C0AE895A51E91F6465AFAA864537E692E4576E6699B4976E62AA2C38EF9125D9AAF09A72ACAA068A0C2B05D413AF858A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..2...a...a...a..ua...a..sa...a..ba...a!..a...a...aQ..a..ea...a..ta...a..ra...a..wa...aRich...a........PE..L......L.........."!................l#.......0............................................@.............................5.......<...................................................................@...@............0..d............................text............................... ..`.rdata..Er...0...t..................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe

Download File

Process:	C:\Users\user\Desktop\1wrLmYiC62.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6305325
Entropy (8bit):	7.9787714785946955
Encrypted:	false
SSDEEP:	196608:DfUMP3JauYusFpUjU+Xm7KdVY4aKo7TNn5QjvA:r58jucejnmkVY4zoZ5Qs
MD5:	9C540950F5A8981844FF33BFC55D2F36
SHA1:	8C70F2BCB995CE313843CF7103C659C12EB263DC
SHA-256:	DD53AC67D905DEFD4BD1F2B9B413DFC679E7C076E92792BE650C38659E1557C5
SHA-512:	7D87E02B60647134758F4C20BDB18A1DEF78BC9B69D337B6EE6D9B190968749D028479D0F6758CDFD8C76DF454F7AE68395A4EBDCB6D99CEA5B0B48CD5BA685B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A!.S.@...@...@......@.....y@......@..."\|..@..."{..@..."z.#@...8...@...8...@...@~.PA...#z.N@...#...@...@...@...#}..@..Rich.@..................PE..L......Z..........................................@.......................................@..................................................................`...=..Pv..T....................v......0p..@...................4........................text...7........................... ..`.rdata..`...........................@..@.data...0...........................@....wixburn8...........................@..@.rsrc...............................@..@.reloc...=...`...>..."..............@..B................................................................................................................................................................................................................................................

C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AXE8SharedExpat.dll

Download File

Process:	C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	168960
Entropy (8bit):	6.635989544957891
Encrypted:	false
SSDEEP:	3072:mm3ITKGHS4tcdKwmcOTw1hOqLKpJzadzwxxYBcdgNqbeBTg4vRPzr4zvRjN:mVTxS4tcdKVw1iB8AxrGqG4J
MD5:	77610CBDCAC173785E2FB18CCB522574
SHA1:	315E7DE9D5DA5C13364D6A5E90C7EFF80A15DA48
SHA-256:	40CE54280DBA1A8F029F4A8AFDD19F5D898CE4A221104ED6F9B0F619D54F912F
SHA-512:	AA81C82F122D75B3DCA6993A69C051779F9E63E1006E1B3AAB3C6E1A82AF66BBB100CF091A160049C6B041E53ADA6AF71033FC23ED1EA8888F9F3C161FA11206
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 30%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r..P.n.P.n.P.n.Yk..D.n.w...S.n.P.o...n.Yk.w.n.Yk...n.Yk..Q.n.NA..Q.n.Yk..Q.n.RichP.n.........PE..L....;.L...........!.................W..............................................1&....@..........................h......Lc..(...................................................................`X..@............................................text...$........................... ..`.rdata..bi.......j..................@..@.data...X#...p.......P..............@....rsrc................f..............@..@.reloc...$.......&...n..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe

Download File

Process:	C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1219488
Entropy (8bit):	6.312582930861741
Encrypted:	false
SSDEEP:	24576:+heavSigvk0vhkzswHD4/V3OQdnYKYc4wXUyuy1:qP710vezrj4dJYFYUyuy1
MD5:	F778E9136AB0DB9DE9802A7043DE50A7
SHA1:	850DCA074534A14FDB9ADA6AFACEEA88558764E0
SHA-256:	90803A583E9F693DE5E7B8A196832436F6F648B27FB82E55904C256F30CC8B3A
SHA-512:	CD6C5C3537F05AD5826D503E38B8E6EF2EAF668616BEC15BA51AD3D81E0337A72779D7CA6AF9E8EBEE12D713891B30C0B73BF34718552BC9F4E7D8909B998156
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................%.l....o...D.....y....p...D.....i.......D.....~......n....k...Rich....................PE..L....oEM.........."..................z............@......................................@.................................T...\|.......h.......................d................................... +..@............................................text............................... ..`.rdata..............................@..@.data...........v..................@....rsrc...h............V..............@..@.reloc..:............p..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\BIB.dll

Download File

Process:	C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	110472
Entropy (8bit):	6.411600464209584
Encrypted:	false
SSDEEP:	3072:FeQixAO/A/0VSaGHvP5GeBTEpP2t31VrxrcZ0KOKbfQp:uKO+0VSnKOKbop
MD5:	759D71FC9442AB5A9B5749C0F6C0C263
SHA1:	07A68C6922D443EB9D6D445DA18AE8A6D92F7AC6
SHA-256:	109647F58E7E8386A4C025F2C8175A4D638E5C0E62768953390764010EA22A2E
SHA-512:	E3EFE66C76EA81285BA01B1978FDB3E807EB0BF2CFE0373BB6FEF06F2FD7D9DDC3269ACF0D87517CBF9BEA5FA09B2703A03792491DC8265D26B724D7DCA106C7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............T..T..T..rT..TO.wT..T..tT..T..bT...T._.T..T..T...T..eT..T..sT..T..uT..T..pT..TRich..T................PE..L......L...........!.................j..............................................K.....@.............................j....{..<...................................................................(/..@............................................text............................... ..`.rdata..Js.......t..................@..@.data...,............j..............@....rsrc................t..............@..@.reloc...............\|..............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\BootstrapperApplicationData.xml

Download File

Process:	C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (473), with CRLF line terminators
Category:	dropped
Size (bytes):	2006
Entropy (8bit):	3.7572989677816073
Encrypted:	false
SSDEEP:	48:y+03qHhhO7YDTT3ne1REDHV5JC0wNqycUbTXRC+bLqihGrWrol:Xn7n6q80wMycsRCDKGrN
MD5:	ADBA259B1418C9ED84277688BFEEFAA7
SHA1:	A6EF522036403047FF578DEF1E0AFD616A277357
SHA-256:	6DF90329C4E3DF98DBB91556C98CDB46CD0258B49A500999284096A9DF972BDA
SHA-512:	9F90BD3C1892CE45870DE3FEC0F83516E5B61C1774024C03EC2BCDAEB7C8AC1F05536BF0403C77F520D8D39C0ACBE11769A32A3FE49571B71F1D4DCC5FCFFE66
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.W.i.x.B.u.n.d.l.e.P.r.o.p.e.r.t.i.e.s. .D.i.s.p.l.a.y.N.a.m.e.=.".S.c.a.b.b.a.r.d.". .L.o.g.P.a.t.h.V.a.r.i.a.b.l.e.=.".W.i.x.B.u.n.d.l.e.L.o.g.". .C.o.m.p.r.e.s.s.e.d.=.".n.o.". .I.d.=.".{.5.c.6.7.9.b.6.d.-.9.8.d.4.-.4.b.7.8.-.9.6.0.a.-.1.8.2.1.c.9.2.2.7.4.d.b.}.". .U.p.g.r.a.d.e.C.o.d.e.=.".{.6.C.D.E.7.8.E.C.-.4.C.1.C.-.4.6.A.B.-.B.B.E.9.-.9.7.4.6.B.E.0.D.7.F.8.6.}.". .P.e.r.M.a.c.h.i.n.e.=.".n.o.". ./.>..... . .<.W.i.x.P.a.c.k.a.g.e.P.r.o.p.e.r.t.i.e.s. .P.a.c.k.a.g.e.=.".S.l.u.i.t.". .V.i.t.a.l.=.".y.e.s.". .D.i.s.p.l.a.y.N.a.m.e.=.".P.y.t.h.o.n. .3...1.2...5. .E.x.e.c.u.t.a.b.l.e.s. .(.6.4.-.b.i.t.).". .D.o.w.n.l.o.a.d.S.i.z.e.=.".7.4.1.3.7.6.". .P.a.c.k.a.g.e.S.i.z.e.=.".7.4.1.3.7.6.".

C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\Quadruple.dll

Download File

Process:	C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	255392
Entropy (8bit):	6.5751135995470245
Encrypted:	false
SSDEEP:	6144:z7qdWWmoR0sztnfGIUbmUL1ueM+d9euhAOZD3FCP3z:Sssztnfu9ueM+doKX4P3z
MD5:	7C95B91566BA5A2D8BF70C2BCF13D712
SHA1:	B01F54AE2964480B8AEB2817285219AB8A2C79C0
SHA-256:	39230D24CF7602FF2B00A7FF13BA5160B9B3446FBA7C6F6295DD4FB2EB408DF5
SHA-512:	AB70A77C05EC42B77166D2E7FC81B18AD390E2CB32249F35355AFD4271AEDCFBDE882992AE0E84A9F95453CB9FD05AE224713EE3FDA93BABC6C9CFB572B50FAD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b.o.1.o.1.o.1...0.o.1...0.o.1...0.o.1...0.o.1...0.o.1...0.o.1...0.o.1.o.1.o.1...0.o.1...0.o.1..W1.o.1.o?1.o.1...0.o.1Rich.o.1................PE..L...C.3`.........."!.........R......................................................~.....@......................... .......,...x.......p........................(...`..p...................@a......p...@...................<...@....................text............................... ..`.rdata..N...........................@..@.data...............................@....rsrc...p...........................@..@.reloc...(.......*..................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\choirgirl.pdf

Download File

Process:	C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe
File Type:	data
Category:	dropped
Size (bytes):	62969
Entropy (8bit):	4.539146899101455
Encrypted:	false
SSDEEP:	1536:wtVMpSzCLmJZriRxBfJJXWT/5F0Oy+loZ:wvuSJhEHfJJGT/5F0v+SZ
MD5:	9076AB572C60AAB6B113F4F9108A9CC8
SHA1:	1439248640CE9418B5BA13862160DFA00364390B
SHA-256:	1E5750FFBDC77FCE17521A2EF5754A998B002A87E9036B1157FC2A63DD91C30D
SHA-512:	B42B6162930A5CB9B0FEBC5CE1C6FD5EEF7B02AD041C302820541968EE5FFF1B779D60BDC458B5539B9AEF2F9169F493392A8CD819F435F10D71941A55761287
Malicious:	false
Preview:	t..T...N.mJ..L..x...o.sF.y.w.SOZD.....giq.[.hU\g\Aa[i..VOBib...[.Lok.G.oRgl.l..SLcn.L...D.o..tO...Z.m.[]......Bo`]FL.[....MV..d.n^.W..j.X.._.n.\.U..crq..`YJRSTd.s\T.R...p....M..kS[.....I.c..pV.v..b.^.q`........M.tpY..b.j.R.i..x..gtO.n.p..Q.\..ug...aR.v[.Gg^.jWa..lhX.QL.fB....Qu.gZ.EK.....Wl.gi.ndP....E\.UHo.O..E..u...i...LF.iqMdJ.W...xgVjkqT..RWu.B].q...W.P.D..V.L..^\ecT...[Vv..F..pp.Ae...q.Ge.f[Msm.J.S.[S.dDGmp\J.vKB....NA.Eiqfu\B.P.M\.Pdo.......Pg..k.wdf...l.e....QG^.E.P......EAB..g.X.s...Y...VbZWe..`.g.......C..Lp.J..r...K.^.fS...k..Y`V.r...O.p.TY.X.R..C...hhR.wqPA..o_hMR..m...nIwiHqCfYq^.dhD...]^.\A.iW.j..dk.cn...]P\ag..cU..xxuAdS].t....S.wU.T.SA.l.yt...N.Q..b...`tyraG.....Za...cC.\n.xa.A..qw.A.K...Yk...p.E....bo.S..Z..ag[fB.L.t..G..w..jw.N.WN.....Q[T.q.rbQZg.Zxg..g..YplESQZQ^wo..d.u._..g._LqVlKcXSS..aOr.`r...f.is..pa...W..s.lVL..b.......ZOSCyu.m..b.rJ..n..u.tr..aB...x[o..Rp..mX.hRIr...R..G..n.V_.S.D.......jsqks.Nh.bRy.Z..f.Nld.`.HU.......G\_.MR..\...y..nJEd.dhh...SIXA..G..J^..xWej

C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\intermixture.zip

Download File

Process:	C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe
File Type:	data
Category:	dropped
Size (bytes):	4526833
Entropy (8bit):	7.959653744732072
Encrypted:	false
SSDEEP:	98304:9M79mFIVQgIBckuHqM4KVqnl8dAQiORny+fRt:91MQgIBcksVqKdALO9t
MD5:	3085505DB1512B966530B829E136BDCF
SHA1:	C105A4CB691CC2302878C71BE8D375E4018CDB29
SHA-256:	2B85E3A5C3DA072A33AB1372B102EDD4AF6D02D8B74A3E5C949B3F9E628521B7
SHA-512:	5A1FD3C4A534C00246C2A7CB9B92775E70FFB02653B2E2F442852466B5558D7B5D88168284F4EA20E528523B2ADD9907EF37077F20DB79EB27285E045CF13A72
Malicious:	false
Preview:	luC.G..eR.SU..d...\\.m.ZMH....pj]gI..tj.xf.AFD.Xr.tH...J..g.wL.W.myBY..et.\ADg.........JXNvi.`l`.]FD.I..G.d.[...O.UF.p..[.w._..H.bq.Ix...lw].fW...iUri.A.vg.gTZD..f..H.NYcJ`pH.vJi..Pi..i........mwomuu.E.....tjS...FpI..E.Ua..SFl].F.\.^IU....gL]....b..iM`.....O.A.c.K......xt..jwC.`N..Da....mt].C]GA.jL.H.J.....\E..YNg...LK.q....rhg..Wi..MwF..ikT..J...F.h.w..p.GKrDOo...g..uUPU.Zp.]......P.Z.v..fUhmS..WL..o.xC..d.C.YynN.`.XyUHG.`...]eL.m...Z.^.....D..sF..SY.K\..Yn...t.q.W...Yik.v...Fwp...iQ.s..IM.t......Ch..U..JO.V...xtv.b.M.I......uW....K[.i....SK..i.....E.NvaqC........Fe..u.G...dd.T..rf....JLw......W[.H.K.T..\g.oi.....R.La.X..G.o.CBF..ApN..].J.Vk.[.AJ.m....P..h[Vr..Q^h...Ynx...R..Z.j.yo..HZE.....M..F...c....tJ..WK.C....S.S.nF.j.....FJ.G...[q^.M..vMM.....b.Ei.G...o.HW..LD].....thM....J`Kt.L.oL.m.cFn.j.i._..fsR...X.....l.....J.McHim^.x...I.Y.lT.`B....M.].i..Hv.IJv.s.....psL..Y.TY.EN`..ol.^..sl..V......vG...Y...Ni.SOaDCS....v..R.GxE....TtoQ.b...R.YWrXpp..`R^.od.w..i..kt.y...H.xd..Wy.W.w.AO.Vj

C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\msvcp90.dll

Download File

Process:	C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	570496
Entropy (8bit):	6.5259314477231305
Encrypted:	false
SSDEEP:	12288:BpFE340h3e34GVZQACkIPYhUgiW6QR7t5183Ooc8SHkC2eLgAfO:Bph0h3e3vgzPA83Ooc8SHkC2eLgAfO
MD5:	90A32D8E07F7FB3D102EAB1DA28F0723
SHA1:	0903911BBB5D00F68BA51895FA898B38A5453DED
SHA-256:	004ED24507DC7307CEC1A3732FA57EABF19E918C3E1B54561E6CC01F554C0B77
SHA-512:	2C69586D5C5D2B4B5DECF2BF479554C3D0FF5F5A6FBACB01B8583EA8D96D0AE9C850C30A0D43EB2AD1116BE901578D15FE08FCE3E505440C854082C208A79F1A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....i[...........!.....4...p..............P....Hx......................................@..........................P..,....E..<...............................D3...................................%..@............................................text....2.......4.................. ..`.data...t'...P.......8..............@....rsrc................R..............@..@.reloc..HC.......D...V..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\msvcr90.dll

Download File

Process:	C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	653952
Entropy (8bit):	6.885961951552677
Encrypted:	false
SSDEEP:	12288:5hr4UC+Ju/A0BI4yWkoGKJwZ9axKmhYTMAO7wFKjCUmRyyPe:9JfyZFGKJjxKmhSMAB6CUmRyyPe
MD5:	11D49148A302DE4104DED6A92B78B0ED
SHA1:	FD58A091B39ED52611ADE20A782EF58AC33012AF
SHA-256:	CEB0947D898BC2A55A50F092F5ED3F7BE64AC1CD4661022EEFD3EDD4029213B0
SHA-512:	FDC43B3EE38F7BEB2375C953A29DB8BCF66B73B78CCC04B147E26108F3B650C0A431B276853BB8E08167D34A8CC9C6B7918DAEF9EBC0A4833B1534C5AFAC75E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....i[...........!.....\..........@-.......p....Rx.........................0......?T....@..............................\|..P...(................................3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\sqlite.dll

Download File

Process:	C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	249232
Entropy (8bit):	6.822042592978165
Encrypted:	false
SSDEEP:	6144:hiDoxpdJLEfunorfdoU9nxGIndwR7j0E3/AE6u6J:QDApalrGIdwR7jZ3/B6/J
MD5:	596439B3A9F9EA44FF28E2974F69AB07
SHA1:	A2074CD3D39045902F82A072455420AB7101A036
SHA-256:	8CC91D57D45B46B3439EAA017BF1DEB8E177F15245BA6F18EBCF2BD0A173A4F3
SHA-512:	1DE8D41FEC0844999B88C0CB738AAC71C0AE895A51E91F6465AFAA864537E692E4576E6699B4976E62AA2C38EF9125D9AAF09A72ACAA068A0C2B05D413AF858A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..2...a...a...a..ua...a..sa...a..ba...a!..a...a...aQ..a..ea...a..ta...a..ra...a..wa...aRich...a........PE..L......L.........."!................l#.......0............................................@.............................5.......<...................................................................@...@............0..d............................text............................... ..`.rdata..Er...0...t..................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9787714785946955
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	1wrLmYiC62.exe
File size:	6'305'325 bytes
MD5:	9c540950f5a8981844ff33bfc55d2f36
SHA1:	8c70f2bcb995ce313843cf7103c659c12eb263dc
SHA256:	dd53ac67d905defd4bd1f2b9b413dfc679e7c076e92792be650c38659e1557c5
SHA512:	7d87e02b60647134758f4c20bdb18a1def78bc9b69d337b6ee6d9b190968749d028479d0f6758cdfd8c76df454f7ae68395a4ebdcb6d99cea5b0b48cd5ba685b
SSDEEP:	196608:DfUMP3JauYusFpUjU+Xm7KdVY4aKo7TNn5QjvA:r58jucejnmkVY4zoZ5Qs
TLSH:	E1562332A5614033D7F206B3AD6891347EBCEF28175099A9E3D4BD1D6EB40923BB7253
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A!.S.@...@...@.......@......y@.......@..."\|..@..."{..@..."z.#@...8...@...8...@...@~.PA...#z.N@...#...@...@...@...#}..@..Rich.@.

File Icon


Icon Hash:	a9e8e8e9e8e8e8a9

Static PE Info

General

Entrypoint:	0x42e2a6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5A10AD86 [Sat Nov 18 22:00:38 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	d7e2fd259780271687ffca462b9e69b7

Entrypoint Preview

Instruction
call 00007FA5C0F4D6FFh
jmp 00007FA5C0F4D073h
mov eax, dword ptr [esp+08h]
mov ecx, dword ptr [esp+10h]
or ecx, eax
mov ecx, dword ptr [esp+0Ch]
jne 00007FA5C0F4D1EBh
mov eax, dword ptr [esp+04h]
mul ecx
retn 0010h
push ebx
mul ecx
mov ebx, eax
mov eax, dword ptr [esp+08h]
mul dword ptr [esp+14h]
add ebx, eax
mov eax, dword ptr [esp+08h]
mul ecx
add edx, ebx
pop ebx
retn 0010h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
cmp cl, 00000040h
jnc 00007FA5C0F4D1F7h
cmp cl, 00000020h
jnc 00007FA5C0F4D1E8h
shrd eax, edx, cl
shr edx, cl
ret
mov eax, edx
xor edx, edx
and cl, 0000001Fh
shr eax, cl
ret
xor eax, eax
xor edx, edx
ret
push ebp
mov ebp, esp
jmp 00007FA5C0F4D1EFh
push dword ptr [ebp+08h]
call 00007FA5C0F53A6Ch
pop ecx
test eax, eax
je 00007FA5C0F4D1F1h
push dword ptr [ebp+08h]
call 00007FA5C0F53AF5h
pop ecx
test eax, eax
je 00007FA5C0F4D1C8h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007FA5C0F4DA84h
jmp 00007FA5C0F4DA61h
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007FA5C0F4DA9Dh
pop ecx
pop ebp
ret
push ebp
mov ebp, esp
test byte ptr [ebp+08h], 00000001h
push esi
mov esi, ecx
mov dword ptr [esi], 00460DB8h
je 00007FA5C0F4D1ECh
push 0000000Ch
push esi
call 00007FA5C0F4D1BDh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x686b4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6d000	0x189ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x3dfc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x67650	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x676a4	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x67030	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4b000	0x3e0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x68234	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x49937	0x49a00	2319c0baa707bb66cc0bc08c55a13d8c	False	0.5314688561120543	data	6.570006046413636	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x4b000	0x1ed60	0x1ee00	8ad6c4e18165c6d8ccdc97bab683438d	False	0.3136386639676113	data	5.114228301263695	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x6a000	0x1730	0xa00	00fde973df27dc2d36084e16d6dddbdf	False	0.274609375	firmware 2005 v9319 (revision 0) N\346@\273\261\031\277D V2, 0 bytes or less, UNKNOWN2 0xffffffff, at 0 0 bytes , at 0 0 bytes , at 0x20a14600	3.1526594027632213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.wixburn	0x6c000	0x38	0x200	6a6fa226648aa5455d00e43308ab550f	False	0.107421875	data	0.5813091016060967	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x6d000	0x189ac	0x18a00	768107f716c3d4350e9c7978a9a75946	False	0.6123790450507615	data	7.16247135144247	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x86000	0x3dfc	0x3e00	dd2c47fa48872886af4c9a2e5bd90ccc	False	0.8097278225806451	data	6.794335469567533	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x6d2c8	0xaf05	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.00046869768999
RT_ICON	0x781d0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	English	United States	0.2670642418516769
RT_ICON	0x7c3f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.3201244813278008
RT_ICON	0x7e9a0	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 0	English	United States	0.3479289940828402
RT_ICON	0x80408	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.3897748592870544
RT_ICON	0x814b0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	United States	0.4389344262295082
RT_ICON	0x81e38	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 0	English	United States	0.45290697674418606
RT_ICON	0x824f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.6338652482269503
RT_MESSAGETABLE	0x82958	0x2840	data	English	United States	0.28823757763975155
RT_GROUP_ICON	0x85198	0x76	data	English	United States	0.7203389830508474
RT_VERSION	0x85210	0x2c8	data	English	United States	0.47752808988764045
RT_MANIFEST	0x854d8	0x4d2	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1174), with CRLF line terminators	English	United States	0.47568881685575365

Imports

DLL	Import
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, OpenProcessToken, AdjustTokenPrivileges, LookupPrivilegeValueW, InitiateSystemShutdownExW, GetUserNameW, RegQueryValueExW, RegDeleteValueW, CloseEventLog, OpenEventLogW, ReportEventW, ConvertStringSecurityDescriptorToSecurityDescriptorW, DecryptFileW, CreateWellKnownSid, InitializeAcl, SetEntriesInAclW, ChangeServiceConfigW, CloseServiceHandle, ControlService, OpenSCManagerW, OpenServiceW, QueryServiceStatus, SetNamedSecurityInfoW, CheckTokenMembership, AllocateAndInitializeSid, SetEntriesInAclA, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, RegSetValueExW, RegQueryInfoKeyW, RegEnumValueW, RegEnumKeyExW, RegDeleteKeyW, RegCreateKeyExW, GetTokenInformation, CryptDestroyHash, CryptHashData, CryptCreateHash, CryptGetHashParam, CryptReleaseContext, CryptAcquireContextW, QueryServiceConfigW
USER32.dll	PeekMessageW, PostMessageW, IsWindow, WaitForInputIdle, PostQuitMessage, GetMessageW, TranslateMessage, MsgWaitForMultipleObjects, PostThreadMessageW, GetMonitorInfoW, MonitorFromPoint, IsDialogMessageW, LoadCursorW, LoadBitmapW, SetWindowLongW, GetWindowLongW, GetCursorPos, MessageBoxW, CreateWindowExW, UnregisterClassW, RegisterClassW, DefWindowProcW, DispatchMessageW
OLEAUT32.dll	VariantInit, SysAllocString, VariantClear, SysFreeString
GDI32.dll	DeleteDC, DeleteObject, SelectObject, StretchBlt, GetObjectW, CreateCompatibleDC
SHELL32.dll	CommandLineToArgvW, SHGetFolderPathW, ShellExecuteExW
ole32.dll	CoUninitialize, CoInitializeEx, CoInitialize, StringFromGUID2, CoCreateInstance, CoTaskMemFree, CLSIDFromProgID, CoInitializeSecurity
KERNEL32.dll	GetCommandLineA, GetCPInfo, GetOEMCP, CloseHandle, CreateFileW, GetProcAddress, LocalFree, HeapSetInformation, GetLastError, GetModuleHandleW, FormatMessageW, lstrlenA, lstrlenW, MultiByteToWideChar, WideCharToMultiByte, LCMapStringW, Sleep, GetLocalTime, GetModuleFileNameW, ExpandEnvironmentStringsW, GetTempPathW, GetTempFileNameW, CreateDirectoryW, GetFullPathNameW, CompareStringW, GetCurrentProcessId, WriteFile, SetFilePointer, LoadLibraryW, GetSystemDirectoryW, CreateFileA, HeapAlloc, HeapReAlloc, HeapFree, HeapSize, GetProcessHeap, FindClose, GetCommandLineW, GetCurrentDirectoryW, RemoveDirectoryW, SetFileAttributesW, GetFileAttributesW, DeleteFileW, FindFirstFileW, FindNextFileW, MoveFileExW, GetCurrentProcess, GetCurrentThreadId, InitializeCriticalSection, DeleteCriticalSection, ReleaseMutex, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, CreateProcessW, GetVersionExW, VerSetConditionMask, FreeLibrary, EnterCriticalSection, LeaveCriticalSection, GetSystemTime, GetNativeSystemInfo, GetModuleHandleExW, GetWindowsDirectoryW, GetSystemWow64DirectoryW, GetEnvironmentStringsW, VerifyVersionInfoW, GetVolumePathNameW, GetDateFormatW, GetUserDefaultUILanguage, GetSystemDefaultLangID, GetUserDefaultLangID, GetStringTypeW, ReadFile, SetFilePointerEx, DuplicateHandle, InterlockedExchange, InterlockedCompareExchange, LoadLibraryExW, CreateEventW, ProcessIdToSessionId, OpenProcess, GetProcessId, WaitForSingleObject, ConnectNamedPipe, SetNamedPipeHandleState, CreateNamedPipeW, CreateThread, GetExitCodeThread, SetEvent, WaitForMultipleObjects, InterlockedIncrement, InterlockedDecrement, ResetEvent, SetEndOfFile, SetFileTime, LocalFileTimeToFileTime, DosDateTimeToFileTime, CompareStringA, GetExitCodeProcess, SetThreadExecutionState, CopyFileExW, MapViewOfFile, UnmapViewOfFile, CreateMutexW, CreateFileMappingW, GetThreadLocale, IsValidCodePage, FindFirstFileExW, FreeEnvironmentStringsW, SetStdHandle, GetConsoleCP, GetConsoleMode, FlushFileBuffers, DecodePointer, WriteConsoleW, GetModuleHandleA, GlobalAlloc, GlobalFree, GetFileSizeEx, CopyFileW, VirtualAlloc, VirtualFree, SystemTimeToTzSpecificLocalTime, GetTimeZoneInformation, SystemTimeToFileTime, GetSystemInfo, VirtualProtect, VirtualQuery, GetComputerNameW, SetCurrentDirectoryW, GetFileType, GetACP, ExitProcess, GetStdHandle, InitializeCriticalSectionAndSpinCount, SetLastError, RtlUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, RaiseException, LoadLibraryExA
RPCRT4.dll	UuidCreate

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2025 14:55:32.378217936 CET	51875	53	192.168.2.5	1.1.1.1
Jan 9, 2025 14:55:32.387523890 CET	53	51875	1.1.1.1	192.168.2.5
Jan 9, 2025 14:55:41.452994108 CET	52295	53	192.168.2.5	1.1.1.1
Jan 9, 2025 14:55:41.461195946 CET	53	52295	1.1.1.1	192.168.2.5
Jan 9, 2025 14:55:50.535016060 CET	55153	53	192.168.2.5	1.1.1.1
Jan 9, 2025 14:55:50.546900034 CET	53	55153	1.1.1.1	192.168.2.5
Jan 9, 2025 14:55:59.597937107 CET	55650	53	192.168.2.5	1.1.1.1
Jan 9, 2025 14:55:59.606178999 CET	53	55650	1.1.1.1	192.168.2.5
Jan 9, 2025 14:56:08.662988901 CET	62273	53	192.168.2.5	1.1.1.1
Jan 9, 2025 14:56:08.669814110 CET	53	62273	1.1.1.1	192.168.2.5
Jan 9, 2025 14:56:17.733485937 CET	63364	53	192.168.2.5	1.1.1.1
Jan 9, 2025 14:56:17.741127014 CET	53	63364	1.1.1.1	192.168.2.5
Jan 9, 2025 14:56:26.814261913 CET	50206	53	192.168.2.5	1.1.1.1
Jan 9, 2025 14:56:26.821203947 CET	53	50206	1.1.1.1	192.168.2.5
Jan 9, 2025 14:56:35.934221983 CET	63251	53	192.168.2.5	1.1.1.1
Jan 9, 2025 14:56:35.940975904 CET	53	63251	1.1.1.1	192.168.2.5
Jan 9, 2025 14:56:45.009857893 CET	56014	53	192.168.2.5	1.1.1.1
Jan 9, 2025 14:56:45.020739079 CET	53	56014	1.1.1.1	192.168.2.5
Jan 9, 2025 14:56:54.088184118 CET	56812	53	192.168.2.5	1.1.1.1
Jan 9, 2025 14:56:54.107301950 CET	53	56812	1.1.1.1	192.168.2.5
Jan 9, 2025 14:57:04.415566921 CET	54702	53	192.168.2.5	1.1.1.1
Jan 9, 2025 14:57:04.425812960 CET	53	54702	1.1.1.1	192.168.2.5
Jan 9, 2025 14:57:13.523834944 CET	61475	53	192.168.2.5	1.1.1.1
Jan 9, 2025 14:57:13.530961037 CET	53	61475	1.1.1.1	192.168.2.5
Jan 9, 2025 14:57:22.620918036 CET	63576	53	192.168.2.5	1.1.1.1
Jan 9, 2025 14:57:22.629460096 CET	53	63576	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2025 14:55:32.378217936 CET	192.168.2.5	1.1.1.1	0xfa90	Standard query (0)	tataragirld.site	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:55:41.452994108 CET	192.168.2.5	1.1.1.1	0x53a4	Standard query (0)	tataragirld.site	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:55:50.535016060 CET	192.168.2.5	1.1.1.1	0x2863	Standard query (0)	tataragirld.site	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:55:59.597937107 CET	192.168.2.5	1.1.1.1	0x9853	Standard query (0)	tataragirld.site	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:56:08.662988901 CET	192.168.2.5	1.1.1.1	0x2e5f	Standard query (0)	tataragirld.site	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:56:17.733485937 CET	192.168.2.5	1.1.1.1	0x5e1	Standard query (0)	tataragirld.site	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:56:26.814261913 CET	192.168.2.5	1.1.1.1	0x7636	Standard query (0)	tataragirld.site	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:56:35.934221983 CET	192.168.2.5	1.1.1.1	0x18bc	Standard query (0)	tataragirld.site	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:56:45.009857893 CET	192.168.2.5	1.1.1.1	0x3271	Standard query (0)	tataragirld.site	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:56:54.088184118 CET	192.168.2.5	1.1.1.1	0x7bea	Standard query (0)	tataragirld.site	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:57:04.415566921 CET	192.168.2.5	1.1.1.1	0x56b1	Standard query (0)	tataragirld.site	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:57:13.523834944 CET	192.168.2.5	1.1.1.1	0x6929	Standard query (0)	tataragirld.site	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:57:22.620918036 CET	192.168.2.5	1.1.1.1	0x1c5a	Standard query (0)	tataragirld.site	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 9, 2025 14:55:32.387523890 CET	1.1.1.1	192.168.2.5	0xfa90	Name error (3)	tataragirld.site	none	none	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:55:41.461195946 CET	1.1.1.1	192.168.2.5	0x53a4	Name error (3)	tataragirld.site	none	none	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:55:50.546900034 CET	1.1.1.1	192.168.2.5	0x2863	Name error (3)	tataragirld.site	none	none	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:55:59.606178999 CET	1.1.1.1	192.168.2.5	0x9853	Name error (3)	tataragirld.site	none	none	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:56:08.669814110 CET	1.1.1.1	192.168.2.5	0x2e5f	Name error (3)	tataragirld.site	none	none	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:56:17.741127014 CET	1.1.1.1	192.168.2.5	0x5e1	Name error (3)	tataragirld.site	none	none	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:56:26.821203947 CET	1.1.1.1	192.168.2.5	0x7636	Name error (3)	tataragirld.site	none	none	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:56:35.940975904 CET	1.1.1.1	192.168.2.5	0x18bc	Name error (3)	tataragirld.site	none	none	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:56:45.020739079 CET	1.1.1.1	192.168.2.5	0x3271	Name error (3)	tataragirld.site	none	none	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:56:54.107301950 CET	1.1.1.1	192.168.2.5	0x7bea	Name error (3)	tataragirld.site	none	none	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:57:04.425812960 CET	1.1.1.1	192.168.2.5	0x56b1	Name error (3)	tataragirld.site	none	none	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:57:13.530961037 CET	1.1.1.1	192.168.2.5	0x6929	Name error (3)	tataragirld.site	none	none	A (IP address)	IN (0x0001)	false
Jan 9, 2025 14:57:22.629460096 CET	1.1.1.1	192.168.2.5	0x1c5a	Name error (3)	tataragirld.site	none	none	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	08:54:17
Start date:	09/01/2025
Path:	C:\Users\user\Desktop\1wrLmYiC62.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\1wrLmYiC62.exe"
Imagebase:	0x6a0000
File size:	6'305'325 bytes
MD5 hash:	9C540950F5A8981844FF33BFC55D2F36
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:54:18
Start date:	09/01/2025
Path:	C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe" -burn.clean.room="C:\Users\user\Desktop\1wrLmYiC62.exe" -burn.filehandle.attached=512 -burn.filehandle.self=532
Imagebase:	0xe0000
File size:	6'305'325 bytes
MD5 hash:	9C540950F5A8981844FF33BFC55D2F36
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:54:18
Start date:	09/01/2025
Path:	C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe
Imagebase:	0xd10000
File size:	1'219'488 bytes
MD5 hash:	F778E9136AB0DB9DE9802A7043DE50A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:54:20
Start date:	09/01/2025
Path:	C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
Imagebase:	0x10000
File size:	1'219'488 bytes
MD5 hash:	F778E9136AB0DB9DE9802A7043DE50A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:54:21
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:54:21
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:54:50
Start date:	09/01/2025
Path:	C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
Imagebase:	0x140000000
File size:	2'364'728 bytes
MD5 hash:	967F4470627F823F4D7981E511C9824F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:54:56
Start date:	09/01/2025
Path:	C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe"
Imagebase:	0x10000
File size:	1'219'488 bytes
MD5 hash:	F778E9136AB0DB9DE9802A7043DE50A7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:54:57
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:54:58
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:55:19
Start date:	09/01/2025
Path:	C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe
Imagebase:	0x140000000
File size:	2'364'728 bytes
MD5 hash:	967F4470627F823F4D7981E511C9824F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 006A3CC4 Relevance: 45.8, APIs: 23, Strings: 3, Instructions: 320
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 006A3D40
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006A3D53
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000001,00000000,?), ref: 006A3D9E
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006A3DA8
GetTempPathW.KERNEL32(00000104,?,?,?,?,00000001,00000000,?), ref: 006A3DF6
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006A3E00
FindFirstFileW.KERNELBASE(?,?,?,*.*,?,?,?,?,00000001,00000000,?), ref: 006A3E53
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006A3E64
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00000001,00000000,?), ref: 006A3F3E
DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,00000001,00000000,?), ref: 006A3F52
GetTempFileNameW.KERNEL32(?,DEL,00000000,?,?,?,?,00000001,00000000,?), ref: 006A3F79
MoveFileExW.KERNEL32(?,?,00000001,?,?,?,00000001,00000000,?), ref: 006A3F9C
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 006A3FB5
FindNextFileW.KERNELBASE(000000FF,?,?,?,?,?,?,?,00000001,00000000,?), ref: 006A3FC5
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006A3FDA
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006A4009
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006A402B
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006A404D
RemoveDirectoryW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 006A4064
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006A406E
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 006A4095
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006A40B0
FindClose.KERNEL32(000000FF,?,?,?,00000001,00000000,?), ref: 006A40E6

Strings

dirutil.cpp, xrefs: 006A3D76, 006A3FFA
*.*, xrefs: 006A3E2C
DEL, xrefs: 006A3F6D

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFileLast$AttributesFindMove$Temp$CloseDeleteDirectoryFirstNameNextPathRemove
String ID: *.*$DEL$dirutil.cpp
API String ID: 1544372074-1252831301
Opcode ID: 94611fb1ca5deb6edb52515975327a4617eced2a9eadd24a62933839616e01aa
Instruction ID: 6d93b24a0cb2d8ef8fb82d6af395c3181e13ad842b2388271c20ebd1d5707ae9
Opcode Fuzzy Hash: 94611fb1ca5deb6edb52515975327a4617eced2a9eadd24a62933839616e01aa
Instruction Fuzzy Hash: FCB1C972D412399BDB317B648C45BDAB677AF42720F014295FE08BB390DB729E90DE90

Function 006A5195 Relevance: 38.8, APIs: 5, Strings: 17, Instructions: 315
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 006A5217

Part of subcall function 006E04F8: InitializeCriticalSection.KERNEL32(0070B5FC,?,006A5223,00000000,?,?,?,?,?,?), ref: 006E050F

Part of subcall function 006A120A: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,006A523F,00000000,?), ref: 006A1248
Part of subcall function 006A120A: GetLastError.KERNEL32(?,?,?,006A523F,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 006A1252

CoInitializeEx.COMBASE(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 006A5285

Part of subcall function 006E0E07: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 006E0E28

GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 006A5317
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 006A5321
CoUninitialize.COMBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 006A558E

Strings

Failed to initialize COM., xrefs: 006A5291
Failed to run RunOnce mode., xrefs: 006A541C
engine.cpp, xrefs: 006A5345
Failed to get OS info., xrefs: 006A534F
Failed to initialize Cryputil., xrefs: 006A52A6
Invalid run mode., xrefs: 006A53F9
Failed to run per-machine mode., xrefs: 006A546C
3.11.1.2318, xrefs: 006A5384
Failed to initialize Regutil., xrefs: 006A52C9
Failed to run embedded mode., xrefs: 006A5444
Failed to parse command line., xrefs: 006A5245
Failed to run untrusted mode., xrefs: 006A54B6
Failed to initialize core., xrefs: 006A53C3
Failed to initialize engine state., xrefs: 006A526C
Failed to initialize XML util., xrefs: 006A52F9
Failed to initialize Wiutil., xrefs: 006A52E1
Failed to run per-user mode., xrefs: 006A5494

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
String ID: 3.11.1.2318$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$engine.cpp
API String ID: 3262001429-510904028
Opcode ID: b4e3d7a99d9e14cd2740bb8a6bed6f95891ebcd19a3dfdeba10abfb900fe1a6d
Instruction ID: d328236eedab624552d8db9ec5bc5739ed1dabc1047503c21ed764d4c92bd6e9
Opcode Fuzzy Hash: b4e3d7a99d9e14cd2740bb8a6bed6f95891ebcd19a3dfdeba10abfb900fe1a6d
Instruction Fuzzy Hash: 6AB1D671D41B799BDB31FB558C46BEE76B7AF46310F000099F90AA6241DB709E80CF94

Function 006E304F Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 153libraryloadercomCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,006E3609,00000000,?,00000000), ref: 006E3069
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,006CC025,?,006A5405,?,00000000,?), ref: 006E3075
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 006E30B5
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 006E30C1
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 006E30CC
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 006E30D6
CoCreateInstance.OLE32(0070B6B8,00000000,00000001,006EB818,?,?,?,?,?,?,?,?,?,?,?,006CC025), ref: 006E3111
ExitProcess.KERNEL32 ref: 006E31C0

Strings

xmlutil.cpp, xrefs: 006E3099
kernel32.dll, xrefs: 006E3059
Wow64DisableWow64FsRedirection, xrefs: 006E30BB
Wow64RevertWow64FsRedirection, xrefs: 006E30CE
Wow64EnableWow64FsRedirection, xrefs: 006E30C3
IsWow64Process, xrefs: 006E30AF

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$xmlutil.cpp
API String ID: 2124981135-499589564
Opcode ID: 8c8987a96795dc01a44ef24a8dec3276b1696939db5aef9c6b5290d153ee4fb9
Instruction ID: 2b12d0f77650472b3528245f7009bc73a37cfb4fdf15796926937781c4ff85f9
Opcode Fuzzy Hash: 8c8987a96795dc01a44ef24a8dec3276b1696939db5aef9c6b5290d153ee4fb9
Instruction Fuzzy Hash: A441B331A02365EBDB25DFAA8859BEEB7E6AF44710F11416CE901EB380D775DF408B90

Function 006A1070 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 78fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006A33C7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,006A10DD,?,00000000), ref: 006A33E8

CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 006A10F6

Part of subcall function 006A1175: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,006A111A,cabinet.dll,00000009,?,?,00000000), ref: 006A1186
Part of subcall function 006A1175: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,006A111A,cabinet.dll,00000009,?,?,00000000), ref: 006A1191
Part of subcall function 006A1175: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 006A119F
Part of subcall function 006A1175: GetLastError.KERNEL32(?,?,?,?,?,006A111A,cabinet.dll,00000009,?,?,00000000), ref: 006A11BA
Part of subcall function 006A1175: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 006A11C2
Part of subcall function 006A1175: GetLastError.KERNEL32(?,?,?,?,?,006A111A,cabinet.dll,00000009,?,?,00000000), ref: 006A11D7

CloseHandle.KERNELBASE(?,?,?,?,006EB4D0,?,cabinet.dll,00000009,?,?,00000000), ref: 006A1131

Strings

cabinet.dll, xrefs: 006A1099, 006A1114
feclient.dll, xrefs: 006A10D1
msasn1.dll, xrefs: 006A10C3
comres.dll, xrefs: 006A10B5
msi.dll, xrefs: 006A10A0
crypt32.dll, xrefs: 006A10CA
wininet.dll, xrefs: 006A10AE
version.dll, xrefs: 006A10A7

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
String ID: cabinet.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
API String ID: 3687706282-2392521765
Opcode ID: 4bcca657ff752c6f770e9c546cc6fbbd2b5e84540c06e4589ab7252ea2d3eeda
Instruction ID: 62fce634569f3082044de9706d73c41086194a1d901122ab7b1456758476b5a4
Opcode Fuzzy Hash: 4bcca657ff752c6f770e9c546cc6fbbd2b5e84540c06e4589ab7252ea2d3eeda
Instruction Fuzzy Hash: 73217A7190135CABCB10AFA5DC49BEFBBBAAB0A714F105119FA11BA281D7709D048FA4

Function 006BA0BB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

Strings

Failed create working folder., xrefs: 006BA0EE
Failed to copy working folder., xrefs: 006BA116
Failed to calculate working folder to ensure it exists., xrefs: 006BA0D8

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CurrentDirectoryErrorLastProcessWindows
String ID: Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
API String ID: 3841436932-2072961686
Opcode ID: d51503760a205107a8c4343ca5e0b1d0063695075d1a7d2820260b0082588b7e
Instruction ID: 45ac1b25a5eec3fc4d41ee7a164ea80b0f3f8a5cb5a55b993187278410498e4b
Opcode Fuzzy Hash: d51503760a205107a8c4343ca5e0b1d0063695075d1a7d2820260b0082588b7e
Instruction Fuzzy Hash: 5701FC72901668FB4F626F99DC06CEEBB7BDF95B20B114159F80076210DB319F80E795

Function 006D48D8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,006D48AE,00000000,00707F08,0000000C,006D4A05,00000000,00000002,00000000), ref: 006D48F9
TerminateProcess.KERNEL32(00000000,?,006D48AE,00000000,00707F08,0000000C,006D4A05,00000000,00000002,00000000), ref: 006D4900
ExitProcess.KERNEL32 ref: 006D4912

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 3eb7cc3882a5cb9aa2ce5035e8ccd57d91fa2c15ebe4c1ff4bfcf912c1f2d0d7
Instruction ID: 74c29b14a82f2ed3bad769a4452cfac7ff2d2196dbb98a8a2442e9b46c598583
Opcode Fuzzy Hash: 3eb7cc3882a5cb9aa2ce5035e8ccd57d91fa2c15ebe4c1ff4bfcf912c1f2d0d7
Instruction Fuzzy Hash: 4AE04631800288AFCF12AF62CD5AA9A3B2BEF40381B005015F8098F222CF35ED42CB84

Function 006A394F Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,000001C7,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3960
RtlAllocateHeap.NTDLL(00000000,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3967

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 28c76f11436145e49658faeac0a14353c0529cf6c3859ccb6655625955dfe6e2
Instruction ID: 53ad2aac75d357dc71d553681cbda77aeb5dba28cb20566bb6dc2ddab20101c2
Opcode Fuzzy Hash: 28c76f11436145e49658faeac0a14353c0529cf6c3859ccb6655625955dfe6e2
Instruction Fuzzy Hash: 21C012321A430DA7CB005FF4DC4DC97379DB7146127049404B505C6110C738E0108760

Function 006ADF33 Relevance: 126.6, APIs: 11, Strings: 61, Instructions: 646COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 006AE058
SysFreeString.OLEAUT32(00000000), ref: 006AE736

Part of subcall function 006A394F: GetProcessHeap.KERNEL32(?,000001C7,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3960
Part of subcall function 006A394F: RtlAllocateHeap.NTDLL(00000000,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3967

Strings

Failed to get next node., xrefs: 006AE708
Failed to get @Vital., xrefs: 006AE6B8
CacheId, xrefs: 006AE1C9
MspPackage, xrefs: 006AE3CD
Failed to find forward transaction boundary: %ls, xrefs: 006AE506
cabinet.dll, xrefs: 006AE1FE
RollbackBoundary, xrefs: 006ADF56
Vital, xrefs: 006AE027, 006AE25B
MsuPackage, xrefs: 006AE406
ETj, xrefs: 006ADF33
Cache, xrefs: 006AE14B
Chain/ExePackage|Chain/MsiPackage|Chain/MspPackage|Chain/MsuPackage, xrefs: 006AE081
Failed to parse MSU package., xrefs: 006AE53B
RollbackBoundaryBackward, xrefs: 006AE319
comres.dll, xrefs: 006AE234
RollbackBoundaryForward, xrefs: 006AE2DF
Failed to allocate memory for patch sequence information to package lookup., xrefs: 006AE570
Failed to get @Size., xrefs: 006AE6D4
InstallSize, xrefs: 006AE1FF
Invalid cache type: %ls, xrefs: 006AE6EA
Failed to get @Id., xrefs: 006AE701
Failed to parse payload references., xrefs: 006AE6B1
Size, xrefs: 006AE1E4
always, xrefs: 006AE1A7
Failed to parse EXE package., xrefs: 006AE389
Failed to select package nodes., xrefs: 006AE094
Failed to select rollback boundary nodes., xrefs: 006ADF69
MsiPackage, xrefs: 006AE395
RollbackLogPathVariable, xrefs: 006AE299
wininet.dll, xrefs: 006AE25A
Failed to get @PerMachine., xrefs: 006AE6C6
Failed to get @InstallSize., xrefs: 006AE6CD
Failed to parse dependency providers., xrefs: 006AE6AA
Failed to get @RollbackBoundaryForward., xrefs: 006AE510
Permanent, xrefs: 006AE235
crypt32.dll, xrefs: 006AE2BB
LogPathVariable, xrefs: 006AE276
Failed to allocate memory for MSP patch sequence information., xrefs: 006AE4DB
Failed to parse target product codes., xrefs: 006AE69B
Failed to get @RollbackLogPathVariable., xrefs: 006AE4EF
Failed to get rollback bundary node count., xrefs: 006ADF8E
Failed to get @Cache., xrefs: 006AE6FA
Failed to get @InstallCondition., xrefs: 006AE4F9
feclient.dll, xrefs: 006AE298
Failed to get @RollbackBoundaryBackward., xrefs: 006AE527
Failed to allocate memory for package structs., xrefs: 006AE0EF
Failed to parse MSI package., xrefs: 006AE3C1
yes, xrefs: 006AE187
package.cpp, xrefs: 006ADFBE, 006AE0E3, 006AE4CF, 006AE564
Failed to parse MSP package., xrefs: 006AE531
InstallCondition, xrefs: 006AE2BC
Failed to get @Permanent., xrefs: 006AE6BF
Failed to get @CacheId., xrefs: 006AE6DB
Failed to get @LogPathVariable., xrefs: 006AE4E5
Failed to get package node count., xrefs: 006AE0B1
Failed to find backward transaction boundary: %ls, xrefs: 006AE51D
PerMachine, xrefs: 006AE21A
`)u, xrefs: 006AE058, 006AE47B, 006AE736
Failed to allocate memory for rollback boundary structs., xrefs: 006ADFCA
ExePackage, xrefs: 006AE357
msi.dll, xrefs: 006AE1C8

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: Cache$CacheId$Chain/ExePackage|Chain/MsiPackage|Chain/MspPackage|Chain/MsuPackage$ETj$ExePackage$Failed to allocate memory for MSP patch sequence information.$Failed to allocate memory for package structs.$Failed to allocate memory for patch sequence information to package lookup.$Failed to allocate memory for rollback boundary structs.$Failed to find backward transaction boundary: %ls$Failed to find forward transaction boundary: %ls$Failed to get @Cache.$Failed to get @CacheId.$Failed to get @Id.$Failed to get @InstallCondition.$Failed to get @InstallSize.$Failed to get @LogPathVariable.$Failed to get @PerMachine.$Failed to get @Permanent.$Failed to get @RollbackBoundaryBackward.$Failed to get @RollbackBoundaryForward.$Failed to get @RollbackLogPathVariable.$Failed to get @Size.$Failed to get @Vital.$Failed to get next node.$Failed to get package node count.$Failed to get rollback bundary node count.$Failed to parse EXE package.$Failed to parse MSI package.$Failed to parse MSP package.$Failed to parse MSU package.$Failed to parse dependency providers.$Failed to parse payload references.$Failed to parse target product codes.$Failed to select package nodes.$Failed to select rollback boundary nodes.$InstallCondition$InstallSize$Invalid cache type: %ls$LogPathVariable$MsiPackage$MspPackage$MsuPackage$PerMachine$Permanent$RollbackBoundary$RollbackBoundaryBackward$RollbackBoundaryForward$RollbackLogPathVariable$Size$Vital$`)u$always$cabinet.dll$comres.dll$crypt32.dll$feclient.dll$msi.dll$package.cpp$wininet.dll$yes
API String ID: 336948655-2479505255
Opcode ID: e38e05e6fb88e1a18550b6c500fa0c3d7e31d66467ffc8c060d3df91bd49804c
Instruction ID: 66afca4e3a865c04b61fca423ee2742f1cfc626ff560677e325a3d5d27d691a4
Opcode Fuzzy Hash: e38e05e6fb88e1a18550b6c500fa0c3d7e31d66467ffc8c060d3df91bd49804c
Instruction Fuzzy Hash: B132D431D4022AAFDB11AB54CC45FAEB6B7AF05720F214669FA11BB291D772ED00CF94

Function 006AF9E3 Relevance: 115.9, APIs: 3, Strings: 63, Instructions: 446
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to get @Manufacturer., xrefs: 006AFE66
ParentDisplayName, xrefs: 006AFC81
Failed to select Update node., xrefs: 006AFE3C
Name, xrefs: 006AFEC1
Failed to get @ParentDisplayName., xrefs: 006AFC98
Failed to get @Register., xrefs: 006AFB70
DisplayVersion, xrefs: 006AFBA3
DisableRemove, xrefs: 006AFDC9
Failed to get @ProductFamily., xrefs: 006AFEB3
Arp, xrefs: 006AFB33
Failed to get @DisplayName., xrefs: 006AFB95
Register, xrefs: 006AFB5D
ETj, xrefs: 006AF9E3
Update, xrefs: 006AFE1E
ExecutableName, xrefs: 006AFAF4
Failed to get @AboutUrl., xrefs: 006AFC4E
Version, xrefs: 006AFA91
ProductFamily, xrefs: 006AFE9C
button, xrefs: 006AFD15
Failed to parse related bundles, xrefs: 006AFA83
Failed to get @DisableRemove., xrefs: 006AFDE0
Classification, xrefs: 006AFEE2
Failed to get @Id., xrefs: 006AFA49
AboutUrl, xrefs: 006AFC37
Department, xrefs: 006AFE77
Registration, xrefs: 006AF9FD
Failed to get @Version., xrefs: 006AFAA4
Failed to get @ProviderKey., xrefs: 006AFAE6
ProviderKey, xrefs: 006AFAD3
registration.cpp, xrefs: 006AFD87
Failed to get @PerMachine., xrefs: 006AFB25
Failed to get @Department., xrefs: 006AFE8E
Failed to get @Classification., xrefs: 006AFEF5
Failed to set registration paths., xrefs: 006AFF08
Failed to get @Comments., xrefs: 006AFCC0
HelpLink, xrefs: 006AFBED
Failed to select registration node., xrefs: 006AFA1C
Failed to parse software tag., xrefs: 006AFE10
HelpTelephone, xrefs: 006AFC12
Publisher, xrefs: 006AFBC8
Failed to get @Contact., xrefs: 006AFCE8
Comments, xrefs: 006AFCA9
Failed to get @DisplayVersion., xrefs: 006AFBBA
Failed to get @Name., xrefs: 006AFED4
msasn1.dll, xrefs: 006AFA35
Failed to get @UpdateUrl., xrefs: 006AFC73
Manufacturer, xrefs: 006AFE53
DisableModify, xrefs: 006AFCF6
Failed to get @HelpLink., xrefs: 006AFC04
Failed to get @DisableModify., xrefs: 006AFDB8
Invalid modify disabled type: %ls, xrefs: 006AFD94
yes, xrefs: 006AFD36
Failed to get @Tag., xrefs: 006AFA6A
Failed to get @ExecutableName., xrefs: 006AFB07
DisplayName, xrefs: 006AFB7E
Failed to parse @Version: %ls, xrefs: 006AFAC5
Contact, xrefs: 006AFCD1
Tag, xrefs: 006AFA57
Failed to select ARP node., xrefs: 006AFB4F
UpdateUrl, xrefs: 006AFC5C
Failed to get @HelpTelephone., xrefs: 006AFC29
PerMachine, xrefs: 006AFB12
Failed to get @Publisher., xrefs: 006AFBDF

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ETj$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$msasn1.dll$registration.cpp$yes
API String ID: 760788290-1891573164
Opcode ID: 42ee950a667d7f4924645e2a049d3747063582f633c93ff364448fb176d68e89
Instruction ID: d9d5b3df78de79efa406753e034ecce4ff1d7628378231c021d9da444cdfe4d4
Opcode Fuzzy Hash: 42ee950a667d7f4924645e2a049d3747063582f633c93ff364448fb176d68e89
Instruction Fuzzy Hash: 2DE1B532E45679FECB11B7E4CC42EBDB6A76B03750F124235EA11BB251DB619E009BC2

Function 006AB48B Relevance: 93.3, APIs: 24, Strings: 29, Instructions: 578
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00000000,76EDC3F0,00000000), ref: 006AB502
SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006AB550
GetLastError.KERNEL32(?,?,?,00000000,76EDC3F0,00000000), ref: 006AB556
ReadFile.KERNELBASE(00000000,aDjH,00000040,?,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006AB59E
GetLastError.KERNEL32(?,?,?,00000000,76EDC3F0,00000000), ref: 006AB5A4
SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006AB601
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006AB607
ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006AB650
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006AB656
SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006AB6C7
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006AB6CD
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006AB716
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006AB71C
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006AB765
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006AB76B
SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006AB7B7
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006AB7BD

Part of subcall function 006A394F: GetProcessHeap.KERNEL32(?,000001C7,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3960
Part of subcall function 006A394F: RtlAllocateHeap.NTDLL(00000000,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3967

ReadFile.KERNEL32(00000000,?,00000028,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006AB810
ReadFile.KERNEL32(00000000,?,00000028,00000028,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006AB872
SetFilePointerEx.KERNELBASE(00000000,?,00000000,00000000,00000000,00000034,00000001,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006AB8FC
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006AB906

Strings

Failed to find Burn section., xrefs: 006ABB32
(, xrefs: 006AB81D
Failed to seek to section info., xrefs: 006AB6F8, 006AB934
Failed to read complete image section header, index: %u, xrefs: 006ABB75
PE, xrefs: 006AB698
Failed to read image section header, index: %u, xrefs: 006ABBAC
Failed to read signature offset., xrefs: 006AB747
Failed to read DOS header., xrefs: 006AB5CF
Failed to read section info, data to short: %u, xrefs: 006AB8AA
Failed to seek to start of file., xrefs: 006AB581
Failed to read signature size., xrefs: 006AB796
Failed to seek to NT header., xrefs: 006AB632
Failed to seek past optional headers., xrefs: 006AB7EB
Failed to allocate buffer for section info., xrefs: 006AB8E4
PE Header from file didn't match PE Header in memory., xrefs: 006ABB11
Failed to find valid DOS image header in buffer., xrefs: 006ABBEB
Failed to get total size of bundle., xrefs: 006ABA23
Failed to read section info, unsupported version: %08x, xrefs: 006AB9F5
4, xrefs: 006AB884
Failed to open handle to engine process path., xrefs: 006AB52D
.wix, xrefs: 006AB830
Failed to read complete section info., xrefs: 006AB9C5
burn, xrefs: 006AB838
aDjH, xrefs: 006AB4A2, 006AB598, 006AB5EB, 006AB4AC, 006AB59B
Failed to read section info., xrefs: 006AB999
Failed to allocate memory for container sizes., xrefs: 006ABAD3
section.cpp, xrefs: 006AB523, 006AB577, 006AB5C5, 006AB628, 006AB677, 006AB6EE, 006AB73D, 006AB78C, 006AB7E1, 006AB898, 006AB8D8, 006AB92A, 006AB98F, 006AB9B9, 006AB9E0, 006ABAC7, 006ABB07, 006ABB26, 006ABB63, 006ABBA1, 006ABBC4, 006ABBDF
Failed to read NT header., xrefs: 006AB681
Failed to find valid NT image header in buffer., xrefs: 006ABBD0

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: File$ErrorLast$Read$Pointer$Heap$AllocateProcess
String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to engine process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$aDjH$burn$section.cpp
API String ID: 3411815225-1878768504
Opcode ID: e8bd4a84a7292d8d68748be4ff060201b3c0e181a05c93c9eb6a98e6358694e7
Instruction ID: 25ced3ee3d2c6d763e7f6235d5cf2abc9c39d87eea2ea08b3dda17ebcf50b984
Opcode Fuzzy Hash: e8bd4a84a7292d8d68748be4ff060201b3c0e181a05c93c9eb6a98e6358694e7
Instruction Fuzzy Hash: 6C123672941335ABDB30AB558C46FAB76A6AF06710F0111A9FD04BB382EB759D408FE4

Function 006C0D16 Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 306
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?,?,?,?,006C08BC,?,?), ref: 006C0D25
GetLastError.KERNEL32(?,?,?,?,006C08BC,?,?), ref: 006C0D2F
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,006C08BC,?,?), ref: 006C0D74
GetLastError.KERNEL32(?,?,?,?,006C08BC,?,?), ref: 006C0D7F
ResetEvent.KERNEL32(?,?,?,?,?,006C08BC,?,?), ref: 006C0DB7
GetLastError.KERNEL32(?,?,?,?,006C08BC,?,?), ref: 006C0DC1

Strings

Failed to allocate buffer for stream., xrefs: 006C0F93
Failed to create file: %ls, xrefs: 006C1001
cabextract.cpp, xrefs: 006C0D53, 006C0DA3, 006C0DE5, 006C0E11, 006C0E94, 006C0EDC, 006C0F21, 006C0F89, 006C0FF4, 006C1045, 006C108A, 006C10CE
Invalid operation for this state., xrefs: 006C0E1D
Failed to copy stream name: %ls, xrefs: 006C0E50
Failed to set file pointer to beginning of file., xrefs: 006C10D8
Failed to set end of file., xrefs: 006C1094
Failed to reset begin operation event., xrefs: 006C0DEF, 006C0F2B
Failed to wait for begin operation event., xrefs: 006C0DAD, 006C0EE6
Failed to set file pointer to end of file., xrefs: 006C104F
Failed to set operation complete event., xrefs: 006C0D5D, 006C0E9E

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$Event$ObjectResetSingleWait
String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
API String ID: 1865021742-2104912459
Opcode ID: 2396a1e901845ff4890f30d293dc42d75c330329b9f1c6b87e47a7728264fb89
Instruction ID: 0ebca2925af1dcbfeebb4657b781f790c3564aa425a52d673ff68a363d56e7dc
Opcode Fuzzy Hash: 2396a1e901845ff4890f30d293dc42d75c330329b9f1c6b87e47a7728264fb89
Instruction Fuzzy Hash: 6091F477A81736ABE73026E54D49F7A2953EF06B20F22422DBF24BE3D1D750AC4086D5

Function 006A4D39 Relevance: 38.7, APIs: 6, Strings: 16, Instructions: 220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006A33C7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,006A10DD,?,00000000), ref: 006A33E8

CloseHandle.KERNEL32(00000000,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 006A4F40
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 006A4F4F
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 006A4F5E
CloseHandle.KERNEL32(?,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 006A4F69

Strings

burn.filehandle.self, xrefs: 006A4E45
Failed to launch clean room process: %ls, xrefs: 006A4EF7
Failed to append original command line., xrefs: 006A4E69
Failed to cache to clean room., xrefs: 006A4DC2
engine.cpp, xrefs: 006A4EEA
Failed to allocate parameters for unelevated process., xrefs: 006A4DFA
"%ls" %ls, xrefs: 006A4E7A
Failed to wait for clean room process: %ls, xrefs: 006A4F23
Failed to get path for current process., xrefs: 006A4D83
burn.filehandle.attached, xrefs: 006A4E17
-%ls="%ls", xrefs: 006A4DE6
burn.clean.room, xrefs: 006A4DDE
Failed to allocate full command-line., xrefs: 006A4E8E
%ls %ls, xrefs: 006A4E55
D, xrefs: 006A4EA9
Failed to append %ls, xrefs: 006A4E1C

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseHandle$FileModuleName
String ID: "%ls" %ls$%ls %ls$-%ls="%ls"$D$Failed to allocate full command-line.$Failed to allocate parameters for unelevated process.$Failed to append %ls$Failed to append original command line.$Failed to cache to clean room.$Failed to get path for current process.$Failed to launch clean room process: %ls$Failed to wait for clean room process: %ls$burn.clean.room$burn.filehandle.attached$burn.filehandle.self$engine.cpp
API String ID: 3884789274-2391192076
Opcode ID: a8609e71d2cec986805ffd69225ef7b28d63163a18acb428223742192e450bd1
Instruction ID: 294dbbd981aa47deb57b16d3b4c0013f9768de2da5465889ad24bc543ef4afcb
Opcode Fuzzy Hash: a8609e71d2cec986805ffd69225ef7b28d63163a18acb428223742192e450bd1
Instruction Fuzzy Hash: B671B632D0136AAACF11ABA5CC45EEFBBBAAF45720F110155F910B7251DBB09E418FE4

Function 006B752A Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 291
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to get source process folder from path., xrefs: 006B7725
Failed to get manifest stream from container., xrefs: 006B75CC
Failed to open manifest stream., xrefs: 006B75AB
Failed to open attached UX container., xrefs: 006B758E
Failed to get unique temporary folder for bootstrapper application., xrefs: 006B77CE
Failed to initialize internal cache functionality., xrefs: 006B779F
Failed to set source process folder variable., xrefs: 006B7745
WixBundleOriginalSource, xrefs: 006B7759
Failed to load catalog files., xrefs: 006B780F
WixBundleElevated, xrefs: 006B76A5, 006B76B6
Failed to set original source variable., xrefs: 006B776A
Failed to set source process path variable., xrefs: 006B7709
Failed to parse command line., xrefs: 006B7667
WixBundleUILevel, xrefs: 006B76D6, 006B76E7
Failed to extract bootstrapper application payloads., xrefs: 006B77EF
WixBundleSourceProcessFolder, xrefs: 006B7734
Failed to load manifest., xrefs: 006B75E8
Failed to initialize variables., xrefs: 006B7571
Failed to overwrite the %ls built-in variable., xrefs: 006B76BB
WixBundleSourceProcessPath, xrefs: 006B76F8

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleUILevel
API String ID: 32694325-1564579409
Opcode ID: ef6cd512941c40b2533da5a9ba0907428264d2852febf67a80429be3cab77319
Instruction ID: 8bfea257f8751c5d5b65b1c0c01e15e20fa85f588fdb39ab8b8446161dd269fa
Opcode Fuzzy Hash: ef6cd512941c40b2533da5a9ba0907428264d2852febf67a80429be3cab77319
Instruction Fuzzy Hash: 09A187B2E44629BBDB129AA4CC45EEBB76EBF44710F010176F615E7141DB30EA84CBE4

Function 006B86D0 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 209
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,40000000,00000005,00000000,00000002,08000080,00000000,?,00000000,00000000,006A4DBC,?,?,00000000,006A4DBC,00000000), ref: 006B8713
GetLastError.KERNEL32 ref: 006B8720

Part of subcall function 006E3EDD: ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 006E3F73

SetFilePointerEx.KERNEL32(00000000,006EB4B8,00000000,00000000,00000000,?,00000000,006EB500,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006B87CD
GetLastError.KERNEL32 ref: 006B87D7
CloseHandle.KERNELBASE(00000000,?,00000000,006EB500,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006B8902

Strings

Failed to create engine file at path: %ls, xrefs: 006B8751
Failed to seek to checksum in exe header., xrefs: 006B8805
cache.cpp, xrefs: 006B8744, 006B87FB, 006B8862, 006B88D1
Failed to copy engine from: %ls to: %ls, xrefs: 006B87A8
cabinet.dll, xrefs: 006B887B
Failed to zero out original data offset., xrefs: 006B88F4
msi.dll, xrefs: 006B8814
Failed to seek to beginning of engine file: %ls, xrefs: 006B8779
Failed to seek to signature table in exe header., xrefs: 006B886C
Failed to update signature offset., xrefs: 006B8821
Failed to seek to original data in exe burn section header., xrefs: 006B88DB

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: File$ErrorLast$CloseCreateHandlePointerRead
String ID: Failed to copy engine from: %ls to: %ls$Failed to create engine file at path: %ls$Failed to seek to beginning of engine file: %ls$Failed to seek to checksum in exe header.$Failed to seek to original data in exe burn section header.$Failed to seek to signature table in exe header.$Failed to update signature offset.$Failed to zero out original data offset.$cabinet.dll$cache.cpp$msi.dll
API String ID: 3456208997-1976062716
Opcode ID: 968f8a8c88f9abad4fb3e2bc1a0bf84e62d540ef6ceaf3212765117fb5108f62
Instruction ID: fb04a9320b03aee5dbe7a60b2281b8ac92431081fbeb1847c98049673f7fee2c
Opcode Fuzzy Hash: 968f8a8c88f9abad4fb3e2bc1a0bf84e62d540ef6ceaf3212765117fb5108f62
Instruction Fuzzy Hash: 225196B2A41236AFEB215A648C46FFF366EAF04B10F110168FE10FB291EE549D41C7E5

Function 006A762C Relevance: 34.9, APIs: 1, Strings: 22, Instructions: 420
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(006B756B,006A53BD,00000000,006A5445), ref: 006A764C

Strings

WixBundleProviderKey, xrefs: 006A7E7E
Failed to add built-in variable: %ls., xrefs: 006A7F19
WixBundleExecutePackageAction, xrefs: 006A7DF8
', xrefs: 006A78EB
0, xrefs: 006A7663
LogonUser, xrefs: 006A7882
WixBundleActiveParent, xrefs: 006A7E62
WixBundleInstalled, xrefs: 006A7E2A
WixBundleElevated, xrefs: 006A7E46
InstallerName, xrefs: 006A7812
Date, xrefs: 006A7770
$, xrefs: 006A7D49
WixBundleAction, xrefs: 006A7D76
WixBundleTag, xrefs: 006A7EAE
InstallerVersion, xrefs: 006A7833
WixBundleUILevel, xrefs: 006A7EBE
WixBundleSourceProcessFolder, xrefs: 006A7E9E
WixBundleForcedRestartPackage, xrefs: 006A7E14
#, xrefs: 006A76CB
WixBundleVersion, xrefs: 006A7ECE
WixBundleExecutePackageCacheFolder, xrefs: 006A7D98
WixBundleSourceProcessPath, xrefs: 006A7E8E

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleUILevel$WixBundleVersion
API String ID: 32694325-3635313340
Opcode ID: a7105f7b05eaced0f3dd1d5832605b11f01417b7ab1d4e19f76ffdcf74f38e6a
Instruction ID: 5dbd8f2d23096123d9ab791267356c224926033a77cdddc81cc9208fcb6c2496
Opcode Fuzzy Hash: a7105f7b05eaced0f3dd1d5832605b11f01417b7ab1d4e19f76ffdcf74f38e6a
Instruction Fuzzy Hash: 9D3248B0C127699FDB65CF5AC9887DDFAB6BB49314F5081EED20CA6211C7B00B898F45

Function 006B82BA Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00000000,00000000,006A5489), ref: 006B8310

Part of subcall function 006E0879: OpenProcessToken.ADVAPI32(?,00000008,?,006A53BD,00000000,?,?,?,?,?,?,?,006B769D,00000000), ref: 006E0897
Part of subcall function 006E0879: GetLastError.KERNEL32(?,?,?,?,?,?,?,006B769D,00000000), ref: 006E08A1
Part of subcall function 006E0879: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,006B769D,00000000), ref: 006E092B

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 006B8336
GetLastError.KERNEL32 ref: 006B8340
GetTempPathW.KERNEL32(00000104,?,00000000), ref: 006B83BD
GetLastError.KERNEL32 ref: 006B83C7
UuidCreate.RPCRT4(?), ref: 006B8406

Strings

Failed to copy working folder path., xrefs: 006B848B
Failed to get windows path for working folder., xrefs: 006B836E
Temp\, xrefs: 006B8395
Failed to convert working folder guid into string., xrefs: 006B8446
cache.cpp, xrefs: 006B8364, 006B83EB, 006B843C
Failed to create working folder guid., xrefs: 006B8413
Failed to get temp path for working folder., xrefs: 006B83F5
Failed to append bundle id on to temp path for working folder., xrefs: 006B8470
%ls%ls\, xrefs: 006B8458
Failed to ensure windows path for working folder ended in backslash., xrefs: 006B838B
Failed to concat Temp directory on windows path for working folder., xrefs: 006B83AD

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$Process$CloseCreateCurrentDirectoryHandleOpenPathTempTokenUuidWindows
String ID: %ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$cache.cpp
API String ID: 266130487-819636856
Opcode ID: 346bf50d7d539b8e084b78880137f72d1adea2e172b3a676047df6029ae90f85
Instruction ID: 993197214fcbb819db5acd9f9df373a8f1c3046bb58643d7b573f06e8db3a7bc
Opcode Fuzzy Hash: 346bf50d7d539b8e084b78880137f72d1adea2e172b3a676047df6029ae90f85
Instruction Fuzzy Hash: 2141D7B2A41329BFD72096E4CD4AFEB72AE9B04B10F114165BB04EB240EE749D4087E5

Function 006C10FB Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000000), ref: 006C111D
CoUninitialize.COMBASE ref: 006C1398

Strings

Failed to initialize COM., xrefs: 006C1129
cabextract.cpp, xrefs: 006C1193, 006C12BA, 006C1307, 006C1346, 006C1372
Invalid operation for this state., xrefs: 006C137C
<the>.cab, xrefs: 006C11BD
Failed to extract all files from container, erf: %d:%X:%d, xrefs: 006C1279
Failed to reset begin operation event., xrefs: 006C1350
Failed to wait for begin operation event., xrefs: 006C1311
Failed to set operation complete event., xrefs: 006C12C4
Failed to initialize cabinet.dll., xrefs: 006C119F

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: InitializeUninitialize
String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
API String ID: 3442037557-1168358783
Opcode ID: f715b53b42275833e079f60fe6062029e3fd07376aa6182a093dc409ae46b3d8
Instruction ID: 71437260cda6f4631c3c63f37bd1640afa38a27fa5cb68abc6ec77b3c055fbaf
Opcode Fuzzy Hash: f715b53b42275833e079f60fe6062029e3fd07376aa6182a093dc409ae46b3d8
Instruction Fuzzy Hash: B651553AA402A2E7DF2056D48C05FBB3657DB03720B22436EBE15FF392D62D8E4186D5

Function 006A42D7 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 158
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,006A5266,?,?,00000000,?,?), ref: 006A4303
InitializeCriticalSection.KERNEL32(000000D0,?,?,006A5266,?,?,00000000,?,?), ref: 006A430C
lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,006A5266,?,?,00000000,?,?), ref: 006A4352
lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,006A5266,?,?,00000000,?,?), ref: 006A435C
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,006A5266,?,?,00000000,?,?), ref: 006A4370
lstrlenW.KERNEL32(burn.filehandle.attached,?,?,006A5266,?,?,00000000,?,?), ref: 006A4380
lstrlenW.KERNEL32(burn.filehandle.self,?,?,006A5266,?,?,00000000,?,?), ref: 006A43D0
lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,006A5266,?,?,00000000,?,?), ref: 006A43DA
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,006A5266,?,?,00000000,?,?), ref: 006A43EE
lstrlenW.KERNEL32(burn.filehandle.self,?,?,006A5266,?,?,00000000,?,?), ref: 006A43FE

Strings

burn.filehandle.self, xrefs: 006A43CB, 006A43D3, 006A43D8, 006A43D9, 006A43F9, 006A44CB
Failed to initialize engine section., xrefs: 006A4467
Failed to parse file handle: '%ls', xrefs: 006A4482
engine.cpp, xrefs: 006A4495, 006A44C1
Missing required parameter for switch: %ls, xrefs: 006A44A4
burn.filehandle.attached, xrefs: 006A434D, 006A4355, 006A435A, 006A435B, 006A437B, 006A449F

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: lstrlen$CompareCriticalInitializeSectionString
String ID: Failed to initialize engine section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$engine.cpp
API String ID: 3039292287-3209860532
Opcode ID: 992571af8355d4bed499a9fd1b44853af8ed398158b067aec0afd3e95de58159
Instruction ID: 69c0e0e06167fbceb07556e12b40aac295d418a0a0e555aa0d4d0b547d726631
Opcode Fuzzy Hash: 992571af8355d4bed499a9fd1b44853af8ed398158b067aec0afd3e95de58159
Instruction Fuzzy Hash: 3151C171A00256BECB20AB69CC86F9B77AAEF45760F010119F614D72A0DBB0AD50CAA4

Function 006AC28F Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 131
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,?,006AC47F,006A5405,?,?,006A5445), ref: 006AC2D6
GetLastError.KERNEL32(?,006AC47F,006A5405,?,?,006A5445,006A5445,00000000,?,00000000), ref: 006AC2E7
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,?,006AC47F,006A5405,?,?,006A5445,006A5445,00000000,?), ref: 006AC336
GetCurrentProcess.KERNEL32(000000FF,00000000,?,006AC47F,006A5405,?,?,006A5445,006A5445,00000000,?,00000000), ref: 006AC33C
DuplicateHandle.KERNELBASE(00000000,?,006AC47F,006A5405,?,?,006A5445,006A5445,00000000,?,00000000), ref: 006AC33F
GetLastError.KERNEL32(?,006AC47F,006A5405,?,?,006A5445,006A5445,00000000,?,00000000), ref: 006AC349
SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,006AC47F,006A5405,?,?,006A5445,006A5445,00000000,?,00000000), ref: 006AC39B
GetLastError.KERNEL32(?,006AC47F,006A5405,?,?,006A5445,006A5445,00000000,?,00000000), ref: 006AC3A5

Strings

Failed to duplicate handle to container: %ls, xrefs: 006AC37A
container.cpp, xrefs: 006AC30B, 006AC36D, 006AC3C9
Failed to open container., xrefs: 006AC3F1
Failed to open file: %ls, xrefs: 006AC318
feclient.dll, xrefs: 006AC398
Failed to move file pointer to container offset., xrefs: 006AC3D3
crypt32.dll, xrefs: 006AC397

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$container.cpp$crypt32.dll$feclient.dll
API String ID: 2619879409-373955632
Opcode ID: 4eb1e13dffcd8700b72c1a1576b9422fd7c021701ec3d1d9ab4f18a0b0803444
Instruction ID: f69c77845faea31651bb1c670514ec8263cca1e4ed9ed794a67e0039627181d1
Opcode Fuzzy Hash: 4eb1e13dffcd8700b72c1a1576b9422fd7c021701ec3d1d9ab4f18a0b0803444
Instruction Fuzzy Hash: 3441B336140241ABDF20AF5A8D49E5B3AB7EF86730B218429F914AF351EB71DC019FA0

Function 006E2AF7 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 79libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 006A3838: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 006A3877
Part of subcall function 006A3838: GetLastError.KERNEL32 ref: 006A3881

Part of subcall function 006E4A6C: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 006E4A9D

GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 006E2B41
GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 006E2B61
GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 006E2B81
GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 006E2BA1
GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 006E2BC1
GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 006E2BE1
GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 006E2C01

Strings

Msi.dll, xrefs: 006E2B09
MsiSourceListAddSourceExW, xrefs: 006E2BF6
MsiGetProductInfoExW, xrefs: 006E2BB6
MsiSetExternalUIRecord, xrefs: 006E2BD6
MsiGetPatchInfoExW, xrefs: 006E2B96
MsiEnumProductsExW, xrefs: 006E2B76
MsiDetermineApplicablePatchesW, xrefs: 006E2B56
MsiDeterminePatchSequenceW, xrefs: 006E2B36

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AddressProc$ErrorLast$DirectorySystem
String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
API String ID: 2510051996-1735120554
Opcode ID: ced5ed26d208852db3df08eec7982afe225c902175b37cce465b41750b7d5b67
Instruction ID: 6d72725ada1d99483746c0c1978216c5ea2c46f05c211d033fd2ff5e4c8828ef
Opcode Fuzzy Hash: ced5ed26d208852db3df08eec7982afe225c902175b37cce465b41750b7d5b67
Instruction Fuzzy Hash: 3731D4B0981349EADB119F21ED16B5A7BAAF714708F00836AE404562B0EFBF0A559F58

Function 006C1741 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 106COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,006AC3EB,?,00000000,?,006AC47F), ref: 006C1778
GetLastError.KERNEL32(?,006AC3EB,?,00000000,?,006AC47F,006A5405,?,?,006A5445,006A5445,00000000,?,00000000), ref: 006C1781

Strings

Failed to wait for operation complete., xrefs: 006C1854
cabextract.cpp, xrefs: 006C17A5, 006C17EB, 006C1837
Failed to create extraction thread., xrefs: 006C1841
Failed to copy file name., xrefs: 006C1763
Failed to create operation complete event., xrefs: 006C17F5
Failed to create begin operation event., xrefs: 006C17AF
wininet.dll, xrefs: 006C1757

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$cabextract.cpp$wininet.dll
API String ID: 545576003-938279966
Opcode ID: 905718399049c5953bb2af7a5e3633be210009ab209950344cde739c86f3b32d
Instruction ID: 264c87bd5009488be7fd07e1a1daa1379ce7b249958a0acd28bd73b523c4d31c
Opcode Fuzzy Hash: 905718399049c5953bb2af7a5e3633be210009ab209950344cde739c86f3b32d
Instruction Fuzzy Hash: 0021F8B7D4173A76E32116954C46F7B659FEF037A0B120229FE04BF282E650DC0085F5

Function 006DFCAE Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 006DFCD6
GetProcAddress.KERNEL32(SystemFunction041), ref: 006DFCE8
GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 006DFD2B
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 006DFD3F
GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 006DFD77
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 006DFD8B

Strings

AdvApi32.dll, xrefs: 006DFCB5
SystemFunction040, xrefs: 006DFCCB
cryputil.cpp, xrefs: 006DFD60
Crypt32.dll, xrefs: 006DFD0C
SystemFunction041, xrefs: 006DFCD8
CryptUnprotectMemory, xrefs: 006DFD6C
CryptProtectMemory, xrefs: 006DFD20

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$cryputil.cpp
API String ID: 4214558900-3191127217
Opcode ID: f332f7f6fe71bff210e27ebf507dbd5ecacb9dfa21bcaadf1c30a340c64b8b9f
Instruction ID: 220358d4fd680cccc75442eedc14a2198131e06623e5b1db958e744491969770
Opcode Fuzzy Hash: f332f7f6fe71bff210e27ebf507dbd5ecacb9dfa21bcaadf1c30a340c64b8b9f
Instruction Fuzzy Hash: DE21B372D41336DBC7316B91AD05B5679D3AF00B54F124376FC21AA3E0EB689D20CAD8

Function 006C08C2 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 006C08F2
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 006C090A
GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 006C090F
DuplicateHandle.KERNELBASE(00000000,?,?), ref: 006C0912
GetLastError.KERNEL32(?,?), ref: 006C091C
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 006C098B
GetLastError.KERNEL32(?,?), ref: 006C0998

Strings

Failed to add virtual file pointer for cab container., xrefs: 006C0971
cabextract.cpp, xrefs: 006C0940, 006C09BC
Failed to open cabinet file: %hs, xrefs: 006C09C9
<the>.cab, xrefs: 006C08EB
Failed to duplicate handle to cab container., xrefs: 006C094A

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$cabextract.cpp
API String ID: 3030546534-3446344238
Opcode ID: 1abfb51ac284efd3e24da1b0aa8aa9211e9cdb6b71162fe4beff2aabb60c5192
Instruction ID: 63ee82043468e0cee62f80efc16890b906b038aad1531662bcdb65db97ad86a9
Opcode Fuzzy Hash: 1abfb51ac284efd3e24da1b0aa8aa9211e9cdb6b71162fe4beff2aabb60c5192
Instruction Fuzzy Hash: A531E872941235FBFB215B958C49FAF7A6AEF04760F111119FE08BB251D770AD0086E4

Function 006B6A57 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 69COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000000FF,00000000,00000001,00000002,?,00000000,?,?,006A4E11,?,?), ref: 006B6A77
GetCurrentProcess.KERNEL32(?,00000000,?,?,006A4E11,?,?), ref: 006B6A7D
DuplicateHandle.KERNELBASE(00000000,?,?,006A4E11,?,?), ref: 006B6A80
GetLastError.KERNEL32(?,?,006A4E11,?,?), ref: 006B6A8A
CloseHandle.KERNEL32(000000FF,?,006A4E11,?,?), ref: 006B6B03

Strings

%ls -%ls=%u, xrefs: 006B6AD7
Failed to append the file handle to the command line., xrefs: 006B6AEB
core.cpp, xrefs: 006B6AAE
Failed to duplicate file handle for attached container., xrefs: 006B6AB8
burn.filehandle.attached, xrefs: 006B6AD0

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CurrentHandleProcess$CloseDuplicateErrorLast
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to duplicate file handle for attached container.$burn.filehandle.attached$core.cpp
API String ID: 4224961946-4196573879
Opcode ID: 225c83f305ec734ccad40713ab09bcc27016e730001eb6c59f2ec8502bc53a93
Instruction ID: 60dfd768170cbec185085a80bf0f4f47cd46215590341fb04ad9b9fa5f6492c7
Opcode Fuzzy Hash: 225c83f305ec734ccad40713ab09bcc27016e730001eb6c59f2ec8502bc53a93
Instruction Fuzzy Hash: 6D11B772941269FBCF10ABA4CC05E9F7B6AAF05730F114255FA20FB2D0D7B49E008790

Function 006E32F3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 006E3309
SysAllocString.OLEAUT32(?), ref: 006E3325
VariantClear.OLEAUT32(?), ref: 006E33AC
SysFreeString.OLEAUT32(00000000), ref: 006E33B7

Strings

xmlutil.cpp, xrefs: 006E333C
`)u, xrefs: 006E33B7

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: `)u$xmlutil.cpp
API String ID: 760788290-763603079
Opcode ID: f091f1a07d00ceca3afd6cdf6cdf0b1d50cce435a45ebae12843bb6e0de657e3
Instruction ID: 8bad42ec5fbff435ca6e71f4d9811493c2cc9e350ae9e558b7a144b517571fb1
Opcode Fuzzy Hash: f091f1a07d00ceca3afd6cdf6cdf0b1d50cce435a45ebae12843bb6e0de657e3
Instruction Fuzzy Hash: 3D217E319023A9ABCB11DF95C84DEAEBBBAAF85711F150158F901AB360DB319E018B90

Function 006E0879 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008,?,006A53BD,00000000,?,?,?,?,?,?,?,006B769D,00000000), ref: 006E0897
GetLastError.KERNEL32(?,?,?,?,?,?,?,006B769D,00000000), ref: 006E08A1
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,006B769D,00000000), ref: 006E08D3
GetLastError.KERNEL32(?,?,?,?,?,?,?,006B769D,00000000), ref: 006E08EC
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,006B769D,00000000), ref: 006E092B

Strings

procutil.cpp, xrefs: 006E0919

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLastToken$CloseHandleInformationOpenProcess
String ID: procutil.cpp
API String ID: 4040495316-1178289305
Opcode ID: a8f0a2ca736137977d8083a79cc5dca0ec2a23c1f753c4f5a6701f6457cf473e
Instruction ID: 94a40de321fb3801b4b40cae2610f406d9f2660439944a5106db397512550e10
Opcode Fuzzy Hash: a8f0a2ca736137977d8083a79cc5dca0ec2a23c1f753c4f5a6701f6457cf473e
Instruction Fuzzy Hash: 3521D432D02369EBEB219F969C44A9FBBA9EF10710F115156ED14AB351D3B09E40DAD0

Function 006B6B13 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 72fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000005,?,00000003,00000080,00000000,?,00000000,?,?,?), ref: 006B6B49
CloseHandle.KERNEL32(00000000), ref: 006B6BB9

Strings

burn.filehandle.self, xrefs: 006B6B5A, 006B6B8C
%ls -%ls=%u, xrefs: 006B6B61, 006B6B93
Failed to append the file handle to the obfuscated command line., xrefs: 006B6BA7
Failed to append the file handle to the command line., xrefs: 006B6B75

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to append the file handle to the obfuscated command line.$burn.filehandle.self
API String ID: 3498533004-3263533295
Opcode ID: f57cd7246e4c0bb7417a600ba169a0bd388cc828641150368191cd719424bb2c
Instruction ID: e0766aaf22bfe7f6a177faca6aed97d33f3344657a8b9d452dddb52d3dae23f3
Opcode Fuzzy Hash: f57cd7246e4c0bb7417a600ba169a0bd388cc828641150368191cd719424bb2c
Instruction Fuzzy Hash: 3E110372600654BFCB205A68CC45FAB77ABDB45B30F060350FE29EB2E1D7B458618691

Function 006E3565 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 006E3574
InterlockedIncrement.KERNEL32(0070B6C8), ref: 006E3591
CLSIDFromProgID.COMBASE(Msxml2.DOMDocument,0070B6B8,?,?,?,?,?,?), ref: 006E35AC
CLSIDFromProgID.OLE32(MSXML.DOMDocument,0070B6B8,?,?,?,?,?,?), ref: 006E35B8

Strings

MSXML.DOMDocument, xrefs: 006E35B3
Msxml2.DOMDocument, xrefs: 006E35A7

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: FromProg$IncrementInitializeInterlocked
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 2109125048-2356320334
Opcode ID: 0db012bc0f7792113c058037afbb1caf2a5fba79f07421e22d06ac9c9d02d6ff
Instruction ID: 8d35aec3cccb7b1c9ec725a4ff8abcd568f8ec74725ceb69b3ffaf557c6424a8
Opcode Fuzzy Hash: 0db012bc0f7792113c058037afbb1caf2a5fba79f07421e22d06ac9c9d02d6ff
Instruction Fuzzy Hash: D3F06530B423B5D7D3215B637D0DF572DABDB81B55F142629E900DB3A4D764CB418AB0

Function 006E4A6C Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 006E4A9D
GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 006E4ACA
GetLastError.KERNEL32(?,00000000,?,00000000), ref: 006E4AF6
GetLastError.KERNEL32(00000000,006EB7A0,?,00000000,?,00000000,?,00000000), ref: 006E4B34
GlobalFree.KERNEL32(00000000), ref: 006E4B65

Strings

fileutil.cpp, xrefs: 006E4AB8, 006E4B11

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$Global$AllocFree
String ID: fileutil.cpp
API String ID: 1145190524-2967768451
Opcode ID: d69ef48dde2641fe8f35bf9841ca6d02bdaa45d934038765fe7624b2caa057d9
Instruction ID: 732f88b9c9b0a7d61b19db4e1688eac356429f234959179dae5765c056355ded
Opcode Fuzzy Hash: d69ef48dde2641fe8f35bf9841ca6d02bdaa45d934038765fe7624b2caa057d9
Instruction Fuzzy Hash: 7C31A936D41369ABD7219AAA8C41FAFBBAAAF44760F114165FD14EB341DB30DD0086E4

Function 006C0A81 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 006C0B27
GetLastError.KERNEL32(?,?,?), ref: 006C0B31

Strings

cabextract.cpp, xrefs: 006C0B55
Failed to move file pointer 0x%x bytes., xrefs: 006C0B62
Invalid seek type., xrefs: 006C0ABD

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$cabextract.cpp
API String ID: 2976181284-417918914
Opcode ID: ed875076a462fc0f22c071dd63b8af9e410be31e5408ced700a138ddf91bdf08
Instruction ID: 50cdaef07ec6a84c6ae1af50d21dcf84e65f3e87ddf3dd608d7a765f981c7e5d
Opcode Fuzzy Hash: ed875076a462fc0f22c071dd63b8af9e410be31e5408ced700a138ddf91bdf08
Instruction Fuzzy Hash: 1131A371A4061AFFDB10DF98C884EBEB7AAFF08724B148219FA1497351D731EE108B90

Function 006A4115 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,006BA0E8,00000000,00000000,?,00000000,006A53BD,00000000,?,?,006AD5B5,?), ref: 006A4123
GetLastError.KERNEL32(?,006BA0E8,00000000,00000000,?,00000000,006A53BD,00000000,?,?,006AD5B5,?,00000000,00000000), ref: 006A4131
CreateDirectoryW.KERNEL32(?,840F01E8,006A5489,?,006BA0E8,00000000,00000000,?,00000000,006A53BD,00000000,?,?,006AD5B5,?,00000000), ref: 006A419A
GetLastError.KERNEL32(?,006BA0E8,00000000,00000000,?,00000000,006A53BD,00000000,?,?,006AD5B5,?,00000000,00000000), ref: 006A41A4

Strings

dirutil.cpp, xrefs: 006A41D4

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: dirutil.cpp
API String ID: 1375471231-2193988115
Opcode ID: 7fa4e7b516f0283197de1c86d7b07cc7fbca74968919445a94698f42643e0526
Instruction ID: 3b7448f31f79184f2d593556befc0b459d978f83aaac82fc68220f222602e5be
Opcode Fuzzy Hash: 7fa4e7b516f0283197de1c86d7b07cc7fbca74968919445a94698f42643e0526
Instruction Fuzzy Hash: F011D23660033596D7713AA54C84BBBA697EFF7B61F114025FD04EB350EBE48C819AD1

Function 006A56A9 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,006A6595,006A6595,?,006A563D,?,?,00000000), ref: 006A56E5
GetLastError.KERNEL32(?,006A563D,?,?,00000000,?,?,006A6595,?,006A7F02,?,?,?,?,?), ref: 006A5714

Strings

variable.cpp, xrefs: 006A5738
Failed to compare strings., xrefs: 006A5742
version.dll, xrefs: 006A56D7

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CompareErrorLastString
String ID: Failed to compare strings.$variable.cpp$version.dll
API String ID: 1733990998-4228644734
Opcode ID: 9447a1073a885d5d5befc596c41cf38aede68c3260563c21e7eae2df1150555a
Instruction ID: 8570ce5588a011ddefea094339e20f25abf2c7fa57924c992345d1f5eb17ea10
Opcode Fuzzy Hash: 9447a1073a885d5d5befc596c41cf38aede68c3260563c21e7eae2df1150555a
Instruction Fuzzy Hash: CF210A36641625EFC710DF98CD4499AB7A6EB06730B210319F926BB390E630ED018A90

Function 006E0A28 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,?,006A4F1C,?,000000FF,?,?,?,?,?,00000000,?,?), ref: 006E0A38
GetLastError.KERNEL32(?,?,006A4F1C,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?), ref: 006E0A46
GetExitCodeProcess.KERNELBASE(000000FF,?), ref: 006E0A8B
GetLastError.KERNEL32(?,?,006A4F1C,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?), ref: 006E0A95

Strings

procutil.cpp, xrefs: 006E0A6A

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectProcessSingleWait
String ID: procutil.cpp
API String ID: 590199018-1178289305
Opcode ID: b3581e7c306884341798d3562a399d3b4d268719063d78ed40c3da70bbc2dd61
Instruction ID: c84a2d17741c08510e61bf14f19aac9a339ab133fe8c4014d275b3b389232996
Opcode Fuzzy Hash: b3581e7c306884341798d3562a399d3b4d268719063d78ed40c3da70bbc2dd61
Instruction Fuzzy Hash: 3A112C37D0237DEBE7208B9A8D0469F7AA6DF04770F114164FD10AF391D2B08D409AD0

Function 006C09EA Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006C140C: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,006C0A19,?,?,?), ref: 006C1434
Part of subcall function 006C140C: GetLastError.KERNEL32(?,006C0A19,?,?,?), ref: 006C143E

ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 006C0A27
GetLastError.KERNEL32 ref: 006C0A31

Strings

cabextract.cpp, xrefs: 006C0A55
Failed to read during cabinet extraction., xrefs: 006C0A5F

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read during cabinet extraction.$cabextract.cpp
API String ID: 2170121939-2426083571
Opcode ID: 66e24e62b6feac12c48f8d0b3b7288414b1c1492e4caf998eb2da6d7ef04a449
Instruction ID: 63f84ebd135d3db8b7fd726def943b88b25e830ebf591ab42b1b243b9a413759
Opcode Fuzzy Hash: 66e24e62b6feac12c48f8d0b3b7288414b1c1492e4caf998eb2da6d7ef04a449
Instruction Fuzzy Hash: D411CE76A00269FBDB219FD5DC04EAA7BAAFF09760B114159FE08AB251C730A9108BD4

Function 006C140C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,006C0A19,?,?,?), ref: 006C1434
GetLastError.KERNEL32(?,006C0A19,?,?,?), ref: 006C143E

Strings

Failed to move to virtual file pointer., xrefs: 006C146C
cabextract.cpp, xrefs: 006C1462

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$cabextract.cpp
API String ID: 2976181284-3005670968
Opcode ID: 04a35ecfcf6e9c41d38f23ae722f437be95d37dba377e0d1a7b5ea2ac6dd0886
Instruction ID: bcf4fbce16ec4d3e2715c4eb0ab748dde9f1508071219e4cac96a488829b06de
Opcode Fuzzy Hash: 04a35ecfcf6e9c41d38f23ae722f437be95d37dba377e0d1a7b5ea2ac6dd0886
Instruction Fuzzy Hash: D501843794163AB797255A968C08FABBB57EF02770711C12AFE189E212D7259C10C6D4

Function 006E3EDD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 006E3F73
GetLastError.KERNEL32 ref: 006E3FD6

Strings

fileutil.cpp, xrefs: 006E3FFA

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: fileutil.cpp
API String ID: 1948546556-2967768451
Opcode ID: 1353f4c84c4759d41f4ad70a2ab316e279adc731e327be5b3d9fb4ba148e1b13
Instruction ID: f5f9e11dbd96c9740d55284d9a82edb4f2d0baef9d899353f115dbc74c0ea96a
Opcode Fuzzy Hash: 1353f4c84c4759d41f4ad70a2ab316e279adc731e327be5b3d9fb4ba148e1b13
Instruction Fuzzy Hash: CB317071E013B99BDB21CF56C944BDA77B6EB04751F0040AAFA48E7340DB749EC48B94

Function 006E4E3A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,?,006E3F9A,?,?,?), ref: 006E4E5E
GetLastError.KERNEL32(?,?,006E3F9A,?,?,?), ref: 006E4E68

Strings

fileutil.cpp, xrefs: 006E4E91

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: fileutil.cpp
API String ID: 442123175-2967768451
Opcode ID: 2fa127a9be7aeec65496e67b599c39393b5f3b1cc8cd79638e71c76081ec92d8
Instruction ID: 96ec91ee4a69081ae8698cd116257ab567984ba54f055291a9dfba84f78e4d57
Opcode Fuzzy Hash: 2fa127a9be7aeec65496e67b599c39393b5f3b1cc8cd79638e71c76081ec92d8
Instruction Fuzzy Hash: 02F06D33A01269ABC7209EAACD45ADFBB6EFB44761F110265FD04D7240DB31AE0086E0

Function 006E490D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,006B8770,00000000,00000000,00000000,00000000,00000000), ref: 006E4925
GetLastError.KERNEL32(?,?,?,006B8770,00000000,00000000,00000000,00000000,00000000), ref: 006E492F

Strings

fileutil.cpp, xrefs: 006E4953

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: fileutil.cpp
API String ID: 2976181284-2967768451
Opcode ID: 501e18084326abfcf2505175777d1c7f89a4ca3d66ea1f4b2825e38ea116d9c4
Instruction ID: 5e18b2a5a336a6edc561c640b159ef45834cf262a42be81b46c2e4c1b7be4ab2
Opcode Fuzzy Hash: 501e18084326abfcf2505175777d1c7f89a4ca3d66ea1f4b2825e38ea116d9c4
Instruction Fuzzy Hash: 3FF0F976605229ABCB208F95CC099AB7FAAEF047A0F014158FD14AB351E730DC10D7E0

Function 006A3838 Relevance: 4.6, APIs: 3, Instructions: 80libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 006A3877
GetLastError.KERNEL32 ref: 006A3881
LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 006A38EA

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem
String ID:
API String ID: 1230559179-0
Opcode ID: fa02793a5717b091bfacc6f5868b4a08aef9da5ef68937405acd72be7d7dd41a
Instruction ID: bdc4c9a90b289e61496378d8413af4ba4c3275cdeb3e25c0dfd2f3094195f9e6
Opcode Fuzzy Hash: fa02793a5717b091bfacc6f5868b4a08aef9da5ef68937405acd72be7d7dd41a
Instruction Fuzzy Hash: 1021D3B2D0133DA7DB20AB659C45F9B77AA9B02720F1101A5FE14EB341EA74DE408FD0

Function 006A3A16 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,006A3BB6,00000000,?,006A1474,00000000,80004005,00000000,80004005,00000000,000001C7,?,006A13B8), ref: 006A3A20
RtlFreeHeap.NTDLL(00000000,?,006A3BB6,00000000,?,006A1474,00000000,80004005,00000000,80004005,00000000,000001C7,?,006A13B8,000001C7,00000100), ref: 006A3A27
GetLastError.KERNEL32(?,006A3BB6,00000000,?,006A1474,00000000,80004005,00000000,80004005,00000000,000001C7,?,006A13B8,000001C7,00000100,?), ref: 006A3A31

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Heap$ErrorFreeLastProcess
String ID:
API String ID: 406640338-0
Opcode ID: 4a98abbdacaab42257bcd8492e6846fca60d672b6f7515ef799aed3b63b78f8b
Instruction ID: 71a9c94701cac2452905ba692efb45ea4808db71ee2808862fa9902bccf42422
Opcode Fuzzy Hash: 4a98abbdacaab42257bcd8492e6846fca60d672b6f7515ef799aed3b63b78f8b
Instruction Fuzzy Hash: 78D0C233A0023957832127E66C8C99B7E59EF01AB17011020FE48DA320DB21CC0086E4

Function 006DF479 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 006DF491

Part of subcall function 006E998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006E9A09
Part of subcall function 006E998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006E9A1A

Strings

PAct, xrefs: 006DF479, 006DF48B

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PAct
API String ID: 1269201914-2192161288
Opcode ID: 20a06df20e1a448a2fb8a861bd3f5dbdf9c82dba83aa1a7c239d15ff8a41c38a
Instruction ID: 86aab4f959d717c3a4e7dd24eb1cd21bd8cc2b8cd8fcae8f7039f8fca2efcea3
Opcode Fuzzy Hash: 20a06df20e1a448a2fb8a861bd3f5dbdf9c82dba83aa1a7c239d15ff8a41c38a
Instruction Fuzzy Hash: E1B012E537B601FCB28822115C02C37028DC5C1F21330C37FB441C00C2E8841C010077

Function 006DF4AA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 006DF491

Part of subcall function 006E998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006E9A09
Part of subcall function 006E998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006E9A1A

Strings

PAct, xrefs: 006DF48B

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PAct
API String ID: 1269201914-2192161288
Opcode ID: be22b39dbae2c389a21d774e0b3cdf533d95f78c312fae5bd4e3d361340960bc
Instruction ID: a6340eec26ec34700a461e556048f99c484107dc65608f207921b2328ec86006
Opcode Fuzzy Hash: be22b39dbae2c389a21d774e0b3cdf533d95f78c312fae5bd4e3d361340960bc
Instruction Fuzzy Hash: C3B092A126A601ACA28862155802C370289C5C5B21320836EB041C1182E88418410136

Function 006DF49A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 006DF491

Part of subcall function 006E998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006E9A09
Part of subcall function 006E998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006E9A1A

Strings

PAct, xrefs: 006DF48B

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PAct
API String ID: 1269201914-2192161288
Opcode ID: f81e1828604db1b2085f722a9130b7a10cd2f37cf9567dab6d6978cf6436c16d
Instruction ID: b53f7357f086a6586071ebb18a41d0c31ea66c0ba84a7756971e4cf5dfa8f5d9
Opcode Fuzzy Hash: f81e1828604db1b2085f722a9130b7a10cd2f37cf9567dab6d6978cf6436c16d
Instruction Fuzzy Hash: D9B012E137A601FDB2C862155D03D3702CDC5C5F21330437FB041C11C2E8881C020137

Function 006E35C3 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 006E35F8

Part of subcall function 006E304F: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,006E3609,00000000,?,00000000), ref: 006E3069
Part of subcall function 006E304F: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,006CC025,?,006A5405,?,00000000,?), ref: 006E3075

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorHandleInitLastModuleVariant
String ID:
API String ID: 52713655-0
Opcode ID: b729b2aa64cef044437fa2bb318b2dd0a0428f8390a02e6f5221b939c6ff78cd
Instruction ID: a4030c26ab46eb5e9e12a2f8e230135d1b65561d356582fd6241dda733b3124e
Opcode Fuzzy Hash: b729b2aa64cef044437fa2bb318b2dd0a0428f8390a02e6f5221b939c6ff78cd
Instruction Fuzzy Hash: C0314F76E01369ABCB11DFA9C888ADEB7F9EF08710F01456AED15EB311D6359D008BA4

Function 006A34B5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,006B8BD3,0000001C,80070490,00000000,00000000,80070490), ref: 006A34D5

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 729976df4c1521e8e9491ed3ddae9ac0831c9f1bfbb4689e0b0c17b91be70838
Instruction ID: 1efdd09874c8e4e5693cc0e8dcc3082d7e282bc731c96f4f210fa3a4b77d8665
Opcode Fuzzy Hash: 729976df4c1521e8e9491ed3ddae9ac0831c9f1bfbb4689e0b0c17b91be70838
Instruction Fuzzy Hash: B1E012722012257BE7427E655C05DEB7B9EEF0B354B008055FE40D6110D762DD508AB4

Function 006E2EFE Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(00000000,00000000,006A556E,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006E2F0B

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 5350d6f222075021a68acf9db9c09316deb757087ccac038460a041526a56e93
Instruction ID: d8eecdac3051110a5a9913037e9d381b60db31ac6cd1b333df5ca65c7efb3096
Opcode Fuzzy Hash: 5350d6f222075021a68acf9db9c09316deb757087ccac038460a041526a56e93
Instruction Fuzzy Hash: D4E0F6B1966265DECB008F69BD848427ABDF709B50304834BB800C3324CFBA46418FA8

Function 006E9674 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 006E966B

Part of subcall function 006E998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006E9A09
Part of subcall function 006E998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006E9A1A

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9712b66743bca34a93d2507d95dae4c333557b237ace1268c120f936eb677dca
Instruction ID: 0aa7402eaffe7c8918dfd6554fe4a95250bbdd06289d7b6d13351b9ca29c5c16
Opcode Fuzzy Hash: 9712b66743bca34a93d2507d95dae4c333557b237ace1268c120f936eb677dca
Instruction Fuzzy Hash: 6FB012D237A342FCBAC862161C03D37028DC9C0B11330C32FB800C10D2E8441C054337

Function 006E9653 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 006E966B

Part of subcall function 006E998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006E9A09
Part of subcall function 006E998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006E9A1A

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c0640c1062d9dcebb18b0c53b6a8634eaaf034dcd52be6b5104ad1dd41335d44
Instruction ID: 7a4d99b563147d3a924c05010171a1192d0af2c61231651ce829dcb91da29f33
Opcode Fuzzy Hash: c0640c1062d9dcebb18b0c53b6a8634eaaf034dcd52be6b5104ad1dd41335d44
Instruction Fuzzy Hash: D1B012D237A341FCBA8822026C82C37024DDDC0B11330832FB400E00D2E8441C01433B

Function 006E9684 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 006E966B

Part of subcall function 006E998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 006E9A09
Part of subcall function 006E998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 006E9A1A

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 515e90bb1931273081119e328832e36f5194bd35e0b6afcadce83dc07e5014cc
Instruction ID: a36e9eb6574150e52e24d28059fbf1d0850f94d20c51d2683c9f5be640740eea
Opcode Fuzzy Hash: 515e90bb1931273081119e328832e36f5194bd35e0b6afcadce83dc07e5014cc
Instruction Fuzzy Hash: EDB012D237A341FCBAC862462E43D37028DCDC0B11330432FB400D10D2E8481C024237

Function 006A14B6 Relevance: 1.3, APIs: 1, Instructions: 57stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,00000000,?,?,006A21A8,?,00000000,?,00000000,?,006A390C,00000000,?,00000104), ref: 006A14E8

Part of subcall function 006A3BD3: GetProcessHeap.KERNEL32(00000000,000001C7,?,006A21CC,000001C7,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3BDB
Part of subcall function 006A3BD3: HeapSize.KERNEL32(00000000,?,006A21CC,000001C7,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3BE2

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Heap$ProcessSizelstrlen
String ID:
API String ID: 3492610842-0
Opcode ID: 68cacc262c0e654b02135a435d456d2a8b20e3223231e83427af2f012ce72d71
Instruction ID: 915ad3b7b39c181439cf39b9ccc62a8d7afb355e3f192927085e8164153be33e
Opcode Fuzzy Hash: 68cacc262c0e654b02135a435d456d2a8b20e3223231e83427af2f012ce72d71
Instruction Fuzzy Hash: FF01D677600228ABCF117E58DC84F9AB7E7DF8B760F114219FA165F251D631AC118EA4

Non-executed Functions

Function 006AA8F1 Relevance: 172.2, APIs: 29, Strings: 69, Instructions: 688COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 006AB11C

Part of subcall function 006A394F: GetProcessHeap.KERNEL32(?,000001C7,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3960
Part of subcall function 006A394F: RtlAllocateHeap.NTDLL(00000000,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3967

CompareStringW.KERNEL32(0000007F,00000000,006ECA9C,000000FF,DirectorySearch,000000FF,006ECA9C,Condition,feclient.dll,006ECA9C,Variable,?,006ECA9C,006ECA9C,?,?), ref: 006AAA29
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exists,000000FF,?,Type,?,?,Path,006EB4D0), ref: 006AAA7E
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,path,000000FF), ref: 006AAA9A
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,FileSearch,000000FF), ref: 006AAABE
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exists,000000FF,?,Type,?,?,Path,006EB4D0), ref: 006AAB11
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 006AAB2B
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,RegistrySearch,000000FF), ref: 006AAB53
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,HKCR,000000FF,?,Root,?), ref: 006AAB91
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,HKCU,000000FF), ref: 006AABB0
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,HKLM,000000FF), ref: 006AABCF
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exists,000000FF,?,Win64,msi.dll,?,Type,?,?,Value,version.dll,?), ref: 006AAC8D
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,value,000000FF), ref: 006AACA7

Part of subcall function 006E32F3: VariantInit.OLEAUT32(?), ref: 006E3309
Part of subcall function 006E32F3: SysAllocString.OLEAUT32(?), ref: 006E3325
Part of subcall function 006E32F3: VariantClear.OLEAUT32(?), ref: 006E33AC
Part of subcall function 006E32F3: SysFreeString.OLEAUT32(00000000), ref: 006E33B7

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,numeric,000000FF,?,VariableType,?,?,ExpandEnvironment,cabinet.dll), ref: 006AAD06
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,string,000000FF), ref: 006AAD28
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 006AAD48
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,directory,000000FF), ref: 006AAE20
SysFreeString.OLEAUT32(?), ref: 006AAFFE

Strings

numeric, xrefs: 006AACF7
FileSearch, xrefs: 006AAAB1
Failed to get @Type., xrefs: 006AB0B0
path, xrefs: 006AAA8D, 006AAB3A
Failed to get next node., xrefs: 006AB0EB
Failed to get Key attribute., xrefs: 006AB06E
Failed to get search node count., xrefs: 006AA945
DirectorySearch|FileSearch|RegistrySearch|MsiComponentSearch|MsiProductSearch|MsiFeatureSearch, xrefs: 006AA90D
MsiProductSearch, xrefs: 006AAE39
Failed to get @UpgradeCode., xrefs: 006AB08D
Failed to get Win64 attribute., xrefs: 006AB046
Value, xrefs: 006AAC1F
Failed to get @ExpandEnvironment., xrefs: 006AB050
cabinet.dll, xrefs: 006AACBA
ETj, xrefs: 006AA8F1
VariableType, xrefs: 006AACDE
UpgradeCode, xrefs: 006AAE8C
Condition, xrefs: 006AA9F9
value, xrefs: 006AAC9A
version, xrefs: 006AAB1E, 006AAD3B, 006AAEDB
Failed to get @Root., xrefs: 006AB07F
Win64, xrefs: 006AAC5D
ComponentId, xrefs: 006AADA7
Failed to allocate memory for search structs., xrefs: 006AA97D
state, xrefs: 006AADF7, 006AAF13, 006AAFC5
ExpandEnvironment, xrefs: 006AACBB
Failed to get @FeatureId., xrefs: 006AB0B7
search.cpp, xrefs: 006AA973
Unexpected element name: %ls, xrefs: 006AB0CD
Failed to get @Variable., xrefs: 006AB0DD
Path, xrefs: 006AAA3B, 006AAACE
Failed to get @VariableType., xrefs: 006AB064
comres.dll, xrefs: 006AADA6, 006AAE5B, 006AAE8B, 006AAF90
RegistrySearch, xrefs: 006AAB46
exists, xrefs: 006AAA6F, 006AAB02, 006AAC7E
Invalid value for @VariableType: %ls, xrefs: 006AB05D
Variable, xrefs: 006AA9DE
Failed to get @Id., xrefs: 006AB0E4
Failed to get @Path., xrefs: 006AB032
ProductCode, xrefs: 006AAD84, 006AAE5C, 006AAF76
Failed to get @ProductCode., xrefs: 006AB0BE
wininet.dll, xrefs: 006AAC03
Failed to get @ProductCode or @UpgradeCode., xrefs: 006AB094
Invalid value for @Root: %ls, xrefs: 006AB078
FeatureId, xrefs: 006AAF91
Type, xrefs: 006AAA56, 006AAAE9, 006AAC42, 006AADC2, 006AAEC2, 006AAFAC
MsiComponentSearch, xrefs: 006AAD61
Invalid value for @Type: %ls, xrefs: 006AB0A1
language, xrefs: 006AAEF7
string, xrefs: 006AAD1B
Failed to get @ComponentId., xrefs: 006AB086
feclient.dll, xrefs: 006AA9F8
directory, xrefs: 006AAE13
MsiFeatureSearch, xrefs: 006AAF53
HKLM, xrefs: 006AABC2
keyPath, xrefs: 006AADDB
Failed to select search nodes., xrefs: 006AA920
Failed to get @Condition., xrefs: 006AB028
Root, xrefs: 006AAB69
Failed to get Value attribute., xrefs: 006AB03C
HKU, xrefs: 006AABE1
HKCU, xrefs: 006AABA3
Key, xrefs: 006AAC04
HKCR, xrefs: 006AAB82
`)u, xrefs: 006AAFFE, 006AB11C
assignment, xrefs: 006AAF2D
msi.dll, xrefs: 006AAC5C
DirectorySearch, xrefs: 006AAA1A
version.dll, xrefs: 006AAC1E

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: String$Compare$Free$HeapVariant$AllocAllocateClearInitProcess
String ID: ComponentId$Condition$DirectorySearch$DirectorySearch|FileSearch|RegistrySearch|MsiComponentSearch|MsiProductSearch|MsiFeatureSearch$ETj$ExpandEnvironment$Failed to allocate memory for search structs.$Failed to get @ComponentId.$Failed to get @Condition.$Failed to get @ExpandEnvironment.$Failed to get @FeatureId.$Failed to get @Id.$Failed to get @Path.$Failed to get @ProductCode or @UpgradeCode.$Failed to get @ProductCode.$Failed to get @Root.$Failed to get @Type.$Failed to get @UpgradeCode.$Failed to get @Variable.$Failed to get @VariableType.$Failed to get Key attribute.$Failed to get Value attribute.$Failed to get Win64 attribute.$Failed to get next node.$Failed to get search node count.$Failed to select search nodes.$FeatureId$FileSearch$HKCR$HKCU$HKLM$HKU$Invalid value for @Root: %ls$Invalid value for @Type: %ls$Invalid value for @VariableType: %ls$Key$MsiComponentSearch$MsiFeatureSearch$MsiProductSearch$Path$ProductCode$RegistrySearch$Root$Type$Unexpected element name: %ls$UpgradeCode$Value$Variable$VariableType$Win64$`)u$assignment$cabinet.dll$comres.dll$directory$exists$feclient.dll$keyPath$language$msi.dll$numeric$path$search.cpp$state$string$value$version$version.dll$wininet.dll
API String ID: 2748437055-2275996038
Opcode ID: ca86017aff4036dd16e2372c3c467da80064269ef3aabdbc67926f44d654eadf
Instruction ID: e29ae4c74fe23687b29a5fc003105bfcb0a862f9cfd11f14b33b6b52f9c0ca91
Opcode Fuzzy Hash: ca86017aff4036dd16e2372c3c467da80064269ef3aabdbc67926f44d654eadf
Instruction Fuzzy Hash: 4322E630D4A376BEDB20AAA58C06EAE7A67AF02730F314315F530B72D1D7719E40DA95

Function 006C41EA Relevance: 43.0, Strings: 34, Instructions: 498COMMON

Download Yara Rule

Strings

ACTION=ADMIN, xrefs: 006C4709
Failed to add reinstall all property on minor upgrade., xrefs: 006C45EA
Failed to install MSI package., xrefs: 006C4746
Failed to uninstall MSI package., xrefs: 006C47EF
crypt32.dll, xrefs: 006C440A
%ls%ls REINSTALLMODE="cmus%ls" REBOOT=ReallySuppress, xrefs: 006C4687
Failed to add feature action properties to argument string., xrefs: 006C44B9
IGNOREDEPENDENCIES, xrefs: 006C46A5, 006C4784
feclient.dll, xrefs: 006C42C5, 006C434D, 006C441D, 006C454B, 006C47D8
Failed to enable logging for package: %ls to: %ls, xrefs: 006C441F
msasn1.dll, xrefs: 006C440B
WixBundleExecutePackageCacheFolder, xrefs: 006C436A, 006C48A4
Failed to add feature action properties to obfuscated argument string., xrefs: 006C44DB
Failed to perform minor upgrade of MSI package., xrefs: 006C4638
WixBundleExecutePackageAction, xrefs: 006C43B7, 006C48B4
VersionString, xrefs: 006C428E, 006C42EF
Failed to get cached path for package: %ls, xrefs: 006C434F
Failed to initialize external UI handler., xrefs: 006C43F4
%ls %ls=ALL, xrefs: 006C46B6, 006C4795
REBOOT=ReallySuppress, xrefs: 006C45A0, 006C476C
Failed to run maintanance mode for MSI package., xrefs: 006C46F6
REINSTALL=ALL, xrefs: 006C45D3, 006C464D
Failed to add ADMIN property on admin install., xrefs: 006C471E
Failed to add obfuscated properties to argument string., xrefs: 006C4497
Failed to add reboot suppression property on install., xrefs: 006C45BB
Failed to add the list of dependencies to ignore to the properties., xrefs: 006C46CA
Failed to add patch properties to obfuscated argument string., xrefs: 006C451F
Failed to build MSI path., xrefs: 006C439D
Failed to add reboot suppression property on uninstall., xrefs: 006C477D
Failed to add patch properties to argument string., xrefs: 006C44FD
Failed to add reinstall mode and reboot suppression properties on minor upgrade., xrefs: 006C460C
Failed to add reinstall mode and reboot suppression properties on repair., xrefs: 006C469B
Failed to add properties to argument string., xrefs: 006C4463
REINSTALLMODE="vomus" REBOOT=ReallySuppress, xrefs: 006C45F5

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID:
String ID: ACTION=ADMIN$ REBOOT=ReallySuppress$ REINSTALL=ALL$ REINSTALLMODE="vomus" REBOOT=ReallySuppress$%ls %ls=ALL$%ls%ls REINSTALLMODE="cmus%ls" REBOOT=ReallySuppress$Failed to add ADMIN property on admin install.$Failed to add feature action properties to argument string.$Failed to add feature action properties to obfuscated argument string.$Failed to add obfuscated properties to argument string.$Failed to add patch properties to argument string.$Failed to add patch properties to obfuscated argument string.$Failed to add properties to argument string.$Failed to add reboot suppression property on install.$Failed to add reboot suppression property on uninstall.$Failed to add reinstall all property on minor upgrade.$Failed to add reinstall mode and reboot suppression properties on minor upgrade.$Failed to add reinstall mode and reboot suppression properties on repair.$Failed to add the list of dependencies to ignore to the properties.$Failed to build MSI path.$Failed to enable logging for package: %ls to: %ls$Failed to get cached path for package: %ls$Failed to initialize external UI handler.$Failed to install MSI package.$Failed to perform minor upgrade of MSI package.$Failed to run maintanance mode for MSI package.$Failed to uninstall MSI package.$IGNOREDEPENDENCIES$VersionString$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$crypt32.dll$feclient.dll$msasn1.dll
API String ID: 0-2033600224
Opcode ID: d6a1a45862177be999e123d1aa89cb73460edb8f20cac54ded2839814fc0ba6e
Instruction ID: 6818e0786251b928631b69eca3196da04b7189dcbba85239cef07ced0c797efc
Opcode Fuzzy Hash: d6a1a45862177be999e123d1aa89cb73460edb8f20cac54ded2839814fc0ba6e
Instruction Fuzzy Hash: F402A071901629AFDB21EE55CD61FB977ABFF44710F0101A9F608A7211DB32DEA0CB90

Function 006E1719 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 337COMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 006E17B1
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006E17BB
CreateWellKnownSid.ADVAPI32(0000001A,00000000,?,?), ref: 006E1808
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006E180E
CreateWellKnownSid.ADVAPI32(00000017,00000000,?,?), ref: 006E1848
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006E184E
CreateWellKnownSid.ADVAPI32(00000018,00000000,?,?), ref: 006E188E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006E1894
CreateWellKnownSid.ADVAPI32(00000010,00000000,?,?), ref: 006E18D4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006E18DA
CreateWellKnownSid.ADVAPI32(00000016,00000000,?,?), ref: 006E191A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006E1920
SetEntriesInAclA.ADVAPI32(00000005,?,00000000,?), ref: 006E1A11
SetSecurityDescriptorOwner.ADVAPI32(?,?,00000000), ref: 006E1A4B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006E1A55
SetSecurityDescriptorGroup.ADVAPI32(?,?,00000000), ref: 006E1A8D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006E1A97
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 006E1AD0
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006E1ADA
CoInitializeSecurity.OLE32(?,000000FF,00000000,00000000,00000006,00000002,00000000,00003000,00000000), ref: 006E1B18
LocalFree.KERNEL32(?), ref: 006E1B2E

Strings

srputil.cpp, xrefs: 006E17DC

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$CreateKnownSecurityWell$Descriptor$Initialize$DaclEntriesFreeGroupLocalOwner
String ID: srputil.cpp
API String ID: 267631441-4105181634
Opcode ID: 48be10a2f84b4171279da57b40c7fa42261f586152898efe5868f1d704db4472
Instruction ID: fa147bb3b7367ae9df9c3851441a3a3ef4c7f9a9357369454bbd5624a807a9ea
Opcode Fuzzy Hash: 48be10a2f84b4171279da57b40c7fa42261f586152898efe5868f1d704db4472
Instruction Fuzzy Hash: 47C15776D4237D9BDB308B968C48BDFFAB9AF45750F0101AAE905FB250E7709D409EA0

Function 006CC332 Relevance: 37.1, APIs: 1, Strings: 20, Instructions: 376COMMON

Download Yara Rule

Strings

Failed to allocate space for burn package payload inside of related bundle struct, xrefs: 006CC385
Failed to copy local source path for pseudo bundle., xrefs: 006CC43B
Failed to copy version for pseudo bundle., xrefs: 006CC72D
pseudobundle.cpp, xrefs: 006CC379, 006CC3B2, 006CC4A1, 006CC6D2
Failed to allocate memory for pseudo bundle payload hash., xrefs: 006CC4AD
Failed to copy uninstall arguments for related bundle package, xrefs: 006CC623
Failed to copy display name for pseudo bundle., xrefs: 006CC74F
Failed to copy install arguments for related bundle package, xrefs: 006CC584
Failed to append relation type to install arguments for related bundle package, xrefs: 006CC5A9
Failed to append relation type to uninstall arguments for related bundle package, xrefs: 006CC644
Failed to copy repair arguments for related bundle package, xrefs: 006CC5D0
-%ls, xrefs: 006CC34C
Failed to copy key for pseudo bundle payload., xrefs: 006CC3F3
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 006CC3BE
Failed to copy cache id for pseudo bundle., xrefs: 006CC55F
Failed to append relation type to repair arguments for related bundle package, xrefs: 006CC5F1
Failed to allocate memory for dependency providers., xrefs: 006CC6DE
Failed to copy key for pseudo bundle., xrefs: 006CC542
Failed to copy download source for pseudo bundle., xrefs: 006CC469
Failed to copy filename for pseudo bundle., xrefs: 006CC417

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: -%ls$Failed to allocate memory for dependency providers.$Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of related bundle struct$Failed to allocate space for burn payload inside of related bundle struct$Failed to append relation type to install arguments for related bundle package$Failed to append relation type to repair arguments for related bundle package$Failed to append relation type to uninstall arguments for related bundle package$Failed to copy cache id for pseudo bundle.$Failed to copy display name for pseudo bundle.$Failed to copy download source for pseudo bundle.$Failed to copy filename for pseudo bundle.$Failed to copy install arguments for related bundle package$Failed to copy key for pseudo bundle payload.$Failed to copy key for pseudo bundle.$Failed to copy local source path for pseudo bundle.$Failed to copy repair arguments for related bundle package$Failed to copy uninstall arguments for related bundle package$Failed to copy version for pseudo bundle.$pseudobundle.cpp
API String ID: 1357844191-2832335422
Opcode ID: f5c017587f1de014a339da17d81804a95fd416bd9c99f31998d2ca41774a8874
Instruction ID: d739d9c5afda144ec951c7810fab0befa8890becc834191ace5df460613a2aea
Opcode Fuzzy Hash: f5c017587f1de014a339da17d81804a95fd416bd9c99f31998d2ca41774a8874
Instruction Fuzzy Hash: E5C1B171640616ABDB55DF28C891F7A77ABFF09720B01812EFA19EB341D770EC209B94

Function 006A45EE Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 141sleepshutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?,00000001,00000000,?,?,?,?,?,?,?), ref: 006A4617
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 006A461E
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 006A4628
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 006A4678
GetLastError.KERNEL32 ref: 006A4682
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 006A46C6
GetLastError.KERNEL32 ref: 006A46D0
Sleep.KERNEL32(000003E8), ref: 006A470C
InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,80040002), ref: 006A471D
GetLastError.KERNEL32 ref: 006A4727
CloseHandle.KERNEL32(?), ref: 006A477D

Strings

Failed to schedule restart., xrefs: 006A4768
Failed to adjust token to add shutdown privileges., xrefs: 006A46FE
Failed to get shutdown privilege LUID., xrefs: 006A46B0
Failed to get process token., xrefs: 006A4656
engine.cpp, xrefs: 006A464C, 006A46A6, 006A46F4, 006A475E
SeShutdownPrivilege, xrefs: 006A466B

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$ProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSleepSystemValue
String ID: Failed to adjust token to add shutdown privileges.$Failed to get process token.$Failed to get shutdown privilege LUID.$Failed to schedule restart.$SeShutdownPrivilege$engine.cpp
API String ID: 2241679041-1583736410
Opcode ID: 9571ac9bfc2e4db3c8f8b7e9bd379f4dd0ae49e8d48fd6af191b754f77a2e4b6
Instruction ID: 2024fe52689531316660f951f3aa3a153504bc3b4e1278ae5ff036cd84080138
Opcode Fuzzy Hash: 9571ac9bfc2e4db3c8f8b7e9bd379f4dd0ae49e8d48fd6af191b754f77a2e4b6
Instruction Fuzzy Hash: 94412D33A41375ABD720ABA54D86BAF766BAB43760F111125FE00BB250EBA59C0049D5

Function 006B4EDF Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 165pipeCOMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD),00000001,?,00000000), ref: 006B4F0D
GetLastError.KERNEL32(?,00000000,?,?,006A452F,?), ref: 006B4F16
CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,?,?,00000000,?,?,006A452F,?), ref: 006B4FB8
GetLastError.KERNEL32(?,006A452F,?), ref: 006B4FC5
CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,00000000,?,?,?,?,?,?,?,006A452F), ref: 006B5040
GetLastError.KERNEL32(?,?,?,?,?,?,?,006A452F,?), ref: 006B504B
CloseHandle.KERNEL32(00000000,pipe.cpp,00000132,00000000,?,?,?,?,?,?,?,006A452F,?), ref: 006B508B
LocalFree.KERNEL32(00000000,?,006A452F,?), ref: 006B50B9

Strings

Failed to allocate full name of pipe: %ls, xrefs: 006B4F84
Failed to create the security descriptor for the connection event and pipe., xrefs: 006B4F44
Failed to allocate full name of cache pipe: %ls, xrefs: 006B5022
\\.\pipe\%ls.Cache, xrefs: 006B500C
\\.\pipe\%ls, xrefs: 006B4F6E
pipe.cpp, xrefs: 006B4F3A, 006B4FE9, 006B506F
Failed to create pipe: %ls, xrefs: 006B4FF6, 006B507C
D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD), xrefs: 006B4F08

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$CreateDescriptorNamedPipeSecurity$CloseConvertFreeHandleLocalString
String ID: D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD)$Failed to allocate full name of cache pipe: %ls$Failed to allocate full name of pipe: %ls$Failed to create pipe: %ls$Failed to create the security descriptor for the connection event and pipe.$\\.\pipe\%ls$\\.\pipe\%ls.Cache$pipe.cpp
API String ID: 1214480349-3253666091
Opcode ID: f3ac51d7b33856f9a1944201ecc1926461febf7dadcfca80434c56a9fd327880
Instruction ID: c1b956a911382e570691e575bb1c3e2178cff74ab2a6b69f119765c26725e828
Opcode Fuzzy Hash: f3ac51d7b33856f9a1944201ecc1926461febf7dadcfca80434c56a9fd327880
Instruction Fuzzy Hash: 2351E872D4172ABBDB21AB948C46FFE7B6AAF04720F110124FE01BB291D7755E808BD4

Function 006DFA62 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 173encryptionfileCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000003,F0000040,00000003,00000000,00000000,006B9F04,00000003,000007D0,00000003,?,000007D0,00000000,000007D0), ref: 006DFAC7
GetLastError.KERNEL32 ref: 006DFAD1
CryptCreateHash.ADVAPI32(?,?,00000000,00000000,?), ref: 006DFB0E
GetLastError.KERNEL32 ref: 006DFB18
CryptHashData.ADVAPI32(?,?,?,00000000), ref: 006DFB5F
ReadFile.KERNEL32(00000000,?,00001000,?,00000000), ref: 006DFB83
GetLastError.KERNEL32 ref: 006DFB8D
CryptDestroyHash.ADVAPI32(00000000), ref: 006DFBCA
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 006DFBE1
GetLastError.KERNEL32 ref: 006DFBFC
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000), ref: 006DFC34
GetLastError.KERNEL32 ref: 006DFC3E
SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00008004,00000001), ref: 006DFC77
GetLastError.KERNEL32 ref: 006DFC85

Strings

cryputil.cpp, xrefs: 006DFBB1

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CryptErrorLast$Hash$ContextFile$AcquireCreateDataDestroyParamPointerReadRelease
String ID: cryputil.cpp
API String ID: 3955742341-2185294990
Opcode ID: bc5d6cffb00834bea381e119fb7c036cc091582c80491f6097f63563a39166bd
Instruction ID: 46cc4a8bdb9e7ee6077cf5840dbc2d1f6f7eb4aeaceac1dd1daa5c7c40f7294c
Opcode Fuzzy Hash: bc5d6cffb00834bea381e119fb7c036cc091582c80491f6097f63563a39166bd
Instruction Fuzzy Hash: A7510637D40279ABD7318B51CC44BEB7AA6AF04751F0140B7BE49FA350E7749D808AE4

Function 006B9E9E Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 181COMMON

Download Yara Rule

Strings

Failed to concat complete cached path., xrefs: 006B9EF4
Failed to transfer working path to unverified path for payload: %ls., xrefs: 006B9FA4
Failed to reset permissions on unverified cached payload: %ls, xrefs: 006B9FF1
Failed to get cached path for package with cache id: %ls, xrefs: 006B9EC8
copying, xrefs: 006BA030, 006BA038
moving, xrefs: 006BA029
Failed to find payload: %ls in working path: %ls and unverified path: %ls, xrefs: 006B9FCB
Failed to move verified file to complete payload path: %ls, xrefs: 006BA06C
Failed to create unverified path., xrefs: 006B9F6E

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID:
String ID: Failed to concat complete cached path.$Failed to create unverified path.$Failed to find payload: %ls in working path: %ls and unverified path: %ls$Failed to get cached path for package with cache id: %ls$Failed to move verified file to complete payload path: %ls$Failed to reset permissions on unverified cached payload: %ls$Failed to transfer working path to unverified path for payload: %ls.$copying$moving
API String ID: 0-1289240508
Opcode ID: 871d7cbdfeacff8cd0e85e85a68b013c9d64c83f8f97f7004690091e1dcc5018
Instruction ID: bd56b7652bb50e82c6ad48482e9fb7b6feb96bb2af76900ac09158e102085b28
Opcode Fuzzy Hash: 871d7cbdfeacff8cd0e85e85a68b013c9d64c83f8f97f7004690091e1dcc5018
Instruction Fuzzy Hash: F1517D71941219FADF226FE4CC06FED7B77AF04710F104055FA00B62A1E7729EA1AB99

Function 006A62AA Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 144COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C), ref: 006A62F8
GetLastError.KERNEL32 ref: 006A6302

Strings

variable.cpp, xrefs: 006A6326
Failed to set variant value., xrefs: 006A6423
Failed to get OS info., xrefs: 006A6330

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLastVersion
String ID: Failed to get OS info.$Failed to set variant value.$variable.cpp
API String ID: 305913169-1971907631
Opcode ID: d0d44a06d79573e296debd2a296eb097925208579087d75b1125c77e56b044c0
Instruction ID: acebee4e6c607922c54bba49778f5096f2618b47c61ad516cfff74eb765d4b3d
Opcode Fuzzy Hash: d0d44a06d79573e296debd2a296eb097925208579087d75b1125c77e56b044c0
Instruction Fuzzy Hash: 6D41C971A01268EBDB20EB59CC49FEF7BBAEB4A720F141199F515E7250D6309E42CF90

Function 006DFEC6 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 132threadtimeCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0070B5FC,00000000,?,?,?,?,006C12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 006DFEF4
GetCurrentProcessId.KERNEL32(00000000,?,006C12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 006DFF04
GetCurrentThreadId.KERNEL32 ref: 006DFF0D
GetLocalTime.KERNEL32(8007139F,?,006C12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 006DFF23
LeaveCriticalSection.KERNEL32(0070B5FC,006C12CF,?,00000000,0000FDE9,?,006C12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 006E001A

Strings

$ep, xrefs: 006DFF61
0ep, xrefs: 006DFF70
(ep, xrefs: 006DFF5A
,ep, xrefs: 006DFF53
%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 006DFFC0

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
String ID: $ep$%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls$(ep$,ep$0ep
API String ID: 296830338-3915793786
Opcode ID: 97a6d67255df87a48b2cbae581501959eadd84c11b7eec117f083063012d9fe6
Instruction ID: 73f519132d6505f8ee800d75d7447c1d31ab909ef658e22f733b96e0b0443d75
Opcode Fuzzy Hash: 97a6d67255df87a48b2cbae581501959eadd84c11b7eec117f083063012d9fe6
Instruction Fuzzy Hash: 14417071D0125AEBDB219FA5DC44AFFB7B6EB08711F004126F901EA390D7399D91CBA1

Function 006A6037 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 107timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 006A6062
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,00000000,00000000), ref: 006A6076
GetLastError.KERNEL32 ref: 006A6088
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,00000000,?,00000000), ref: 006A60DC
GetLastError.KERNEL32 ref: 006A60E6

Strings

Failed to get the required buffer length for the Date., xrefs: 006A60AD
variable.cpp, xrefs: 006A60A3, 006A6101
Failed to set variant value., xrefs: 006A6124
Failed to allocate the buffer for the Date., xrefs: 006A60C4
Failed to get the Date., xrefs: 006A610B

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: DateErrorFormatLast$SystemTime
String ID: Failed to allocate the buffer for the Date.$Failed to get the Date.$Failed to get the required buffer length for the Date.$Failed to set variant value.$variable.cpp
API String ID: 2700948981-3682088697
Opcode ID: 5c940efb538dfc8d6fb5bf507c3cf1cfac9d3807c88dcf01a3497838caa6f457
Instruction ID: 251ca9c56a5ca3116d1a5f5a6305bd86c88f338292eed9e83b13902ebf8f7ee4
Opcode Fuzzy Hash: 5c940efb538dfc8d6fb5bf507c3cf1cfac9d3807c88dcf01a3497838caa6f457
Instruction Fuzzy Hash: 6F31ED32A413656BDB11ABE9CD46EAF7AA6AB05710F110029FE00FB281D6649D414AE5

Function 006B9B43 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000,?,*.*,?,?,?,00000000,.unverified,?), ref: 006B9BF2
lstrlenW.KERNEL32(?), ref: 006B9C19
FindNextFileW.KERNEL32(00000000,00000010), ref: 006B9C79
FindClose.KERNEL32(00000000), ref: 006B9C84

Part of subcall function 006A3CC4: GetFileAttributesW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 006A3D40
Part of subcall function 006A3CC4: GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 006A3D53

Strings

*.*, xrefs: 006B9BCC
.unverified, xrefs: 006B9B86

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: FileFind$AttributesCloseErrorFirstLastNextlstrlen
String ID: *.*$.unverified
API String ID: 457978746-2528915496
Opcode ID: 080aed0777604d662e9399303059ff3c9ea9d48eed0cfcdada5da8af2bffec9a
Instruction ID: 1bceb69678d1252cf8438754630e368e6e7ab9532611e918f7f170fbd0bba833
Opcode Fuzzy Hash: 080aed0777604d662e9399303059ff3c9ea9d48eed0cfcdada5da8af2bffec9a
Instruction Fuzzy Hash: B841B67090166CAECB61AB60DD4DBEA7BFAEF44301F1001A5E909E11A1EB758EC4DF58

Function 006E887B Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 77timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000001,00000000), ref: 006E88D0
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 006E88E2

Strings

feclient.dll, xrefs: 006E88AA
%04hu-%02hu-%02huT%02hu:%02hu:%02huZ, xrefs: 006E88B9
%04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u, xrefs: 006E892D
crypt32.dll, xrefs: 006E88A0

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Time$InformationLocalSpecificSystemZone
String ID: %04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u$%04hu-%02hu-%02huT%02hu:%02hu:%02huZ$crypt32.dll$feclient.dll
API String ID: 1772835396-1985132828
Opcode ID: 4c83e773043dd9ea2fd519d3058bae5beb82462f3d9cd647837cc8dbd8c8d667
Instruction ID: dce9021d75213ee618371891bed5aee3698204a5c05b2e47a7cdeb627448b3eb
Opcode Fuzzy Hash: 4c83e773043dd9ea2fd519d3058bae5beb82462f3d9cd647837cc8dbd8c8d667
Instruction Fuzzy Hash: 21212AA6901128EED760DB9ADC05EBFB3FDEB4CB11F00455AB945D6180E7389A80D770

Function 006DAA0E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 006DAB54

Strings

1#SNAN, xrefs: 006DBD53
1#QNAN, xrefs: 006DBD5A
1#INF, xrefs: 006DBD61
1#IND, xrefs: 006DBD4C

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 337c01edc67b631765879034c01e25ffd0ecadfc1a27eea60a773ff527732f9a
Instruction ID: 8e39bca56d8b73f217f4a8c9bf38e2fe5079c61fb83efdec68f4581f2c9c8357
Opcode Fuzzy Hash: 337c01edc67b631765879034c01e25ffd0ecadfc1a27eea60a773ff527732f9a
Instruction Fuzzy Hash: 26C22871E086288FDB25CE289D407EAB7B6EB88305F1551EBD40DE7344E779AE818F41

Function 006A61DF Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 006A620F
GetLastError.KERNEL32 ref: 006A6219

Strings

variable.cpp, xrefs: 006A6238
Failed to get the user name., xrefs: 006A6242
Failed to set variant value., xrefs: 006A625E

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLastNameUser
String ID: Failed to get the user name.$Failed to set variant value.$variable.cpp
API String ID: 2054405381-1522884404
Opcode ID: 5ed4668910c6fd76d38f2b7803d0b318c7d285617e728b8ebd36826ff5f4bf4d
Instruction ID: 2e82ca6a6f3888eff849848b171d351c5749be577f2b24c13d07851d243f6381
Opcode Fuzzy Hash: 5ed4668910c6fd76d38f2b7803d0b318c7d285617e728b8ebd36826ff5f4bf4d
Instruction Fuzzy Hash: D4014932A413386BC720AB55CC0AFAF77AADB01720F110299FC10E7241DA749F404ED4

Function 006DFE21 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00000900,?,?,00000000,00000000,00000000,?,00000000,?,?,006E04F4,?,?,?,?,00000001), ref: 006DFE40
GetLastError.KERNEL32(?,006E04F4,?,?,?,?,00000001,?,006A5616,?,?,00000000,?,?,006A5395,00000002), ref: 006DFE4C
LocalFree.KERNEL32(00000000,?,?,00000000,?,?,006E04F4,?,?,?,?,00000001,?,006A5616,?,?), ref: 006DFEB5

Strings

logutil.cpp, xrefs: 006DFE6B

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: logutil.cpp
API String ID: 1365068426-3545173039
Opcode ID: 334264810a1653b2cd237e9bf4f10e990a2bd5680800996512718fc53ba0d941
Instruction ID: 27c6881d4b5ab94851893395c648611be9155613547902b308f3f7e95e771ed3
Opcode Fuzzy Hash: 334264810a1653b2cd237e9bf4f10e990a2bd5680800996512718fc53ba0d941
Instruction Fuzzy Hash: C011BF32A00229FBDB219F818D05EEF7B6AEF14710F11406AFD069A372D7319E20D6A0

Function 006C6B88 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000003,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,006C6B32,00000000,00000003), ref: 006C6B9F
GetLastError.KERNEL32(?,006C6B32,00000000,00000003,00000000,?,?,?,?,?,?,?,?,?,006C6F28,?), ref: 006C6BA9

Strings

msuengine.cpp, xrefs: 006C6BCD
Failed to set service start type., xrefs: 006C6BD7

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ChangeConfigErrorLastService
String ID: Failed to set service start type.$msuengine.cpp
API String ID: 1456623077-1628545019
Opcode ID: 477281cfddd8c5a22f875da9a6b87d46f8abec05f7dc084a2a9fd05bba51ddd0
Instruction ID: b8650db73c54ea1673519b0e66247db774eff6018a2930133b30ccec02a6c40b
Opcode Fuzzy Hash: 477281cfddd8c5a22f875da9a6b87d46f8abec05f7dc084a2a9fd05bba51ddd0
Instruction Fuzzy Hash: 62F0A73364523577872026959C09E9B7D4ADF01770B110319FE28EA2D0DA559D1085E8

Function 006D3C76 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 006D3D6E
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 006D3D78
UnhandledExceptionFilter.KERNEL32(80003CDD,?,?,?,?,?,?), ref: 006D3D85

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a1d5b70e39502faedad9087a7c14a015d1736a7e4e4e3a0f91246debce1d0d32
Instruction ID: bb36040c21ba275482cd78a516744a37ff720f39cf68268e7e5eb318ec3463f0
Opcode Fuzzy Hash: a1d5b70e39502faedad9087a7c14a015d1736a7e4e4e3a0f91246debce1d0d32
Instruction Fuzzy Hash: 1131E27491122CABCB61DF65D989BD9BBB9FF18310F5051EAE40CA6250E7309F818F49

Function 006D7B87 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 006D7C51

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 3610adae4f53317315160f9dff0083063188d48e456d54aa178389a713d7ff67
Instruction ID: ee4283f48b9d1e61d62be781cfaadccf1f6395ff4bfb884417f9817509fbf512
Opcode Fuzzy Hash: 3610adae4f53317315160f9dff0083063188d48e456d54aa178389a713d7ff67
Instruction Fuzzy Hash: DA4105729042196ECB209F79CC89EFB77BAEB80314F10466AF905D7380F6319E818B54

Function 006DA560 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f8f95bc5e7c876d0a1a0b2598f8063104ee7b1299e502c05a036ee161ca1c45
Instruction ID: 767193fa53e743dad057c684934fd50ed9a0fd558ee9469f84068b86a896a93b
Opcode Fuzzy Hash: 4f8f95bc5e7c876d0a1a0b2598f8063104ee7b1299e502c05a036ee161ca1c45
Instruction Fuzzy Hash: 4E022C71E042199FDF14CFA9C8906ADB7F2EF88314F15826AD819EB384D731AE41CB95

Function 006E3A5F Relevance: 3.1, APIs: 2, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006E3BF1: RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,006E3A8E,?), ref: 006E3C62

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 006E3AB2
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 006E3AC3

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AllocateCheckCloseInitializeMembershipToken
String ID:
API String ID: 2114926846-0
Opcode ID: 8ee7609347a0a90eac154a558816a362d2e7cd8f01bd32e4e418da1ee3afb3a9
Instruction ID: 5d37f5e92d29ac2a97d4426bfeb2c28deab15eea2586e866d7f58aab3befc169
Opcode Fuzzy Hash: 8ee7609347a0a90eac154a558816a362d2e7cd8f01bd32e4e418da1ee3afb3a9
Instruction Fuzzy Hash: AF11397190135EABDB10DFA9CC89BAFB7B9FF08304F50483DA541AB251E7709A80CB55

Function 006E4440 Relevance: 3.0, APIs: 2, Instructions: 44fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(006C923A,?,00000100,00000000,00000000), ref: 006E447B
FindClose.KERNEL32(00000000), ref: 006E4487

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3cb56e906484d2f0dc25c19cefe5fa61006fb7ec4dcac621137b6c75896a1d5d
Instruction ID: 9d808eb25201830de174174a40f8369dd5c43f4e818b4e975b077a4fd30a6b8e
Opcode Fuzzy Hash: 3cb56e906484d2f0dc25c19cefe5fa61006fb7ec4dcac621137b6c75896a1d5d
Instruction Fuzzy Hash: 5301A232601248ABCB10EF66AD89EABB3AEEB85325F000169E914C7280DA345D498694

Function 006D2C18 Relevance: 2.7, Strings: 2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 006D2D88
comres.dll, xrefs: 006D2DBF, 006D2DD8, 006D2E00, 006D2E2B

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID:
String ID: 0$comres.dll
API String ID: 0-3030269839
Opcode ID: f7a880ec5967ec64a90054ca813bf1243ddeae79b496adee3d9f08ad155e7dd2
Instruction ID: ed35f188c1f78a6361a5f5f1122a8b4022864ac4e77253eb45cc1d6a0cee7e65
Opcode Fuzzy Hash: f7a880ec5967ec64a90054ca813bf1243ddeae79b496adee3d9f08ad155e7dd2
Instruction Fuzzy Hash: 42516870E14B0757DBB8496885B67FE23979F76340F18091FE843DB392C606DE42839A

Function 006DEE7C Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,006DEE77,?,?,00000008,?,?,006DEB17,00000000), ref: 006DF0A9

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d7519eb47575041018c126c6034c740b1a107f4b95022a73eafb20ba9ebd5d77
Instruction ID: e21ad84f3fdceaf9313c75973fe2fda2b49e9f3e0b5fc3bc21938bcedbfa8df5
Opcode Fuzzy Hash: d7519eb47575041018c126c6034c740b1a107f4b95022a73eafb20ba9ebd5d77
Instruction Fuzzy Hash: 9DB15F35A10609DFD715CF28C486BA57BE1FF45364F258669E89ACF3A2C336D982CB40

Function 006CEC07 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 006CEC20

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 6f175f9ea7ec756070b65589fc14cbbdbc3de6c7ddae13b3111de4d0c3d05c13
Instruction ID: 69959523d5a6ac43042ce23cb9e33d090ed09bbff2bd8146110ba39805f116d3
Opcode Fuzzy Hash: 6f175f9ea7ec756070b65589fc14cbbdbc3de6c7ddae13b3111de4d0c3d05c13
Instruction Fuzzy Hash: B4513771900319DBDB18CF59D886BAABBF5FB48310F24816ED405EB350E776AA10CB55

Function 006CE9DC Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002E9E8,006CE131), ref: 006CE9E1

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 55d50a9f076509a6fcb9368787a966d5efc5a252fddd112fc84f76bb7ce4cfc7
Instruction ID: 9712df93a7f58e0cc8d049156fec56b945b0d8b2a1f61bb9393d0451630aa308
Opcode Fuzzy Hash: 55d50a9f076509a6fcb9368787a966d5efc5a252fddd112fc84f76bb7ce4cfc7
Instruction Fuzzy Hash:

Function 006CFB89 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f228b55eb7d2d65ba948e77c885efd45861f5bcafbbd173ff521d5a0265d5833
Instruction ID: 798463956473cf2e682b6b072927b1d6fd1377b27fcb9ba05e53c6399a9f2774
Opcode Fuzzy Hash: f228b55eb7d2d65ba948e77c885efd45861f5bcafbbd173ff521d5a0265d5833
Instruction Fuzzy Hash: B502E8321041A21BDB2D4B3984705BB7BA3EA433B071E476ED8B6CF3D6DE10E565D660

Function 006D0B6F Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 713254dbb735968c7063ac25a152bc56bcdf297f8f834348282298adb5de4d15
Instruction ID: cde1236f57a3e045e7b1d7464c1f4a66d55b936eec38caff52c850c15bb535fc
Opcode Fuzzy Hash: 713254dbb735968c7063ac25a152bc56bcdf297f8f834348282298adb5de4d15
Instruction Fuzzy Hash: E1C16B335091A30AFF6D433984742BEBBA35A923B171A179FD4B2CB3D5EE209535D620

Function 006D07AA Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3c7a540a95456d95b2f03679edd2d49eac6f1621006280bdad19664e1d0b21d
Instruction ID: d5ac5ce3626c07efe2eb3c0a9db6ad452e59548ad53c70b394bcb669d2e5f523
Opcode Fuzzy Hash: f3c7a540a95456d95b2f03679edd2d49eac6f1621006280bdad19664e1d0b21d
Instruction Fuzzy Hash: CCC18A379051A20AFF2D423984742BEBBA25E92371B1E175FD4F2CF3C6EE209565D620

Function 006D03D5 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c190a499e79552c1a64f39d84a7142e521bf6eb77b491d3645054bb47bb5be
Instruction ID: 777e7312bd8111413aee9f8089369819c2a4cbb1d949d94fc96d6232968777f9
Opcode Fuzzy Hash: 43c190a499e79552c1a64f39d84a7142e521bf6eb77b491d3645054bb47bb5be
Instruction Fuzzy Hash: CEC1B7329051A34BFF1D423985746BEBBE25A923B0B1A079FD4B2CB3D5EE20D535D620

Function 006D001D Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d2de95a5a3d7d395022a3d348c00081b72a5afa3478eed40d51441493dea68
Instruction ID: 361ccbbfeb0f47d8e00c5505ed71a81cc4bc3a85b764fc88dec3c3c5a189fa5c
Opcode Fuzzy Hash: c3d2de95a5a3d7d395022a3d348c00081b72a5afa3478eed40d51441493dea68
Instruction Fuzzy Hash: C9B198329051635BFF2D423984346BEBBA25A933B1B1B175FD4B2CB3C5EE209525D620

Function 006D2E47 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c627c5a3c993d2809967ccf91f68df1dc47f2048bfbc12a8adc328c246f7c49a
Instruction ID: b3653887c98efc923039b7b6a4d9ba6508470228735972fd7cd77e165c561a18
Opcode Fuzzy Hash: c627c5a3c993d2809967ccf91f68df1dc47f2048bfbc12a8adc328c246f7c49a
Instruction Fuzzy Hash: 44614A71E8070B56DB385B2888B5BFE63A7ABB1700F140D1BE942DF381D6119E82835A

Function 006ACDBD Relevance: 86.1, APIs: 3, Strings: 46, Instructions: 366COMMON

Download Yara Rule

APIs

Part of subcall function 006A394F: GetProcessHeap.KERNEL32(?,000001C7,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3960
Part of subcall function 006A394F: RtlAllocateHeap.NTDLL(00000000,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3967

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,download,000000FF,00000000,Packaging,00000000,00000000,FilePath,comres.dll,00000000,006ECA9C,?,00000000), ref: 006ACEF3

Strings

Failed to find catalog., xrefs: 006AD1CE
Failed to get @Container., xrefs: 006AD18D
Failed to get next node., xrefs: 006AD228
Failed to get @DownloadUrl., xrefs: 006AD1EA
Failed to get @CertificateRootThumbprint., xrefs: 006AD1C7
payload.cpp, xrefs: 006ACE3F
Failed to hex decode @CertificateRootPublicKeyIdentifier., xrefs: 006AD1B2
Payload, xrefs: 006ACDD8
Failed to get @LayoutOnly., xrefs: 006AD197
Packaging, xrefs: 006ACEC6
Failed to get @Hash., xrefs: 006AD1E3
cabinet.dll, xrefs: 006AD0A0
LayoutOnly, xrefs: 006ACF8D
Failed to parse @FileSize., xrefs: 006AD1A1
feclient.dll, xrefs: 006ACF8C
SourcePath, xrefs: 006ACFB0
msasn1.dll, xrefs: 006AD024
Failed to get @Packaging., xrefs: 006AD213
FileSize, xrefs: 006AD002
Failed to get @CertificateRootPublicKeyIdentifier., xrefs: 006AD1B9
Failed to hex decode @CertificateRootThumbprint., xrefs: 006AD1C0
FilePath, xrefs: 006ACEAB
comres.dll, xrefs: 006ACEAA
Hash, xrefs: 006AD0B7
Failed to allocate memory for payload structs., xrefs: 006ACE49
external, xrefs: 006ACF21
Failed to get @SourcePath., xrefs: 006AD1F1
CertificateRootPublicKeyIdentifier, xrefs: 006AD03D
DownloadUrl, xrefs: 006ACFD9
Invalid value for @Packaging: %ls, xrefs: 006AD200
Failed to hex decode the Payload/@Hash., xrefs: 006AD1DC
Failed to get @Id., xrefs: 006AD221
Failed to get @FileSize., xrefs: 006AD1AB
Failed to to find container: %ls, xrefs: 006AD186
Failed to get @Catalog., xrefs: 006AD1D5
Catalog, xrefs: 006AD0EC
CertificateRootThumbprint, xrefs: 006AD07A
Failed to select payload nodes., xrefs: 006ACDEB
embedded, xrefs: 006ACF05
download, xrefs: 006ACEE5
Failed to get @FilePath., xrefs: 006AD21A
msi.dll, xrefs: 006AD05F
Failed to get payload node count., xrefs: 006ACE10
Container, xrefs: 006ACF4B
wininet.dll, xrefs: 006AD10E
version.dll, xrefs: 006AD063

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Heap$AllocateCompareProcessString
String ID: Catalog$CertificateRootPublicKeyIdentifier$CertificateRootThumbprint$Container$DownloadUrl$Failed to allocate memory for payload structs.$Failed to find catalog.$Failed to get @Catalog.$Failed to get @CertificateRootPublicKeyIdentifier.$Failed to get @CertificateRootThumbprint.$Failed to get @Container.$Failed to get @DownloadUrl.$Failed to get @FilePath.$Failed to get @FileSize.$Failed to get @Hash.$Failed to get @Id.$Failed to get @LayoutOnly.$Failed to get @Packaging.$Failed to get @SourcePath.$Failed to get next node.$Failed to get payload node count.$Failed to hex decode @CertificateRootPublicKeyIdentifier.$Failed to hex decode @CertificateRootThumbprint.$Failed to hex decode the Payload/@Hash.$Failed to parse @FileSize.$Failed to select payload nodes.$Failed to to find container: %ls$FilePath$FileSize$Hash$Invalid value for @Packaging: %ls$LayoutOnly$Packaging$Payload$SourcePath$cabinet.dll$comres.dll$download$embedded$external$feclient.dll$msasn1.dll$msi.dll$payload.cpp$version.dll$wininet.dll
API String ID: 1171520630-1949177747
Opcode ID: ac9819d2c4a7af9d4eea678cdce0c8a98fd173373bfe130cfb6caa356ed32979
Instruction ID: 22832d74d746b3da5b612d7d144de7d5f358b1e0b3ac27343f078d4088eba880
Opcode Fuzzy Hash: ac9819d2c4a7af9d4eea678cdce0c8a98fd173373bfe130cfb6caa356ed32979
Instruction Fuzzy Hash: 0CC1D271D42369BFCB11AB95CC05FADB667AF06B20F214165FA02BB690C771EE01DE90

Function 006AFF99 Relevance: 84.5, APIs: 1, Strings: 47, Instructions: 484registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000101,?,?,00020006,00000000), ref: 006B0592

Strings

ParentDisplayName, xrefs: 006B02F2, 006B0305
Failed to update name and publisher., xrefs: 006B01EE
EstimatedSize, xrefs: 006B051C, 006B0521, 006B0530
%hs, xrefs: 006B0198
Failed to register the bundle dependency key., xrefs: 006B0553
BundleDetectCode, xrefs: 006B0093, 006B009B
Failed to update resume mode., xrefs: 006B056D
BundleVersion, xrefs: 006B00CF, 006B00F5
"%ls" %ls, xrefs: 006B0484
URLUpdateInfo, xrefs: 006B02CC, 006B02DF
SystemComponent, xrefs: 006B0428, 006B043B
3.11.1.2318, xrefs: 006B0193
HelpLink, xrefs: 006B025A, 006B026D
QuietUninstallString, xrefs: 006B044D, 006B0463
DisplayVersion, xrefs: 006B0201, 006B0214
HelpTelephone, xrefs: 006B0280, 006B0293
%s,0, xrefs: 006B01C0
Failed to write software tags., xrefs: 006B04C5
Publisher, xrefs: 006B0234, 006B0247
VersionMajor, xrefs: 006B010F, 006B0115
Comments, xrefs: 006B033A, 006B034D
BundleProviderKey, xrefs: 006B015A, 006B015F
NoModify, xrefs: 006B038B, 006B039E
NoElevateOnModify, xrefs: 006B03D7, 006B03EA
ParentKeyName, xrefs: 006B0312, 006B0325
%hu.%hu.%hu.%hu, xrefs: 006B00F0
"%ls" /uninstall /quiet, xrefs: 006B0448
Failed to write %ls value., xrefs: 006B0531
URLInfoAbout, xrefs: 006B02A6, 006B02B9
BundleAddonCode, xrefs: 006B0075, 006B007D
BundleTag, xrefs: 006B017B, 006B0180
Failed to create registration key., xrefs: 006B001C
NoRemove, xrefs: 006B0403, 006B0416
DisplayIcon, xrefs: 006B01BB, 006B01C5
Contact, xrefs: 006B0362, 006B0375
Failed to cache bundle from path: %ls, xrefs: 006AFFEF
Failed to write update registration., xrefs: 006B04E5
"%ls" /modify, xrefs: 006B03B0
BundleUpgradeCode, xrefs: 006B0057, 006B005F
/uninstall, xrefs: 006B047B, 006B0480
BundlePatchCode, xrefs: 006B00B1, 006B00B9
EngineVersion, xrefs: 006B019D, 006B01A2
ModifyPath, xrefs: 006B03B5, 006B03CB
/modify, xrefs: 006B0474
UninstallString, xrefs: 006B0489, 006B049F
VersionMinor, xrefs: 006B0138, 006B013E
BundleCachePath, xrefs: 006B003C, 006B0041

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Close
String ID: /uninstall$"%ls" %ls$"%ls" /modify$"%ls" /uninstall /quiet$%hs$%hu.%hu.%hu.%hu$%s,0$/modify$3.11.1.2318$BundleAddonCode$BundleCachePath$BundleDetectCode$BundlePatchCode$BundleProviderKey$BundleTag$BundleUpgradeCode$BundleVersion$Comments$Contact$DisplayIcon$DisplayVersion$EngineVersion$EstimatedSize$Failed to cache bundle from path: %ls$Failed to create registration key.$Failed to register the bundle dependency key.$Failed to update name and publisher.$Failed to update resume mode.$Failed to write %ls value.$Failed to write software tags.$Failed to write update registration.$HelpLink$HelpTelephone$ModifyPath$NoElevateOnModify$NoModify$NoRemove$ParentDisplayName$ParentKeyName$Publisher$QuietUninstallString$SystemComponent$URLInfoAbout$URLUpdateInfo$UninstallString$VersionMajor$VersionMinor
API String ID: 3535843008-2755343042
Opcode ID: f511ceb1a82877e6b897e5de3005d896aba12b45204c2c2b475d67ba169125e5
Instruction ID: 52060bda00e6b95572b34a5f4538b745b60940734372e7d42b0a8080fabe7a56
Opcode Fuzzy Hash: f511ceb1a82877e6b897e5de3005d896aba12b45204c2c2b475d67ba169125e5
Instruction Fuzzy Hash: 11F1E4B294166AFBEB325A50CE02FFF7EA7AB04710F150150FA0066662D771ED90EBD4

Function 006A8476 Relevance: 61.6, APIs: 5, Strings: 30, Instructions: 331COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,80070490,?,?,?,?,?,?,?,ETj,006CC1BF,?,?,?), ref: 006A84A7
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,ETj,006CC1BF,?,?,?,?,ETj,Chain), ref: 006A8804

Strings

numeric, xrefs: 006A85BC
Failed to get @Type., xrefs: 006A8788
Failed to get next node., xrefs: 006A87F6
variable.cpp, xrefs: 006A87B9
Initializing hidden variable '%ls', xrefs: 006A8671
Persisted, xrefs: 006A854A
Type, xrefs: 006A85A3
Failed to change variant type., xrefs: 006A87DA
Initializing numeric variable '%ls' to value '%ls', xrefs: 006A85E2
Failed to get @Persisted., xrefs: 006A87E1
Value, xrefs: 006A8565
Invalid value for @Type: %ls, xrefs: 006A8778
Failed to set value of variable: %ls, xrefs: 006A87A7
Failed to insert variable '%ls'., xrefs: 006A86C6
string, xrefs: 006A85F7
Failed to get variable node count., xrefs: 006A84E1
Failed to select variable nodes., xrefs: 006A84C4
ETj, xrefs: 006A8476
Initializing version variable '%ls' to value '%ls', xrefs: 006A8653
Hidden, xrefs: 006A852F
version, xrefs: 006A862C
Failed to set variant value., xrefs: 006A878F
Failed to get @Hidden., xrefs: 006A87E8
Variable, xrefs: 006A84B1
Attempt to set built-in variable value: %ls, xrefs: 006A87C8
Failed to get @Id., xrefs: 006A87EF
Failed to set variant encryption, xrefs: 006A879D
Failed to find variable value '%ls'., xrefs: 006A87D2
Initializing string variable '%ls' to value '%ls', xrefs: 006A861A
Failed to get @Value., xrefs: 006A8796

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Attempt to set built-in variable value: %ls$ETj$Failed to change variant type.$Failed to find variable value '%ls'.$Failed to get @Hidden.$Failed to get @Id.$Failed to get @Persisted.$Failed to get @Type.$Failed to get @Value.$Failed to get next node.$Failed to get variable node count.$Failed to insert variable '%ls'.$Failed to select variable nodes.$Failed to set value of variable: %ls$Failed to set variant encryption$Failed to set variant value.$Hidden$Initializing hidden variable '%ls'$Initializing numeric variable '%ls' to value '%ls'$Initializing string variable '%ls' to value '%ls'$Initializing version variable '%ls' to value '%ls'$Invalid value for @Type: %ls$Persisted$Type$Value$Variable$numeric$string$variable.cpp$version
API String ID: 3168844106-1225640335
Opcode ID: 756eb76b762917539d9a5d6eac836504f9fb06d945412f9420e6f3c054f6feba
Instruction ID: a26edcc9d109cae349f1e4bb4bb7781d525dad59ea231cef71a85d955b5ea3dc
Opcode Fuzzy Hash: 756eb76b762917539d9a5d6eac836504f9fb06d945412f9420e6f3c054f6feba
Instruction Fuzzy Hash: 1BB1C032D01369BFCB11AB95CC45EAEBAB7AF05720F210268F910B7290DB719E41DF94

Function 006C6CCC Relevance: 58.1, APIs: 7, Strings: 26, Instructions: 379COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,006BBDDC,00000007,?,?,?), ref: 006C6D20

Part of subcall function 006E0ACC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,006A5EB2,00000000), ref: 006E0AE0
Part of subcall function 006E0ACC: GetProcAddress.KERNEL32(00000000), ref: 006E0AE7
Part of subcall function 006E0ACC: GetLastError.KERNEL32(?,?,?,006A5EB2,00000000), ref: 006E0AFE

CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 006C710F
CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 006C7123

Strings

Bootstrapper application aborted during MSU progress., xrefs: 006C7054
Failed to find Windows directory., xrefs: 006C6D5F
Failed to format MSU install command., xrefs: 006C6E5C
Failed to allocate WUSA.exe path., xrefs: 006C6DB3
Failed to wait for executable to complete: %ls, xrefs: 006C709E
msuengine.cpp, xrefs: 006C6F8D, 006C7022, 006C704A
D, xrefs: 006C6F3B
Failed to format MSU uninstall command., xrefs: 006C6E89
Failed to append log path to MSU command-line., xrefs: 006C6ED4
WixBundleExecutePackageCacheFolder, xrefs: 006C6E0B, 006C713B
"%ls" "%ls" /quiet /norestart, xrefs: 006C6E48
/log:, xrefs: 006C6EA2
Failed to append SysNative directory., xrefs: 006C6D7D
Failed to get cached path for package: %ls, xrefs: 006C6DFC
2, xrefs: 006C6FB3
Failed to get action arguments for MSU package., xrefs: 006C6DD6
Failed to get process exit code., xrefs: 006C702C
Failed to determine WOW64 status., xrefs: 006C6D32
Failed to build MSU path., xrefs: 006C6E35
wusa.exe, xrefs: 006C6DA0
Failed to ensure WU service was enabled to install MSU package., xrefs: 006C6F2E
Failed to find System32 directory., xrefs: 006C6D95
Failed to CreateProcess on path: %ls, xrefs: 006C6F9A
Failed to append log switch to MSU command-line., xrefs: 006C6EB6
SysNative\, xrefs: 006C6D6A
"%ls" /uninstall /kb:%ls /quiet /norestart, xrefs: 006C6E75

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Handle$Close$AddressCurrentErrorLastModuleProcProcess
String ID: /log:$"%ls" "%ls" /quiet /norestart$"%ls" /uninstall /kb:%ls /quiet /norestart$2$Bootstrapper application aborted during MSU progress.$D$Failed to CreateProcess on path: %ls$Failed to allocate WUSA.exe path.$Failed to append SysNative directory.$Failed to append log path to MSU command-line.$Failed to append log switch to MSU command-line.$Failed to build MSU path.$Failed to determine WOW64 status.$Failed to ensure WU service was enabled to install MSU package.$Failed to find System32 directory.$Failed to find Windows directory.$Failed to format MSU install command.$Failed to format MSU uninstall command.$Failed to get action arguments for MSU package.$Failed to get cached path for package: %ls$Failed to get process exit code.$Failed to wait for executable to complete: %ls$SysNative\$WixBundleExecutePackageCacheFolder$msuengine.cpp$wusa.exe
API String ID: 1400713077-4261965642
Opcode ID: 627720fd8129f40e3a81820d4fc130537be6670f0ca0a871a49720750b4450f3
Instruction ID: a03c6980467176827fd731ea4b85261f2f230934c63bf6ee4c135bdff23d8157
Opcode Fuzzy Hash: 627720fd8129f40e3a81820d4fc130537be6670f0ca0a871a49720750b4450f3
Instruction Fuzzy Hash: 1AD183B1B4031AABDB11AFA5CC85FFE7BBBEF08704F10002DF601A6151D7B5AA419B58

Function 006B54DC Relevance: 52.7, APIs: 17, Strings: 13, Instructions: 229filepipesleepCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,?,006EB500,?,00000000,?,006A452F,?,006EB500), ref: 006B54FD
GetCurrentProcessId.KERNEL32(?,006A452F,?,006EB500), ref: 006B5508
SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,006A452F,?,006EB500), ref: 006B553F
ConnectNamedPipe.KERNEL32(?,00000000,?,006A452F,?,006EB500), ref: 006B5554
GetLastError.KERNEL32(?,006A452F,?,006EB500), ref: 006B555E
Sleep.KERNEL32(00000064,?,006A452F,?,006EB500), ref: 006B5593
SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,006A452F,?,006EB500), ref: 006B55B6
WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,006A452F,?,006EB500), ref: 006B55D1
WriteFile.KERNEL32(?,/Ej,006EB500,00000000,00000000,?,006A452F,?,006EB500), ref: 006B55EC
WriteFile.KERNEL32(?,comres.dll,00000004,feclient.dll,00000000,?,006A452F,?,006EB500), ref: 006B5607
ReadFile.KERNEL32(?,wininet.dll,00000004,feclient.dll,00000000,?,006A452F,?,006EB500), ref: 006B5622
GetLastError.KERNEL32(?,006A452F,?,006EB500), ref: 006B567D
GetLastError.KERNEL32(?,006A452F,?,006EB500), ref: 006B56B1
GetLastError.KERNEL32(?,006A452F,?,006EB500), ref: 006B56E5
GetLastError.KERNEL32(?,006A452F,?,006EB500), ref: 006B5719
GetLastError.KERNEL32(?,006A452F,?,006EB500), ref: 006B574A
GetLastError.KERNEL32(?,006A452F,?,006EB500), ref: 006B577B

Strings

Failed to reset pipe to blocking., xrefs: 006B5774
comres.dll, xrefs: 006B5605
Failed to wait for child to connect to pipe., xrefs: 006B5673
/Ej, xrefs: 006B55E8
crypt32.dll, xrefs: 006B55CF
Failed to write secret to pipe., xrefs: 006B570F
Failed to write our process id to pipe., xrefs: 006B56DB
pipe.cpp, xrefs: 006B5669, 006B569D, 006B56D1, 006B5705, 006B5739, 006B576A, 006B579B
Failed to read ACK from pipe., xrefs: 006B56A7
Failed to write secret length to pipe., xrefs: 006B5743
feclient.dll, xrefs: 006B55FF, 006B561A
Failed to set pipe to non-blocking., xrefs: 006B57A5
wininet.dll, xrefs: 006B5620

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$File$NamedPipeWrite$HandleState$ConnectCurrentProcessReadSleeplstrlen
String ID: /Ej$Failed to read ACK from pipe.$Failed to reset pipe to blocking.$Failed to set pipe to non-blocking.$Failed to wait for child to connect to pipe.$Failed to write our process id to pipe.$Failed to write secret length to pipe.$Failed to write secret to pipe.$comres.dll$crypt32.dll$feclient.dll$pipe.cpp$wininet.dll
API String ID: 2944378912-3283162290
Opcode ID: ee67ef81db95fcb110d595bdd839145be8277b82dc393c5557d960f7b2059fa3
Instruction ID: dbaba6e1e98ecc4bfee11028717d15ae3977785788b3c6a05773cfd562e78ede
Opcode Fuzzy Hash: ee67ef81db95fcb110d595bdd839145be8277b82dc393c5557d960f7b2059fa3
Instruction Fuzzy Hash: 7F71BDB7E41735ABD72096A58C45BEF669AAF04B10F120165FE11FB290EB64CD8087E4

Function 006CD43E Relevance: 49.3, APIs: 12, Strings: 16, Instructions: 290synchronizationprocessCOMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 006CD4B3
StringFromGUID2.OLE32(?,?,00000027), ref: 006CD4DC
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?,?,?,?,?), ref: 006CD5C5
GetLastError.KERNEL32(?,?,?,?), ref: 006CD5CF
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00000064,?,?,?,?), ref: 006CD668
WaitForSingleObject.KERNEL32(006EB500,000000FF,?,?,?,?), ref: 006CD673
ReleaseMutex.KERNEL32(006EB500,?,?,?,?), ref: 006CD69D
GetExitCodeProcess.KERNEL32(?,?), ref: 006CD6BE
GetLastError.KERNEL32(?,?,?,?), ref: 006CD6CC
GetLastError.KERNEL32(?,?,?,?), ref: 006CD704

Part of subcall function 006CD33E: WaitForSingleObject.KERNEL32(?,000000FF,759230B0,00000000,?,?,?,?,006CD642,?), ref: 006CD357
Part of subcall function 006CD33E: ReleaseMutex.KERNEL32(?,?,?,?,006CD642,?), ref: 006CD375
Part of subcall function 006CD33E: WaitForSingleObject.KERNEL32(?,000000FF), ref: 006CD3B6
Part of subcall function 006CD33E: ReleaseMutex.KERNEL32(?), ref: 006CD3CD
Part of subcall function 006CD33E: SetEvent.KERNEL32(?), ref: 006CD3D6

CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 006CD7B9
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 006CD7D1

Strings

NetFxEvent.%ls, xrefs: 006CD52B
Failed to allocate event name., xrefs: 006CD53F
Failed to process netfx chainer message., xrefs: 006CD648
%ls /pipe %ls, xrefs: 006CD57F
Failed to allocate section name., xrefs: 006CD51D
Failed to convert netfx chainer guid into string., xrefs: 006CD4FB
Failed to wait for netfx chainer process to complete, xrefs: 006CD732
NetFxChainer.cpp, xrefs: 006CD4F1, 006CD5F3, 006CD6F0, 006CD728
Failed to allocate netfx chainer arguments., xrefs: 006CD593
Failed to get netfx return code., xrefs: 006CD6FA
Failed to create netfx chainer guid., xrefs: 006CD4C0
NetFxSection.%ls, xrefs: 006CD509
D$l, xrefs: 006CD46D
Failed to CreateProcess on path: %ls, xrefs: 006CD5FE
Failed to create netfx chainer., xrefs: 006CD55E
D, xrefs: 006CD5AA

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Wait$ErrorLastMutexObjectReleaseSingle$CloseCreateHandleProcess$CodeEventExitFromMultipleObjectsStringUuid
String ID: %ls /pipe %ls$D$D$l$Failed to CreateProcess on path: %ls$Failed to allocate event name.$Failed to allocate netfx chainer arguments.$Failed to allocate section name.$Failed to convert netfx chainer guid into string.$Failed to create netfx chainer guid.$Failed to create netfx chainer.$Failed to get netfx return code.$Failed to process netfx chainer message.$Failed to wait for netfx chainer process to complete$NetFxChainer.cpp$NetFxEvent.%ls$NetFxSection.%ls
API String ID: 1533322865-1114817301
Opcode ID: fd440ac0049540e5039bddf697cfff6ffe081bd9120c8434190c80b2483bfd0c
Instruction ID: 9580162c4aaebf74d9ec25d0a78972391ab665f3d6d50d48d428c1ab7a601a68
Opcode Fuzzy Hash: fd440ac0049540e5039bddf697cfff6ffe081bd9120c8434190c80b2483bfd0c
Instruction Fuzzy Hash: 11A17172D40328ABDF619BA4CC45FAEB7B6EB04720F114169EA08EB251D7349D448F95

Function 006E744A Relevance: 47.6, APIs: 13, Strings: 14, Instructions: 340COMMON

Download Yara Rule

APIs

Part of subcall function 006A394F: GetProcessHeap.KERNEL32(?,000001C7,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3960
Part of subcall function 006A394F: RtlAllocateHeap.NTDLL(00000000,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3967

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,generator,000000FF,?,?,?), ref: 006E755D
SysFreeString.OLEAUT32(00000000), ref: 006E7726
SysFreeString.OLEAUT32(00000000), ref: 006E77C3

Strings

(, xrefs: 006E7701
author, xrefs: 006E749B, 006E762C
atomutil.cpp, xrefs: 006E7477, 006E77AD
link, xrefs: 006E74F2, 006E76D4
icon, xrefs: 006E7574
@, xrefs: 006E76CC
category, xrefs: 006E74B8, 006E7665
entry, xrefs: 006E74D5, 006E769E
title, xrefs: 006E75E8
subtitle, xrefs: 006E75CC
logo, xrefs: 006E75B0
`)u, xrefs: 006E7726, 006E77C3
updated, xrefs: 006E7604
generator, xrefs: 006E7550

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: String$FreeHeap$AllocateCompareProcess
String ID: ($@$`)u$atomutil.cpp$author$category$entry$generator$icon$link$logo$subtitle$title$updated
API String ID: 1555028553-3149586977
Opcode ID: c7712690eceb7bda82d30a630e3f2904d6c6e27d54f4fba52c1fdfb106a13273
Instruction ID: d1f311d4c232c9b34093a9da5a5a64ee93446a8e3b6c526cd41481fc6db0c490
Opcode Fuzzy Hash: c7712690eceb7bda82d30a630e3f2904d6c6e27d54f4fba52c1fdfb106a13273
Instruction Fuzzy Hash: DBB18E7190A366FBDF119BA5CC51EAE77B6AB04720F200354F521AB2D1DB70EE10DB90

Function 006E710D Relevance: 47.5, APIs: 11, Strings: 16, Instructions: 298COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,00703E78,000000FF,?,?,?), ref: 006E71D4
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,summary,000000FF), ref: 006E71F9
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 006E7219
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,published,000000FF), ref: 006E7235
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,updated,000000FF), ref: 006E725D
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,author,000000FF), ref: 006E7279
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,category,000000FF), ref: 006E72B2
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,content,000000FF), ref: 006E72EB

Part of subcall function 006E6D50: SysFreeString.OLEAUT32(00000000), ref: 006E6E89
Part of subcall function 006E6D50: SysFreeString.OLEAUT32(00000000), ref: 006E6EC8

SysFreeString.OLEAUT32(00000000), ref: 006E736F
SysFreeString.OLEAUT32(00000000), ref: 006E741F

Strings

author, xrefs: 006E7138, 006E726B
atomutil.cpp, xrefs: 006E740C
summary, xrefs: 006E71EB
link, xrefs: 006E7172, 006E731D
crypt32.dll, xrefs: 006E7242
category, xrefs: 006E7155, 006E72A4
(, xrefs: 006E734A
cabinet.dll, xrefs: 006E7150
title, xrefs: 006E720B
content, xrefs: 006E72DD
feclient.dll, xrefs: 006E7206
updated, xrefs: 006E724F
`)u, xrefs: 006E736F, 006E741F
msi.dll, xrefs: 006E7137
published, xrefs: 006E7227
version.dll, xrefs: 006E7133

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: String$Compare$Free
String ID: ($`)u$atomutil.cpp$author$cabinet.dll$category$content$crypt32.dll$feclient.dll$link$msi.dll$published$summary$title$updated$version.dll
API String ID: 318886736-4221998045
Opcode ID: 9247167389869dc3492e3f8c83fd3254eb8e71d3c60566cb0ff5124cca1e018b
Instruction ID: 3e86d60122c9c3aa1027a981bf1deccc4b38be777d77b4d6d4a8d6f5f33d51ce
Opcode Fuzzy Hash: 9247167389869dc3492e3f8c83fd3254eb8e71d3c60566cb0ff5124cca1e018b
Instruction Fuzzy Hash: B6A1A07190A356FBDB619B95CC41FAE7BA6AB04730F204355F920A72D1DB30EE10DB91

Function 006AA416 Relevance: 44.0, APIs: 8, Strings: 17, Instructions: 299registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006AA45A
_MREFOpen@16.MSPDB140-MSVCRT ref: 006AA480
RegCloseKey.ADVAPI32(00000000,?,00000000,?,?,?,?,?), ref: 006AA768

Strings

Failed to query registry key value size., xrefs: 006AA554
Failed to change value type., xrefs: 006AA70F
Registry key not found. Key = '%ls', xrefs: 006AA4B4
Failed to clear variable., xrefs: 006AA4D8
Failed to allocate memory registry value., xrefs: 006AA587
search.cpp, xrefs: 006AA54A, 006AA57D, 006AA5D0, 006AA6D3
Failed to set variable., xrefs: 006AA72B
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 006AA51C
RegistrySearchValue failed: ID '%ls', HRESULT 0x%x, xrefs: 006AA740
Failed to open registry key., xrefs: 006AA4ED
Failed to get expand environment string., xrefs: 006AA6DD
Failed to format value string., xrefs: 006AA48B
Unsupported registry key value type. Type = '%u', xrefs: 006AA608
Failed to format key string., xrefs: 006AA465
Failed to query registry key value., xrefs: 006AA5DA
Failed to allocate string buffer., xrefs: 006AA667
Failed to read registry value., xrefs: 006AA6F6

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Open@16$Close
String ID: Failed to allocate memory registry value.$Failed to allocate string buffer.$Failed to change value type.$Failed to clear variable.$Failed to format key string.$Failed to format value string.$Failed to get expand environment string.$Failed to open registry key.$Failed to query registry key value size.$Failed to query registry key value.$Failed to read registry value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchValue failed: ID '%ls', HRESULT 0x%x$Unsupported registry key value type. Type = '%u'$search.cpp
API String ID: 2348241696-3124384294
Opcode ID: f5147f6d1a8c228386812b7f3c220aad19abd057627f5e339088fb23f6a87408
Instruction ID: a6e87245103293bccabd799071373caf3875777ebc2e1edf95fc5d407e68815f
Opcode Fuzzy Hash: f5147f6d1a8c228386812b7f3c220aad19abd057627f5e339088fb23f6a87408
Instruction Fuzzy Hash: AFA1C572D41225BBCF21AAE4CC45AEFBA77AF06710F158116F900BA250D771DE00DEA6

Function 006A5770 Relevance: 42.5, APIs: 5, Strings: 19, Instructions: 479stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000100,00000100,00000100,00000000,00000000,00000000,?,006AA8B4,00000100,000002C0,000002C0,00000100), ref: 006A5795
lstrlenW.KERNEL32(000002C0,?,006AA8B4,00000100,000002C0,000002C0,00000100), ref: 006A579F
_wcschr.LIBVCRUNTIME ref: 006A59A7
LeaveCriticalSection.KERNEL32(00000100,00000000,000002C0,000002C0,00000000,000002C0,00000001,?,006AA8B4,00000100,000002C0,000002C0,00000100), ref: 006A5C4A

Strings

Failed to allocate variable array., xrefs: 006A5A85
Failed to get formatted length., xrefs: 006A5B92
Failed to get variable name., xrefs: 006A5A8C
variable.cpp, xrefs: 006A59FE, 006A5A1F, 006A5A78, 006A5ACA, 006A5B56, 006A5B88, 006A5C04
Failed to append string., xrefs: 006A581B
Failed to set variable value., xrefs: 006A5A61
Failed to allocate buffer for format string., xrefs: 006A57BD
Failed to copy string., xrefs: 006A5C2E
Failed to reallocate variable array., xrefs: 006A5A2C
Failed to set record format string., xrefs: 006A5AD4
Failed to format placeholder string., xrefs: 006A5A57
*****, xrefs: 006A5913
Failed to determine variable visibility: '%ls'., xrefs: 006A5A3A
[%d], xrefs: 006A5962
Failed to append placeholder., xrefs: 006A5A4D
Failed to set record string., xrefs: 006A5B60
Failed to format record., xrefs: 006A5C0E
Failed to allocate record., xrefs: 006A5A0B
Failed to allocate string., xrefs: 006A5BC1

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalSection$EnterLeave_wcschrlstrlen
String ID: *****$Failed to allocate buffer for format string.$Failed to allocate record.$Failed to allocate string.$Failed to allocate variable array.$Failed to append placeholder.$Failed to append string.$Failed to copy string.$Failed to determine variable visibility: '%ls'.$Failed to format placeholder string.$Failed to format record.$Failed to get formatted length.$Failed to get variable name.$Failed to reallocate variable array.$Failed to set record format string.$Failed to set record string.$Failed to set variable value.$[%d]$variable.cpp
API String ID: 1026845265-2050445661
Opcode ID: 867347738dc208cad02cf6f76809658b1750f8ab8c5e75abc62249a4782357ed
Instruction ID: 1c1e63783d2bd380ef721bb538e34b2005f4e90a4637cd78d24d0149f6b48176
Opcode Fuzzy Hash: 867347738dc208cad02cf6f76809658b1750f8ab8c5e75abc62249a4782357ed
Instruction Fuzzy Hash: 08F19472D01765EECF10EFA58841EAF7BA7EB06B20F154169FD16AB240D7349E018FA4

Function 006CCE81 Relevance: 40.5, APIs: 12, Strings: 11, Instructions: 240synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 006A394F: GetProcessHeap.KERNEL32(?,000001C7,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3960
Part of subcall function 006A394F: RtlAllocateHeap.NTDLL(00000000,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3967

CreateEventW.KERNEL32(00000000,00000000,00000000,?,00000000,00000018,00000001,?,00000000,?,?,006CD558,?,?,?), ref: 006CCEC7
GetLastError.KERNEL32(?,?,006CD558,?,?,?), ref: 006CCED4
ReleaseMutex.KERNEL32(?), ref: 006CD13C

Strings

failed to allocate memory for event name, xrefs: 006CCF1A
failed to allocate memory for mutex name, xrefs: 006CCF89
failed to copy event name to shared memory structure., xrefs: 006CD09A
Failed to MapViewOfFile for %ls., xrefs: 006CD070
Failed to create mutex: %ls, xrefs: 006CCFD6
Failed to memory map cabinet file: %ls, xrefs: 006CD028
Failed to create event: %ls, xrefs: 006CCF67
%ls_mutex, xrefs: 006CCF75
NetFxChainer.cpp, xrefs: 006CCEA3, 006CCEF5, 006CCF5A, 006CCFC9, 006CD01B, 006CD063
%ls_send, xrefs: 006CCF06
Failed to allocate memory for NetFxChainer struct., xrefs: 006CCEAD

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Heap$AllocateCreateErrorEventLastMutexProcessRelease
String ID: %ls_mutex$%ls_send$Failed to MapViewOfFile for %ls.$Failed to allocate memory for NetFxChainer struct.$Failed to create event: %ls$Failed to create mutex: %ls$Failed to memory map cabinet file: %ls$NetFxChainer.cpp$failed to allocate memory for event name$failed to allocate memory for mutex name$failed to copy event name to shared memory structure.
API String ID: 3944734951-2991465304
Opcode ID: 0e8700be8a26673d014a7ee10939da60fee9c0f8d58c6da5cb28f09e63734d90
Instruction ID: 081dab8346cc21eac510bb70f1ea01247feeda93b311df5602b79604dc49a012
Opcode Fuzzy Hash: 0e8700be8a26673d014a7ee10939da60fee9c0f8d58c6da5cb28f09e63734d90
Instruction Fuzzy Hash: 258128B6A41722FBC7215B648C49FAA7AA6FF05730F11426DFD18AB381D774DD008AE4

Function 006AEA42 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 231COMMON

Download Yara Rule

APIs

Part of subcall function 006E32F3: VariantInit.OLEAUT32(?), ref: 006E3309
Part of subcall function 006E32F3: SysAllocString.OLEAUT32(?), ref: 006E3325
Part of subcall function 006E32F3: VariantClear.OLEAUT32(?), ref: 006E33AC
Part of subcall function 006E32F3: SysFreeString.OLEAUT32(00000000), ref: 006E33B7

CompareStringW.KERNEL32(0000007F,00000000,000000FF,000000FF,Detect,000000FF,?,006ECA9C,?,?,Action,?,?,?,00000000,?), ref: 006AEB13
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,Upgrade,000000FF), ref: 006AEB5D

Strings

Addon, xrefs: 006AEB9A
RelatedBundle, xrefs: 006AEA50
Failed to resize Addon code array in registration, xrefs: 006AEC3C
Failed to resize Upgrade code array in registration, xrefs: 006AEC35
Action, xrefs: 006AEAD0
Invalid value for @Action: %ls, xrefs: 006AEC52
Upgrade, xrefs: 006AEB50
comres.dll, xrefs: 006AEB26
Failed to get RelatedBundle nodes, xrefs: 006AEA72
Failed to get next RelatedBundle element., xrefs: 006AEC70
Detect, xrefs: 006AEB04
Failed to get @Id., xrefs: 006AEC62
cabinet.dll, xrefs: 006AEBBA
Failed to resize Detect code array in registration, xrefs: 006AEC2E
Failed to get RelatedBundle element count., xrefs: 006AEA97
Patch, xrefs: 006AEBDD
Failed to get @Action., xrefs: 006AEC69
Failed to resize Patch code array in registration, xrefs: 006AEC43
version.dll, xrefs: 006AEB70

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: String$CompareVariant$AllocClearFreeInit
String ID: Action$Addon$Detect$Failed to get @Action.$Failed to get @Id.$Failed to get RelatedBundle element count.$Failed to get RelatedBundle nodes$Failed to get next RelatedBundle element.$Failed to resize Addon code array in registration$Failed to resize Detect code array in registration$Failed to resize Patch code array in registration$Failed to resize Upgrade code array in registration$Invalid value for @Action: %ls$Patch$RelatedBundle$Upgrade$cabinet.dll$comres.dll$version.dll
API String ID: 702752599-259800149
Opcode ID: c5fdce25a420fbee523c036f85e8f12bb6fa7823f034eac712588e29eb437fd1
Instruction ID: 467369c93cf0d7ed8b9d1697c46c8abad53ecc8b07bbfa8539ab877d991a477b
Opcode Fuzzy Hash: c5fdce25a420fbee523c036f85e8f12bb6fa7823f034eac712588e29eb437fd1
Instruction Fuzzy Hash: BA71833190561AFBCB10EB54C945EAEB7B6FF06760F214258F9226B2C1D772AE11CF90

Function 006B46DC Relevance: 36.9, APIs: 10, Strings: 11, Instructions: 185fileCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,8000FFFF,feclient.dll,?,006B4BF5,006EB4E8,?,feclient.dll,00000000,?,?), ref: 006B46F3
ReadFile.KERNEL32(feclient.dll,feclient.dll,00000004,?,00000000,?,006B4BF5,006EB4E8,?,feclient.dll,00000000,?,?), ref: 006B4714
GetLastError.KERNEL32(?,006B4BF5,006EB4E8,?,feclient.dll,00000000,?,?), ref: 006B471A
ReadFile.KERNEL32(feclient.dll,00000000,006EB518,?,00000000,00000000,006EB519,?,006B4BF5,006EB4E8,?,feclient.dll,00000000,?,?), ref: 006B47A8
GetLastError.KERNEL32(?,006B4BF5,006EB4E8,?,feclient.dll,00000000,?,?), ref: 006B47AE

Strings

Failed to read verification secret from parent pipe., xrefs: 006B47DC
Failed to allocate buffer for verification secret., xrefs: 006B4791
Verification secret from parent does not match., xrefs: 006B4816
Failed to read size of verification secret from parent pipe., xrefs: 006B4748
pipe.cpp, xrefs: 006B473E, 006B4769, 006B47D2, 006B480A, 006B4857, 006B48B1, 006B48F1
Verification process id from parent does not match., xrefs: 006B48FD
Failed to read verification process id from parent pipe., xrefs: 006B4861
feclient.dll, xrefs: 006B46E2, 006B4712, 006B4713, 006B47A7, 006B482C, 006B4882
msasn1.dll, xrefs: 006B482B
Verification secret from parent is too big., xrefs: 006B4775
Failed to inform parent process that child is running., xrefs: 006B48BB

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFileLastRead$CurrentProcess
String ID: Failed to allocate buffer for verification secret.$Failed to inform parent process that child is running.$Failed to read size of verification secret from parent pipe.$Failed to read verification process id from parent pipe.$Failed to read verification secret from parent pipe.$Verification process id from parent does not match.$Verification secret from parent does not match.$Verification secret from parent is too big.$feclient.dll$msasn1.dll$pipe.cpp
API String ID: 1233551569-452622383
Opcode ID: 2548553c0bdf7c8e8ee6bf3744c4979217dcd44efd90df67eea86fa6a71487df
Instruction ID: b8f246b14163787c0558738fcc226b245247dffdd66339503e5be5ebac352476
Opcode Fuzzy Hash: 2548553c0bdf7c8e8ee6bf3744c4979217dcd44efd90df67eea86fa6a71487df
Instruction Fuzzy Hash: 0351C676E40269B7DB219AD54C86FFF666AAB01B20F120169FE10BB281DF74DD4087E4

Function 006C27FC Relevance: 36.9, APIs: 3, Strings: 18, Instructions: 145COMMON

Download Yara Rule

Strings

UninstallArguments, xrefs: 006C2858
Failed to get @Repairable., xrefs: 006C28B5
burn, xrefs: 006C28E0
InstallArguments, xrefs: 006C2836
Failed to get @UninstallArguments., xrefs: 006C2869
none, xrefs: 006C2936
Protocol, xrefs: 006C28C3
Failed to parse exit codes., xrefs: 006C290C
netfx4, xrefs: 006C2915
Failed to get @RepairArguments., xrefs: 006C288B
Failed to get @Protocol., xrefs: 006C2974
Invalid protocol type: %ls, xrefs: 006C295C
Failed to get @DetectCondition., xrefs: 006C2825
Repairable, xrefs: 006C289C
DetectCondition, xrefs: 006C2814
Failed to get @InstallArguments., xrefs: 006C2847
RepairArguments, xrefs: 006C287A
Failed to parse command lines., xrefs: 006C2988

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: DetectCondition$Failed to get @DetectCondition.$Failed to get @InstallArguments.$Failed to get @Protocol.$Failed to get @RepairArguments.$Failed to get @Repairable.$Failed to get @UninstallArguments.$Failed to parse command lines.$Failed to parse exit codes.$InstallArguments$Invalid protocol type: %ls$Protocol$RepairArguments$Repairable$UninstallArguments$burn$netfx4$none
API String ID: 760788290-1911311241
Opcode ID: 65d9166c9cb19982b0d3cc2eab7b41a5fc8a30785054cae69c52ee25371727db
Instruction ID: c0d6dfc7b790b7d822197901316cea56877f83285d7dcbabad0d0e757b1cb8f1
Opcode Fuzzy Hash: 65d9166c9cb19982b0d3cc2eab7b41a5fc8a30785054cae69c52ee25371727db
Instruction Fuzzy Hash: 77412971E86767B6CA2155A58C16F7AB25BEB11B30F210329FE24BB3C1CB749A0482D5

Function 006A8F72 Relevance: 35.4, APIs: 8, Strings: 12, Instructions: 430COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,56006EDB,00000001,?,006A9946,?,00000000,00000000,?,?,006A992E,?,?,00000000,?), ref: 006A8FB2

Strings

Failed to parse condition "%ls". Unexpected character at position %d., xrefs: 006A9162
Failed to parse condition "%ls". Constant too big, at position %d., xrefs: 006A9380
-, xrefs: 006A9118
NOT, xrefs: 006A92DB
Failed to parse condition "%ls". Invalid version format, at position %d., xrefs: 006A9242
Failed to parse condition "%ls". Unterminated literal at position %d., xrefs: 006A9098
condition.cpp, xrefs: 006A9084, 006A914E, 006A91CA, 006A922E, 006A936C, 006A93B0, 006A93F4
Failed to parse condition "%ls". Unexpected '~' operator at position %d., xrefs: 006A9408
Failed to set symbol value., xrefs: 006A9060
AND, xrefs: 006A92BC
Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d., xrefs: 006A93C4
Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d., xrefs: 006A91DE

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: StringType
String ID: -$AND$Failed to parse condition "%ls". Constant too big, at position %d.$Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d.$Failed to parse condition "%ls". Invalid version format, at position %d.$Failed to parse condition "%ls". Unexpected '~' operator at position %d.$Failed to parse condition "%ls". Unexpected character at position %d.$Failed to parse condition "%ls". Unterminated literal at position %d.$Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d.$Failed to set symbol value.$NOT$condition.cpp
API String ID: 4177115715-3594736606
Opcode ID: cb8ffc5c994f661ae32c1e4e01520a5e69ffa798ee12f29a32e1024f040a8941
Instruction ID: 16dce2edb591bc600bb70b71638248724be8188cffb3272c174c34d026d8e135
Opcode Fuzzy Hash: cb8ffc5c994f661ae32c1e4e01520a5e69ffa798ee12f29a32e1024f040a8941
Instruction Fuzzy Hash: 04F1BF71500305FFDB24AF58C889BEA7BE6FB0A704F204549F9159A685C3B5DE92CFA0

Function 006B6BCA Relevance: 35.4, APIs: 6, Strings: 14, Instructions: 351synchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 006AD4A8: EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,006B7040,000000B8,00000000,?,00000000,75A8B390), ref: 006AD4B7
Part of subcall function 006AD4A8: InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 006AD4C6
Part of subcall function 006AD4A8: LeaveCriticalSection.KERNEL32(000000D0,?,006B7040,000000B8,00000000,?,00000000,75A8B390), ref: 006AD4DB

CreateThread.KERNEL32(00000000,00000000,006B57BD,?,00000000,00000000), ref: 006B6E34
GetLastError.KERNEL32(?,?,?,?,?,?,?,006A4522,?,006EB500,?,006A4846,?,?), ref: 006B6E43
CloseHandle.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,006A4522,?,006EB500,?,006A4846,?,?), ref: 006B6EA0
ReleaseMutex.KERNEL32(00000000,?,00000000,?,00000000,00000001,00000000), ref: 006B6F92
CloseHandle.KERNEL32(00000000), ref: 006B6F9B
CloseHandle.KERNEL32(crypt32.dll,?,00000000,?,00000000,00000001,00000000), ref: 006B6FB5

Part of subcall function 006CBD05: SetThreadExecutionState.KERNEL32(80000001), ref: 006CBD0A

Strings

FHj, xrefs: 006B6EC1, 006B6E1F, 006B6EC4
Another per-user setup is already executing., xrefs: 006B6CD8
Failed to register bundle., xrefs: 006B6DEE
Engine cannot start apply because it is busy with another action., xrefs: 006B6C28
crypt32.dll, xrefs: 006B6ECD, 006B6EE7, 006B6FB4
Another per-machine setup is already executing., xrefs: 006B6DC8
Failed to set initial apply variables., xrefs: 006B6D02
Failed to cache engine to working directory., xrefs: 006B6D71
Failed while caching, aborting execution., xrefs: 006B6E98
"Ej, xrefs: 006B6EC9, 006B6E14, 006B6ECC
UX aborted apply begin., xrefs: 006B6C94
Failed to elevate., xrefs: 006B6D94
Failed to create cache thread., xrefs: 006B6E71
core.cpp, xrefs: 006B6C8A, 006B6E67

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseHandle$CriticalSectionThread$CompareCreateEnterErrorExchangeExecutionInterlockedLastLeaveMutexReleaseState
String ID: "Ej$Another per-machine setup is already executing.$Another per-user setup is already executing.$Engine cannot start apply because it is busy with another action.$FHj$Failed to cache engine to working directory.$Failed to create cache thread.$Failed to elevate.$Failed to register bundle.$Failed to set initial apply variables.$Failed while caching, aborting execution.$UX aborted apply begin.$core.cpp$crypt32.dll
API String ID: 2169948125-1180377187
Opcode ID: 24aeb0c6ae803019c53c5e717cbf693e4ee2b3a4d8bbae5a9b832c42668e8e92
Instruction ID: 5e58fc1af321dec3561db940b5a335a0700078761e01a2939f293d6d302caad2
Opcode Fuzzy Hash: 24aeb0c6ae803019c53c5e717cbf693e4ee2b3a4d8bbae5a9b832c42668e8e92
Instruction Fuzzy Hash: B0C1B0B2901215ABDF119F54C885BFE3AABEF04714F04417EFE09AE241DB789D81CBA5

Function 006C1BB1 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 006A394F: GetProcessHeap.KERNEL32(?,000001C7,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3960
Part of subcall function 006A394F: RtlAllocateHeap.NTDLL(00000000,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3967

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,success,000000FF,?,Type,00000000,?,?,00000000,?,00000001,?), ref: 006C1CB8
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,error,000000FF), ref: 006C1CD6

Strings

Failed to get @Type., xrefs: 006C1DB7
ExitCode, xrefs: 006C1BBF
Failed to get next node., xrefs: 006C1DBE
Type, xrefs: 006C1C90
error, xrefs: 006C1CC9
Failed to allocate memory for exit code structs., xrefs: 006C1C43
success, xrefs: 006C1CA9
forceReboot, xrefs: 006C1D03
exeengine.cpp, xrefs: 006C1C39
Failed to get exit code node count., xrefs: 006C1C03
Code, xrefs: 006C1D25
scheduleReboot, xrefs: 006C1CE5
Failed to select exit code nodes., xrefs: 006C1BDE
Failed to get @Code., xrefs: 006C1D98
Invalid exit code type: %ls, xrefs: 006C1DA7
Failed to parse @Code value: %ls, xrefs: 006C1D91

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CompareHeapString$AllocateProcess
String ID: Code$ExitCode$Failed to allocate memory for exit code structs.$Failed to get @Code.$Failed to get @Type.$Failed to get exit code node count.$Failed to get next node.$Failed to parse @Code value: %ls$Failed to select exit code nodes.$Invalid exit code type: %ls$Type$error$exeengine.cpp$forceReboot$scheduleReboot$success
API String ID: 2664528157-1714101571
Opcode ID: 6545ee6ada9f1b7e168ea0af16eca45fb2112a8cf175f9823791f49e5c717f44
Instruction ID: ea2b48a04a2a64436b6d6cb2a9a264b7de0778d7a8dd2bb8e90afd680574c3c8
Opcode Fuzzy Hash: 6545ee6ada9f1b7e168ea0af16eca45fb2112a8cf175f9823791f49e5c717f44
Instruction Fuzzy Hash: F861B63194521ABBCB109B95CC55FBE7BA7EF43720F214259F521AF292DB70AE01CB90

Function 006E77F7 Relevance: 33.5, APIs: 8, Strings: 11, Instructions: 206COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,rel,000000FF,?,?,?,00000000), ref: 006E7857
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,href,000000FF), ref: 006E787C
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,length,000000FF), ref: 006E789C
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 006E78CF
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,type,000000FF), ref: 006E78EB
SysFreeString.OLEAUT32(00000000), ref: 006E7916
SysFreeString.OLEAUT32(00000000), ref: 006E798D
SysFreeString.OLEAUT32(00000000), ref: 006E79D9

Strings

title, xrefs: 006E78C1
href, xrefs: 006E786E
rel, xrefs: 006E784A
feclient.dll, xrefs: 006E7889
type, xrefs: 006E78DD
`)u, xrefs: 006E7916, 006E798D, 006E79D9
msasn1.dll, xrefs: 006E79C7
comres.dll, xrefs: 006E78A6
msi.dll, xrefs: 006E7975
length, xrefs: 006E788E
version.dll, xrefs: 006E78FA

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: String$Compare$Free
String ID: `)u$comres.dll$feclient.dll$href$length$msasn1.dll$msi.dll$rel$title$type$version.dll
API String ID: 318886736-1740249892
Opcode ID: 48589e0ee4beb1abd0a42abb288fb2e7a362705c4f17df34a19ec0cc8ba5d64e
Instruction ID: 0be3661528aaf8e6dcccad6a35bad0b7508ce6b1863cb6ced81c6257e7fddbaa
Opcode Fuzzy Hash: 48589e0ee4beb1abd0a42abb288fb2e7a362705c4f17df34a19ec0cc8ba5d64e
Instruction Fuzzy Hash: 4A613F7190A359FBDF15DB95CC45FAEB7BAAF04320F2002A5E521A72D1D731AE10DB90

Function 006E8134 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 309COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,00000410), ref: 006E8161
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF), ref: 006E817C
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,upgrade,000000FF), ref: 006E821F
CompareStringW.KERNEL32(0000007F,00000000,00700079,000000FF,version,000000FF,000002D8,006EB518,00000000), ref: 006E825E
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exclusive,000000FF), ref: 006E82B1
CompareStringW.KERNEL32(0000007F,00000000,006EB518,000000FF,true,000000FF), ref: 006E82CF
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 006E8307
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,enclosure,000000FF), ref: 006E844B

Strings

version, xrefs: 006E8250, 006E82F9
apuputil.cpp, xrefs: 006E836E
http://appsyndication.org/2006/appsyn, xrefs: 006E8154
upgrade, xrefs: 006E8211
type, xrefs: 006E81A7
application, xrefs: 006E816E
enclosure, xrefs: 006E8439
true, xrefs: 006E82C1
exclusive, xrefs: 006E82A3

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CompareString
String ID: application$apuputil.cpp$enclosure$exclusive$http://appsyndication.org/2006/appsyn$true$type$upgrade$version
API String ID: 1825529933-3037633208
Opcode ID: 73b66a66988047ab0c8d12bbb3e225cc247be3e0dfb5737118538c3af39842c5
Instruction ID: 1157fc06026146a115894b1fe0bfc8918e3c613fd9bf3164a5f7f0509757777e
Opcode Fuzzy Hash: 73b66a66988047ab0c8d12bbb3e225cc247be3e0dfb5737118538c3af39842c5
Instruction Fuzzy Hash: E1B19C31605782EFCB619F55CC85F9A77E7AB44730F214668FA29AB2D1EB70E901CB00

Function 006BE3C8 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 146registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006BE2AF: LoadBitmapW.USER32(?,00000001), ref: 006BE2E5
Part of subcall function 006BE2AF: GetLastError.KERNEL32 ref: 006BE2F1

LoadCursorW.USER32(00000000,00007F00), ref: 006BE429
RegisterClassW.USER32(?), ref: 006BE43D
GetLastError.KERNEL32 ref: 006BE448
UnregisterClassW.USER32(WixBurnSplashScreen,?), ref: 006BE54D
DeleteObject.GDI32(00000000), ref: 006BE55C

Strings

Failed to create window., xrefs: 006BE4DF
Failed to register window., xrefs: 006BE476
Failed to load splash screen., xrefs: 006BE401
Unexpected return value from message pump., xrefs: 006BE537
splashscreen.cpp, xrefs: 006BE46C, 006BE4D5
WixBurnSplashScreen, xrefs: 006BE436, 006BE548

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ClassErrorLastLoad$BitmapCursorDeleteObjectRegisterUnregister
String ID: Failed to create window.$Failed to load splash screen.$Failed to register window.$Unexpected return value from message pump.$WixBurnSplashScreen$splashscreen.cpp
API String ID: 164797020-2188509422
Opcode ID: 5fe6e116ef631e85e658148f58993f57675e3b6dc84d28db76295b968d8e30d2
Instruction ID: 46b1fcae455c6c56d7b56028618d876de28f059f420bc44d9ed54e1c1738def2
Opcode Fuzzy Hash: 5fe6e116ef631e85e658148f58993f57675e3b6dc84d28db76295b968d8e30d2
Instruction Fuzzy Hash: BE4196B3900669BFDB219BD4DD49AEEBBBBFF04710F110125FA01A6250E7769D408BA1

Function 006C9DE1 Relevance: 30.0, APIs: 4, Strings: 13, Instructions: 233threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000001,?,00000000,000000FF,00000001,00000000,00000000,?,006CBC85,00000001), ref: 006C9E46
GetLastError.KERNEL32(?,006CBC85,00000001), ref: 006C9FB6
GetExitCodeThread.KERNEL32(00000001,00000000,?,006CBC85,00000001), ref: 006C9FF6
GetLastError.KERNEL32(?,006CBC85,00000001), ref: 006CA000

Strings

Failed to load compatible package on per-machine package., xrefs: 006C9F5C
Failed to get cache thread exit code., xrefs: 006CA031
apply.cpp, xrefs: 006C9FDD, 006CA027
Failed to execute MSI package., xrefs: 006C9EA6
Failed to execute MSU package., xrefs: 006C9EFB
Failed to execute package provider registration action., xrefs: 006C9F17
Failed to execute MSP package., xrefs: 006C9ECB
Failed to execute compatible package action., xrefs: 006C9F73
Invalid execute action., xrefs: 006CA056
Failed to execute dependency action., xrefs: 006C9F36
Failed to execute EXE package., xrefs: 006C9E7D
Cache thread exited unexpectedly., xrefs: 006CA047
Failed to wait for cache check-point., xrefs: 006C9FE7

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$CodeExitMultipleObjectsThreadWait
String ID: Cache thread exited unexpectedly.$Failed to execute EXE package.$Failed to execute MSI package.$Failed to execute MSP package.$Failed to execute MSU package.$Failed to execute compatible package action.$Failed to execute dependency action.$Failed to execute package provider registration action.$Failed to get cache thread exit code.$Failed to load compatible package on per-machine package.$Failed to wait for cache check-point.$Invalid execute action.$apply.cpp
API String ID: 3703294532-2662572847
Opcode ID: 83815a996166c09f71153dc596f7e6e8ba4ff87cf930eb4ce3c96c10e96bf2fa
Instruction ID: c109f4fa11060420114b2a4a931c7dd34c1f94da77b34c5432c75d07d6d868ff
Opcode Fuzzy Hash: 83815a996166c09f71153dc596f7e6e8ba4ff87cf930eb4ce3c96c10e96bf2fa
Instruction Fuzzy Hash: 5D717D71A0126AEFDB14DFA4C945FBE7BBAEF48B54F11416EF900E7240D2309E019BA5

Function 006AF210 Relevance: 29.9, APIs: 3, Strings: 14, Instructions: 183registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006E3AF1: GetVersionExW.KERNEL32(?,?,00000000,?), ref: 006E3B3E

RegCloseKey.ADVAPI32(00000000,?,006F0D10,00020006,00000000,?,00000000,00000000,00000000,?,00000000,00000001,00000000,00000000), ref: 006AF440

Part of subcall function 006E14A6: RegSetValueExW.ADVAPI32(?,00000005,00000000,00000004,?,00000004,00000001,?,006AF28D,006F0D10,Resume,00000005,?,00000000,00000000,00000000), ref: 006E14BB

Strings

Failed to write run key value., xrefs: 006AF33B
BundleResumeCommandLine, xrefs: 006AF348, 006AF3DB
Failed to create run key., xrefs: 006AF31D
Failed to format resume command line for RunOnce., xrefs: 006AF2F9
Installed, xrefs: 006AF2A5
Failed to delete resume command line value., xrefs: 006AF41C
Failed to write Resume value., xrefs: 006AF293
Failed to delete run key value., xrefs: 006AF3CE
Failed to write Installed value., xrefs: 006AF2B6
"%ls" /%ls, xrefs: 006AF2E5
burn.runonce, xrefs: 006AF2DA
Resume, xrefs: 006AF282
Failed to write resume command line value., xrefs: 006AF35D
registration.cpp, xrefs: 006AF3C4, 006AF412

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseValueVersion
String ID: "%ls" /%ls$BundleResumeCommandLine$Failed to create run key.$Failed to delete resume command line value.$Failed to delete run key value.$Failed to format resume command line for RunOnce.$Failed to write Installed value.$Failed to write Resume value.$Failed to write resume command line value.$Failed to write run key value.$Installed$Resume$burn.runonce$registration.cpp
API String ID: 2348918689-2631711097
Opcode ID: 55d83b9e6ae32fab9a339809edff1a5d3db096bc1bf6f7225dab3f907e8f6023
Instruction ID: 3a6408dccf334dcf8fab4069036c051a235d6824dbc508fecfd731f124b3b787
Opcode Fuzzy Hash: 55d83b9e6ae32fab9a339809edff1a5d3db096bc1bf6f7225dab3f907e8f6023
Instruction Fuzzy Hash: D951E63194136AFBDF11ABE08C06ABE76A7EF06750F110179FA00BA251D7759E109BC6

Function 006CCC91 Relevance: 29.9, APIs: 7, Strings: 10, Instructions: 174processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(75918FB0,00000002,00000000), ref: 006CCC9D

Part of subcall function 006B4D8D: UuidCreate.RPCRT4(?), ref: 006B4DC0

CreateProcessW.KERNEL32(?,?,00000000,00000000,00000001,08000000,00000000,00000000,?,006C2401,?,?,00000000,?,?,?), ref: 006CCD7B
GetLastError.KERNEL32(?,?,00000000,?,?,?,?), ref: 006CCD85
GetProcessId.KERNEL32(006C2401,?,?,00000000,?,?,?,?), ref: 006CCDBD

Part of subcall function 006B54DC: lstrlenW.KERNEL32(?,?,00000000,?,006EB500,?,00000000,?,006A452F,?,006EB500), ref: 006B54FD
Part of subcall function 006B54DC: GetCurrentProcessId.KERNEL32(?,006A452F,?,006EB500), ref: 006B5508
Part of subcall function 006B54DC: SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,006A452F,?,006EB500), ref: 006B553F
Part of subcall function 006B54DC: ConnectNamedPipe.KERNEL32(?,00000000,?,006A452F,?,006EB500), ref: 006B5554
Part of subcall function 006B54DC: GetLastError.KERNEL32(?,006A452F,?,006EB500), ref: 006B555E
Part of subcall function 006B54DC: Sleep.KERNEL32(00000064,?,006A452F,?,006EB500), ref: 006B5593
Part of subcall function 006B54DC: SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,006A452F,?,006EB500), ref: 006B55B6
Part of subcall function 006B54DC: WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,006A452F,?,006EB500), ref: 006B55D1
Part of subcall function 006B54DC: WriteFile.KERNEL32(?,/Ej,006EB500,00000000,00000000,?,006A452F,?,006EB500), ref: 006B55EC
Part of subcall function 006B54DC: WriteFile.KERNEL32(?,comres.dll,00000004,feclient.dll,00000000,?,006A452F,?,006EB500), ref: 006B5607

Part of subcall function 006E0A28: WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,?,006A4F1C,?,000000FF,?,?,?,?,?,00000000,?,?), ref: 006E0A38
Part of subcall function 006E0A28: GetLastError.KERNEL32(?,?,006A4F1C,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?), ref: 006E0A46

CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,006CCBEF,?,?,?,?,?,00000000,?,?,?,?), ref: 006CCE41
CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,006CCBEF,?,?,?,?,?,00000000,?,?,?,?), ref: 006CCE50
CloseHandle.KERNEL32(00000000,?,?,000000FF,00000000,?,006CCBEF,?,?,?,?,?,00000000,?,?,?), ref: 006CCE67

Strings

Failed to create embedded process at path: %ls, xrefs: 006CCDB3
Failed to wait for embedded executable: %ls, xrefs: 006CCE24
Failed to create embedded pipe name and client token., xrefs: 006CCD00
embedded.cpp, xrefs: 006CCDA6
Failed to wait for embedded process to connect to pipe., xrefs: 006CCDDF
burn.embedded, xrefs: 006CCD38
%ls -%ls %ls %ls %u, xrefs: 006CCD40
Failed to create embedded pipe., xrefs: 006CCD27
Failed to allocate embedded command., xrefs: 006CCD54
Failed to process messages from embedded message., xrefs: 006CCE04

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Handle$Process$CloseErrorFileLastNamedPipeWrite$CreateCurrentState$ConnectObjectSingleSleepUuidWaitlstrlen
String ID: %ls -%ls %ls %ls %u$Failed to allocate embedded command.$Failed to create embedded pipe name and client token.$Failed to create embedded pipe.$Failed to create embedded process at path: %ls$Failed to process messages from embedded message.$Failed to wait for embedded executable: %ls$Failed to wait for embedded process to connect to pipe.$burn.embedded$embedded.cpp
API String ID: 875070380-3803182736
Opcode ID: bfb71a2d516849ef1b71647d05642d5a2bf5082e07b88c7b916043517c36ce0e
Instruction ID: 2f7ee00e17dec12761272e8e89ec39649dd0014af498efa41d77bcb38aafb745
Opcode Fuzzy Hash: bfb71a2d516849ef1b71647d05642d5a2bf5082e07b88c7b916043517c36ce0e
Instruction Fuzzy Hash: 4E516372D4021DBBDF119B94DC46FEEBBBAEF08720F110129FA05B6291D774AA409BD4

Function 006AECBE Relevance: 29.9, APIs: 2, Strings: 15, Instructions: 173COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 006AEE4C

Part of subcall function 006A394F: GetProcessHeap.KERNEL32(?,000001C7,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3960
Part of subcall function 006A394F: RtlAllocateHeap.NTDLL(00000000,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3967

SysFreeString.OLEAUT32(?), ref: 006AEE04

Strings

Failed to get next node., xrefs: 006AEEB3
Failed to get @Regid., xrefs: 006AEE9F
Regid, xrefs: 006AED9A
Path, xrefs: 006AEDB2
Failed to select software tag nodes., xrefs: 006AECEE
Failed to get @Filename., xrefs: 006AEEA9
Failed to get SoftwareTag text., xrefs: 006AEE8B
SoftwareTag, xrefs: 006AECCD
Failed to get software tag count., xrefs: 006AED13
Failed to get @Path., xrefs: 006AEE95
Failed to allocate memory for software tag structs., xrefs: 006AED4B
`)u, xrefs: 006AEE04, 006AEE4C
Filename, xrefs: 006AED7F
Failed to convert SoftwareTag text to UTF-8, xrefs: 006AEE81
registration.cpp, xrefs: 006AED41

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: Failed to allocate memory for software tag structs.$Failed to convert SoftwareTag text to UTF-8$Failed to get @Filename.$Failed to get @Path.$Failed to get @Regid.$Failed to get SoftwareTag text.$Failed to get next node.$Failed to get software tag count.$Failed to select software tag nodes.$Filename$Path$Regid$SoftwareTag$`)u$registration.cpp
API String ID: 336948655-348652723
Opcode ID: 4df92c2d236d367efb608902afb669a331e11100b13ad6c2dadc12d889c27bb1
Instruction ID: 19bbe95204e0de5dfe3f6c646c9c8a84c2fc9ac753af17bbfc3ebf9cb18df30d
Opcode Fuzzy Hash: 4df92c2d236d367efb608902afb669a331e11100b13ad6c2dadc12d889c27bb1
Instruction Fuzzy Hash: 68519631E0132AFBCB15EF99C885EAEB7A7BF06750F114169F911AB250C772DE008B90

Function 006E7F7E Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 153stringCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,msi.dll,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,?,006E8468,00000001,?), ref: 006E7F9E
CompareStringW.KERNEL32(0000007F,00000000,digest,000000FF,002E0069,000000FF,?,006E8468,00000001,?), ref: 006E7FB9
CompareStringW.KERNEL32(0000007F,00000000,name,000000FF,002E0069,000000FF,?,006E8468,00000001,?), ref: 006E7FD4
CompareStringW.KERNEL32(0000007F,00000000,algorithm,000000FF,?,000000FF,?,006E8468,00000001,?), ref: 006E8040
CompareStringW.KERNEL32(0000007F,00000001,md5,000000FF,?,000000FF,?,006E8468,00000001,?), ref: 006E8064
CompareStringW.KERNEL32(0000007F,00000001,sha1,000000FF,?,000000FF,?,006E8468,00000001,?), ref: 006E8088
CompareStringW.KERNEL32(0000007F,00000001,sha256,000000FF,?,000000FF,?,006E8468,00000001,?), ref: 006E80A8
lstrlenW.KERNEL32(006C0064,?,006E8468,00000001,?), ref: 006E80C3

Strings

name, xrefs: 006E7FCB
apuputil.cpp, xrefs: 006E80DB
algorithm, xrefs: 006E8037
md5, xrefs: 006E805B
digest, xrefs: 006E7FB0
sha1, xrefs: 006E807F
http://appsyndication.org/2006/appsyn, xrefs: 006E7F91
sha256, xrefs: 006E809F
msi.dll, xrefs: 006E7F98

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CompareString$lstrlen
String ID: algorithm$apuputil.cpp$digest$http://appsyndication.org/2006/appsyn$md5$msi.dll$name$sha1$sha256
API String ID: 1657112622-2492263259
Opcode ID: c1734f66c157e753f4d175619b58aa63fbf648a6d407761702737f847e2d8993
Instruction ID: a33d65c62eee340dc3b208bd38864f8ccd08b533d7258276bd938e2c5a6255c3
Opcode Fuzzy Hash: c1734f66c157e753f4d175619b58aa63fbf648a6d407761702737f847e2d8993
Instruction Fuzzy Hash: B3519F7168A352BFDB205F55CC95F56BA63AB11B30F204304F638AF2E1CBA5EC508B90

Function 006AA03E Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 215COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006AA0B6

Strings

Language, xrefs: 006AA09F
Failed to change value type., xrefs: 006AA21D
AssignmentType, xrefs: 006AA091
VersionString, xrefs: 006AA0A6, 006AA131, 006AA147, 006AA15B, 006AA174, 006AA188
Failed to copy upgrade code., xrefs: 006AA116
Failed to format GUID string., xrefs: 006AA0C1
Failed to set variable., xrefs: 006AA23C
State, xrefs: 006AA098
Failed to get product info., xrefs: 006AA1E3
Product or related product not found: %ls, xrefs: 006AA1A1
Trying per-machine extended info for property '%ls' for product: %ls, xrefs: 006AA148
Trying per-user extended info for property '%ls' for product: %ls, xrefs: 006AA175
Unsupported product search type: %u, xrefs: 006AA07E
MsiProductSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 006AA24F
Failed to enumerate related products for upgrade code., xrefs: 006AA0F1

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Open@16
String ID: AssignmentType$Failed to change value type.$Failed to copy upgrade code.$Failed to enumerate related products for upgrade code.$Failed to format GUID string.$Failed to get product info.$Failed to set variable.$Language$MsiProductSearch failed: ID '%ls', HRESULT 0x%x$Product or related product not found: %ls$State$Trying per-machine extended info for property '%ls' for product: %ls$Trying per-user extended info for property '%ls' for product: %ls$Unsupported product search type: %u$VersionString
API String ID: 3613110473-2134270738
Opcode ID: 472c965b29ccf0d44643855d90057a5b97df518ad320cae45f772d91718eb77b
Instruction ID: a4cff6336c20b6cdc4ac1e645f197179448aa1827768a2b402477561016fd413
Opcode Fuzzy Hash: 472c965b29ccf0d44643855d90057a5b97df518ad320cae45f772d91718eb77b
Instruction Fuzzy Hash: 7E61D232D41259BBCB11AEE98D45EEE7B6BAB06710F24006AF500BB241C3339F11DE96

Function 006B4B2A Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 158sleepfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?), ref: 006B4B84
GetLastError.KERNEL32 ref: 006B4B92
Sleep.KERNEL32(00000064), ref: 006B4BB6

Strings

\\.\pipe\%ls.Cache, xrefs: 006B4C17
\\.\pipe\%ls, xrefs: 006B4B3C
pipe.cpp, xrefs: 006B4BCF, 006B4CD2
Failed to open parent pipe: %ls, xrefs: 006B4BDC
feclient.dll, xrefs: 006B4BE9, 006B4C84, 006B4C98, 006B4CDC
Failed to verify parent pipe: %ls, xrefs: 006B4BFE
Failed to open companion process with PID: %u, xrefs: 006B4CDE
Failed to allocate name of parent cache pipe., xrefs: 006B4C2B
Failed to allocate name of parent pipe., xrefs: 006B4B50

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CreateErrorFileLastSleep
String ID: Failed to allocate name of parent cache pipe.$Failed to allocate name of parent pipe.$Failed to open companion process with PID: %u$Failed to open parent pipe: %ls$Failed to verify parent pipe: %ls$\\.\pipe\%ls$\\.\pipe\%ls.Cache$feclient.dll$pipe.cpp
API String ID: 408151869-3212458075
Opcode ID: 27827ea5bfc2d48b889019f43e89e992f6f7884ba2d8d7e8f331d03e05484a5a
Instruction ID: f6afc4b82e9c75cb5d044ad68bd036ae13e41512628715eb4943163dcd60b38f
Opcode Fuzzy Hash: 27827ea5bfc2d48b889019f43e89e992f6f7884ba2d8d7e8f331d03e05484a5a
Instruction Fuzzy Hash: 7E412FB6D82735BBDB2156908D46FEF7A56AF10B20F110211FF00BA292DF65AD8087D8

Function 006C69D2 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 153serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,00000000,?,?,?,?,?,?,?,?,006C6F28,?), ref: 006C6A0B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,006C6F28,?,?,?), ref: 006C6A18
OpenServiceW.ADVAPI32(00000000,wuauserv,00000027,?,?,?,?,?,?,?,?,006C6F28,?,?,?), ref: 006C6A60
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,006C6F28,?,?,?), ref: 006C6A6C
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,006C6F28,?,?,?), ref: 006C6AA6
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,006C6F28,?,?,?), ref: 006C6AB0
CloseServiceHandle.ADVAPI32(00000000), ref: 006C6B67
CloseServiceHandle.ADVAPI32(?), ref: 006C6B71

Strings

(ol, xrefs: 006C69F3
msuengine.cpp, xrefs: 006C6A3C, 006C6A90, 006C6AD4
wuauserv, xrefs: 006C6A5A
Failed to query status of WU service., xrefs: 006C6ADE
Failed to open service control manager., xrefs: 006C6A46
Failed to open WU service., xrefs: 006C6A9A
Failed to read configuration for WU service., xrefs: 006C6B17
Failed to mark WU service to start on demand., xrefs: 006C6B38

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Service$ErrorLast$CloseHandleOpen$ManagerQueryStatus
String ID: (ol$Failed to mark WU service to start on demand.$Failed to open WU service.$Failed to open service control manager.$Failed to query status of WU service.$Failed to read configuration for WU service.$msuengine.cpp$wuauserv
API String ID: 971853308-1523477099
Opcode ID: 0aea98ededb3ceb88517f85fc9d970c1f447eedcadc6a8d08ef4416d4dd849b0
Instruction ID: 71b19a92fb33e4a2dd003517d7bbb5f9f83fdf336330f03de5e16867736c015c
Opcode Fuzzy Hash: 0aea98ededb3ceb88517f85fc9d970c1f447eedcadc6a8d08ef4416d4dd849b0
Instruction Fuzzy Hash: B1419672A403296BD7219AA4CD85FBFB6A7EB04710F11506DFD01FB251DA74EC018AA8

Function 006AF585 Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 152registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,006B04DF,InstallerVersion,InstallerVersion,00000000,006B04DF,InstallerName,InstallerName,00000000,006B04DF,Date,InstalledDate,00000000,006B04DF,LogonUser), ref: 006AF733

Part of subcall function 006E14F4: RegSetValueExW.ADVAPI32(00020006,006F0D10,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,006AF335,00000000,?,00020006), ref: 006E1527

Strings

Failed to create the key for update registration., xrefs: 006AF5D3
PublishingGroup, xrefs: 006AF667, 006AF67A
Failed to write %ls value., xrefs: 006AF71C
ReleaseType, xrefs: 006AF68A, 006AF68F, 006AF69E
Failed to get the formatted key path for update registration., xrefs: 006AF5A7
PackageVersion, xrefs: 006AF61F, 006AF632
LogonUser, xrefs: 006AF6A9
PackageName, xrefs: 006AF5FF, 006AF612
InstallerName, xrefs: 006AF6E4, 006AF6E9, 006AF6EA, 006AF6FA
Date, xrefs: 006AF6C9
Publisher, xrefs: 006AF63F, 006AF652
InstallerVersion, xrefs: 006AF701, 006AF706, 006AF707, 006AF717
InstalledBy, xrefs: 006AF6A4, 006AF6BD
ThisVersionInstalled, xrefs: 006AF5DF, 006AF5F2
InstalledDate, xrefs: 006AF6C4, 006AF6DD

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseValue
String ID: Date$Failed to create the key for update registration.$Failed to get the formatted key path for update registration.$Failed to write %ls value.$InstalledBy$InstalledDate$InstallerName$InstallerVersion$LogonUser$PackageName$PackageVersion$Publisher$PublishingGroup$ReleaseType$ThisVersionInstalled
API String ID: 3132538880-2703781546
Opcode ID: 9c3402eadb8d9ba141cfb064086c3549f11acfad3200a3827aeeb1973171ff8f
Instruction ID: ec96b2777cf98f61f843d7ad00696840fa769bce7b04a0080673a0b83f0a1def
Opcode Fuzzy Hash: 9c3402eadb8d9ba141cfb064086c3549f11acfad3200a3827aeeb1973171ff8f
Instruction Fuzzy Hash: 6D41DC31D417AAF7CB22B794DC12DAE7967AB13710F120164FA00B6362C771DE11AE99

Function 006BE7B4 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 137registryCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 006BE7FF
RegisterClassW.USER32(?), ref: 006BE82B
GetLastError.KERNEL32 ref: 006BE836
CreateWindowExW.USER32(00000080,006F9E54,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 006BE89D
GetLastError.KERNEL32 ref: 006BE8A7
UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 006BE945

Strings

uithread.cpp, xrefs: 006BE85A, 006BE8CB
Failed to create window., xrefs: 006BE8D5
Failed to register window., xrefs: 006BE864
Unexpected return value from message pump., xrefs: 006BE930
WixBurnMessageWindow, xrefs: 006BE824, 006BE940

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$uithread.cpp
API String ID: 213125376-288575659
Opcode ID: 2d6054ca416ef21a0efea55d016a7a6b17a3ba171f5c8c494e153926693aa256
Instruction ID: 818d3c358607251059e5034681eab4aae172e3a7a11b3a6abe5e307d26dd4835
Opcode Fuzzy Hash: 2d6054ca416ef21a0efea55d016a7a6b17a3ba171f5c8c494e153926693aa256
Instruction Fuzzy Hash: FA41C7B2900225EBDB209FA5DC85BDFBFBAEF08760F214125F914AA250D7319D44CBA1

Function 006CC774 Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 272COMMON

Download Yara Rule

Strings

Failed to recreate command-line arguments., xrefs: 006CCA43
Failed to copy cache id for passthrough pseudo bundle., xrefs: 006CCA05
Failed to copy install arguments for passthrough bundle package, xrefs: 006CCA62
Failed to allocate space for burn package payload inside of passthrough bundle., xrefs: 006CC7B4
Failed to copy key for passthrough pseudo bundle., xrefs: 006CC988
pseudobundle.cpp, xrefs: 006CC7A8, 006CC9A1, 006CC9DB
Failed to allocate memory for pseudo bundle payload hash., xrefs: 006CC9AD
Failed to copy key for passthrough pseudo bundle payload., xrefs: 006CC9C5
Failed to copy download source for passthrough pseudo bundle., xrefs: 006CC98F
Failed to copy related arguments for passthrough bundle package, xrefs: 006CCA82
Failed to copy filename for passthrough pseudo bundle., xrefs: 006CC9BE
Failed to copy local source path for passthrough pseudo bundle., xrefs: 006CC9B7
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 006CC9E7
Failed to copy uninstall arguments for passthrough bundle package, xrefs: 006CCAAC

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of passthrough bundle.$Failed to allocate space for burn payload inside of related bundle struct$Failed to copy cache id for passthrough pseudo bundle.$Failed to copy download source for passthrough pseudo bundle.$Failed to copy filename for passthrough pseudo bundle.$Failed to copy install arguments for passthrough bundle package$Failed to copy key for passthrough pseudo bundle payload.$Failed to copy key for passthrough pseudo bundle.$Failed to copy local source path for passthrough pseudo bundle.$Failed to copy related arguments for passthrough bundle package$Failed to copy uninstall arguments for passthrough bundle package$Failed to recreate command-line arguments.$pseudobundle.cpp
API String ID: 1357844191-115096447
Opcode ID: fca5e8194ec3432b224114498fc7e63485e8e91fdbbfc4edab524135f9b3b478
Instruction ID: b42037924938206356a4b51f28f1a9a89efbfc5659d5b98063c73d75ef62db36
Opcode Fuzzy Hash: fca5e8194ec3432b224114498fc7e63485e8e91fdbbfc4edab524135f9b3b478
Instruction Fuzzy Hash: 7CB13975A40616EFCB51DF68C881F65BBA2FF08720F118269FD199B351CB31EC619B90

Function 006CDE46 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 204stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,00000000,00000000), ref: 006CDE61

Strings

Falied to start BITS job., xrefs: 006CE019
Failed to set callback interface for BITS job., xrefs: 006CDF99
Failed to complete BITS job., xrefs: 006CE00B
Failed while waiting for BITS download., xrefs: 006CE012
Failed to create BITS job., xrefs: 006CDEF0
Failed to download BITS job., xrefs: 006CDFF8
Failed to copy download URL., xrefs: 006CDEA8
Failed to create BITS job callback., xrefs: 006CDF74
bitsengine.cpp, xrefs: 006CDE77, 006CDF6A
Failed to initialize BITS job callback., xrefs: 006CDF82
Invalid BITS engine URL: %ls, xrefs: 006CDE83
Failed to add file to BITS job., xrefs: 006CDF2E
Failed to set credentials for BITS job., xrefs: 006CDF0F

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: lstrlen
String ID: Failed to add file to BITS job.$Failed to complete BITS job.$Failed to copy download URL.$Failed to create BITS job callback.$Failed to create BITS job.$Failed to download BITS job.$Failed to initialize BITS job callback.$Failed to set callback interface for BITS job.$Failed to set credentials for BITS job.$Failed while waiting for BITS download.$Falied to start BITS job.$Invalid BITS engine URL: %ls$bitsengine.cpp
API String ID: 1659193697-2382896028
Opcode ID: 102253d46febdddec2a736c0fc203a4293d7fd0e713e428fddb203db06b45aac
Instruction ID: 58e00a4c6232111a35d430edcc5a3adeab257b65577ec4259d04697b9f137951
Opcode Fuzzy Hash: 102253d46febdddec2a736c0fc203a4293d7fd0e713e428fddb203db06b45aac
Instruction Fuzzy Hash: 6661D171A01225EBCB119B94C885FBE7BB6EF08B20B11425EFC05AB291D7B5DD119BD0

Function 006ABC93 Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 190processCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006ABCE5
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000200,00000000,?,00000044,?,?,?,?,?), ref: 006ABDF2
GetLastError.KERNEL32(?,?,?,?), ref: 006ABDFC
WaitForInputIdle.USER32(?,?), ref: 006ABE50
CloseHandle.KERNEL32(?,?,?), ref: 006ABE9B
CloseHandle.KERNEL32(?,?,?), ref: 006ABEA8

Strings

Failed to create obfuscated executable command., xrefs: 006ABD90
"%ls" %s, xrefs: 006ABD0B, 006ABD4C
Failed to format argument string., xrefs: 006ABCF0
Failed to create executable command., xrefs: 006ABD1F
Failed to CreateProcess on path: %ls, xrefs: 006ABE2D
D, xrefs: 006ABDD1
"%ls", xrefs: 006ABD62, 006ABD7C
approvedexe.cpp, xrefs: 006ABE20
Failed to format obfuscated argument string., xrefs: 006ABD3C

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseHandle$CreateErrorIdleInputLastOpen@16ProcessWait
String ID: "%ls"$"%ls" %s$D$Failed to CreateProcess on path: %ls$Failed to create executable command.$Failed to create obfuscated executable command.$Failed to format argument string.$Failed to format obfuscated argument string.$approvedexe.cpp
API String ID: 155678114-2737401750
Opcode ID: ecc4fb61d9ec7a7ca172451f745664a24edd095778f7a79924ea39efe0384071
Instruction ID: e82aca302bcdec2496173deebb018883537e870cb553cc69195376596f8bae12
Opcode Fuzzy Hash: ecc4fb61d9ec7a7ca172451f745664a24edd095778f7a79924ea39efe0384071
Instruction Fuzzy Hash: 1B517B72D0165ABBCF11BFD1CC429EEBBBABF05350B144169FA10B6262D7319E109F94

Function 006AA28B Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 138registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006AA2B3
_MREFOpen@16.MSPDB140-MSVCRT ref: 006AA30E
RegQueryValueExW.ADVAPI32(000002C0,00000100,00000000,000002C0,00000000,00000000,000002C0,?,00000100,00000000,?,00000000,?,000002C0,000002C0,?), ref: 006AA32F
RegCloseKey.ADVAPI32(00000000,00000100,00000000,000002C0,00000100,00000000,000002C0), ref: 006AA405

Strings

Failed to format value string., xrefs: 006AA319
Failed to open registry key. Key = '%ls', xrefs: 006AA3C7
Registry key not found. Key = '%ls', xrefs: 006AA396
Failed to format key string., xrefs: 006AA2BE
Failed to query registry key value., xrefs: 006AA36A
Failed to set variable., xrefs: 006AA3BD
search.cpp, xrefs: 006AA360
RegistrySearchExists failed: ID '%ls', HRESULT 0x%x, xrefs: 006AA3DD
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 006AA37A

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Open@16$CloseQueryValue
String ID: Failed to format key string.$Failed to format value string.$Failed to open registry key. Key = '%ls'$Failed to query registry key value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchExists failed: ID '%ls', HRESULT 0x%x$search.cpp
API String ID: 2702208347-46557908
Opcode ID: 8646abe54c6ac429cbaf14052c18812244182ebde3298f74f63b636aaeef17e0
Instruction ID: dbfdf1c6e39b75c4f5bf7f27736636609cec230713907fb735bd7e88317f437e
Opcode Fuzzy Hash: 8646abe54c6ac429cbaf14052c18812244182ebde3298f74f63b636aaeef17e0
Instruction Fuzzy Hash: 37411232D01224BBDF227AD5CC06FAFBA6BEB06710F110256F804A6192D3729E10DE96

Function 006AB208 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 137COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,?,006ABAFB,00000008,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006AB210
GetLastError.KERNEL32(?,006ABAFB,00000008,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006AB21C

Strings

Failed to find valid DOS image header in buffer., xrefs: 006AB27D
Failed to read section info, unsupported version: %08x, xrefs: 006AB35E
Failed to read section info, data to short: %u, xrefs: 006AB314
Failed to find Burn section., xrefs: 006AB332
.wixburn, xrefs: 006AB2BE
section.cpp, xrefs: 006AB240, 006AB271, 006AB29C, 006AB305, 006AB326, 006AB34F, 006AB38F
.wix, xrefs: 006AB2E3
burn, xrefs: 006AB2EB
Failed to get module handle to process., xrefs: 006AB24A
Bundle guid didn't match the guid in the PE Header in memory., xrefs: 006AB39B
Failed to find valid NT image header in buffer., xrefs: 006AB2A8

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorHandleLastModule
String ID: .wix$.wixburn$Bundle guid didn't match the guid in the PE Header in memory.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get module handle to process.$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$burn$section.cpp
API String ID: 4242514867-926796631
Opcode ID: 50cde6900e7d2cc3abef6011a6c3ea73688b84523ed869b1685b3eb892a3c831
Instruction ID: b8fefaf382a945a2ca289338927f2385e727151c10a759fc086c86f39cd87322
Opcode Fuzzy Hash: 50cde6900e7d2cc3abef6011a6c3ea73688b84523ed869b1685b3eb892a3c831
Instruction Fuzzy Hash: F4413231241320A7DF2076925C46F6F2653EF86B30B36506DF9015F283D7A9CD428AD9

Function 006A694B Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 133libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,ntdll,?), ref: 006A699B
GetLastError.KERNEL32 ref: 006A69A5
GetProcAddress.KERNEL32(?,RtlGetVersion), ref: 006A69E8
GetLastError.KERNEL32 ref: 006A69F2
FreeLibrary.KERNEL32(00000000,00000000,?), ref: 006A6B03

Strings

RtlGetVersion, xrefs: 006A69DD
Failed to locate RtlGetVersion., xrefs: 006A6A20
variable.cpp, xrefs: 006A69C9, 006A6A16
Failed to set variant value., xrefs: 006A6AE7
Failed to get OS info., xrefs: 006A6A43
Failed to locate NTDLL., xrefs: 006A69D3
ntdll, xrefs: 006A6995

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$AddressFreeHandleLibraryModuleProc
String ID: Failed to get OS info.$Failed to locate NTDLL.$Failed to locate RtlGetVersion.$Failed to set variant value.$RtlGetVersion$ntdll$variable.cpp
API String ID: 3057421322-109962352
Opcode ID: 5100454bcff32ff66f7399e2dfd8d217b6b11631fb90f8f88bf14c4b3bfeba36
Instruction ID: 0d8472e9bea74c786777d104cc86d5a56ab1dfe30e438d9b125a772b19653263
Opcode Fuzzy Hash: 5100454bcff32ff66f7399e2dfd8d217b6b11631fb90f8f88bf14c4b3bfeba36
Instruction Fuzzy Hash: 0141E832D013799BDB31AB65CC49BEA76A6EB09710F054199FE08F6280D7758E80CF94

Function 006A48EF Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 130memorysynchronizationCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,00000001,00000001,00000000,00000000,?,?,?,006A5466,?,?,?,?), ref: 006A4920
GetLastError.KERNEL32(?,?,?,006A5466,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 006A4931
ReleaseMutex.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 006A4A6E
CloseHandle.KERNEL32(?,?,?,?,006A5466,?,?,?,?,?,?,?,?,?,?,?), ref: 006A4A77

Strings

Failed to pump messages from parent process., xrefs: 006A4A42
Failed to set elevated pipe into thread local storage for logging., xrefs: 006A49A8
engine.cpp, xrefs: 006A4955, 006A499E
Failed to allocate thread local storage for logging., xrefs: 006A495F
comres.dll, xrefs: 006A49DD
Failed to connect to unelevated process., xrefs: 006A4916
Failed to create the message window., xrefs: 006A49CC

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AllocCloseErrorHandleLastMutexRelease
String ID: Failed to allocate thread local storage for logging.$Failed to connect to unelevated process.$Failed to create the message window.$Failed to pump messages from parent process.$Failed to set elevated pipe into thread local storage for logging.$comres.dll$engine.cpp
API String ID: 687263955-1790235126
Opcode ID: e90e13356ccf4ac3a4fdd2a033dc92ddffdac1d1ce47af5aaf8a09ee232d78b6
Instruction ID: 835601649ae80c67a12d3f5008b22bafaafb8db46e1a5aa798937a17167d3816
Opcode Fuzzy Hash: e90e13356ccf4ac3a4fdd2a033dc92ddffdac1d1ce47af5aaf8a09ee232d78b6
Instruction Fuzzy Hash: 2141E473941365BBC711ABA1CC45EEFBB6EBF45750F01022AFA14A6111DFB0AD508BE4

Function 006B3B4E Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 130COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,?,00000000,crypt32.dll), ref: 006B3BA2
GetLastError.KERNEL32(?,00000000,crypt32.dll), ref: 006B3BAC
GetCurrentProcessId.KERNEL32(?,?,?,00000104,?,?,00000000,crypt32.dll), ref: 006B3C15
ProcessIdToSessionId.KERNEL32(00000000,?,00000000,crypt32.dll), ref: 006B3C1C
CompareStringW.KERNEL32(00000000,00000000,?,?,?,?,?,7FFFFFFF,?,?,?,?,?,00000000,crypt32.dll), ref: 006B3CA6

Strings

Failed to format session id as a string., xrefs: 006B3C4A
%u\, xrefs: 006B3C36
Failed to copy temp folder., xrefs: 006B3CCF
Failed to get length of temp folder., xrefs: 006B3C06
Failed to get temp folder., xrefs: 006B3BDA
logging.cpp, xrefs: 006B3BD0
Failed to get length of session id string., xrefs: 006B3C71
crypt32.dll, xrefs: 006B3B61

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Process$CompareCurrentErrorLastPathSessionStringTemp
String ID: %u\$Failed to copy temp folder.$Failed to format session id as a string.$Failed to get length of session id string.$Failed to get length of temp folder.$Failed to get temp folder.$crypt32.dll$logging.cpp
API String ID: 2407829081-3274134579
Opcode ID: ec66d0908f84d83dbc6af80bee55e2afa9ed424b0b2f606c351184030bc3aafb
Instruction ID: 182cc0676b253d0a90199483f408937f55408dd9673c1b3e14a842a62351e4c8
Opcode Fuzzy Hash: ec66d0908f84d83dbc6af80bee55e2afa9ed424b0b2f606c351184030bc3aafb
Instruction Fuzzy Hash: 3A4184B2E8123DABCB219B508C49FEA7B7AAB14710F110195FA09B7351DB709F858BD4

Function 006A7FA5 Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 216COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,000000B9,00000002,?,00000000,00000000,00000000,00000000,00000001,00000000,00000002,000000B9), ref: 006A7FC2
LeaveCriticalSection.KERNEL32(?), ref: 006A81EA

Strings

Failed to get numeric., xrefs: 006A81BC
Unsupported variable type., xrefs: 006A81A7
Failed to write variable value as number., xrefs: 006A8194
Failed to write variable value as string., xrefs: 006A81AE
Failed to write literal flag., xrefs: 006A81C3
Failed to get string., xrefs: 006A81B5
Failed to get version., xrefs: 006A819B
feclient.dll, xrefs: 006A809D, 006A80F3, 006A8134
Failed to write variable count., xrefs: 006A7FDD
Failed to write variable name., xrefs: 006A81D1
Failed to write included flag., xrefs: 006A81D8
Failed to write variable value type., xrefs: 006A81CA

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get numeric.$Failed to get string.$Failed to get version.$Failed to write included flag.$Failed to write literal flag.$Failed to write variable count.$Failed to write variable name.$Failed to write variable value as number.$Failed to write variable value as string.$Failed to write variable value type.$Unsupported variable type.$feclient.dll
API String ID: 3168844106-2118673349
Opcode ID: 4e302a8928da63a3d5c725e666462c710682803618aa54f445c6ec28790ffdd6
Instruction ID: 83658291060e2ed1023c6b68658dba24bc4d662e771b6edb0c28f351767b80e5
Opcode Fuzzy Hash: 4e302a8928da63a3d5c725e666462c710682803618aa54f445c6ec28790ffdd6
Instruction Fuzzy Hash: 5D719E72D0166AEFCB12AFA4C841BAE7BA7BF06350F114566E901A7250DB30DE169F90

Function 006E02F8 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 123COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 006E033C
GetComputerNameW.KERNEL32(?,?), ref: 006E0394

Strings

Executable: %ls v%d.%d.%d.%d, xrefs: 006E03F0
@dp, xrefs: 006E0445
Hdp, xrefs: 006E043D
Computer : %ls, xrefs: 006E0402
\dp, xrefs: 006E042D
8dp, xrefs: 006E030D
Tdp, xrefs: 006E0435
ddp, xrefs: 006E044D
--- logging level: %hs ---, xrefs: 006E0454
=== Logging started: %ls ===, xrefs: 006E03BF

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Name$ComputerFileModule
String ID: --- logging level: %hs ---$8dp$=== Logging started: %ls ===$@dp$Computer : %ls$Executable: %ls v%d.%d.%d.%d$Hdp$Tdp$\dp$ddp
API String ID: 2577110986-2998646071
Opcode ID: 4ba5d5faf3d7255d8529b248c7954fc158ab948ed7aa84fa698a4ab6928f2976
Instruction ID: d2b8389483ba728bb338b461a169df9db357a4df99bfd6a6005ff5de58810329
Opcode Fuzzy Hash: 4ba5d5faf3d7255d8529b248c7954fc158ab948ed7aa84fa698a4ab6928f2976
Instruction Fuzzy Hash: D04173F2901358EBDB10DF65DD45AEA73BDEB44300F4081A9F609A3141D6749EC58F69

Function 006B97B2 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 123fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000000,?,006BA843,00000000,00000000,00000000,?,00000000), ref: 006B97CD
GetLastError.KERNEL32(?,006BA843,00000000,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 006B97DD

Part of subcall function 006E4102: Sleep.KERNEL32(?,00000000,?,006B85EE,?,?,00000001,00000003,000007D0,?,?,?,?,?,?,006A4DBC), ref: 006E4119

CloseHandle.KERNEL32(00000000,00000000,00000001,00000003,000007D0,?,00000000,00000000,00000000), ref: 006B98E9

Strings

Moving, xrefs: 006B987F
cache.cpp, xrefs: 006B9801
Failed to verify payload signature: %ls, xrefs: 006B9838
Failed to verify payload hash: %ls, xrefs: 006B9875
Failed to copy %ls to %ls, xrefs: 006B98D7
Failed to open payload in working path: %ls, xrefs: 006B980C
Failed to move %ls to %ls, xrefs: 006B98C1
Copying, xrefs: 006B9888, 006B9893
%ls payload from working path '%ls' to path '%ls', xrefs: 006B9894

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastSleep
String ID: %ls payload from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open payload in working path: %ls$Failed to verify payload hash: %ls$Failed to verify payload signature: %ls$Moving$cache.cpp
API String ID: 1275171361-1604654059
Opcode ID: 69162e257a500e9b838d3cf8efeab49f16f4ebf002c3b05f7fcddabf9d51d039
Instruction ID: 6ae959ad338f663101c77033ebdcb25d7b7251a13d04b38d1d44496855aa976e
Opcode Fuzzy Hash: 69162e257a500e9b838d3cf8efeab49f16f4ebf002c3b05f7fcddabf9d51d039
Instruction Fuzzy Hash: 403105B2A416757BDA322A258C4AFEB2A5FDF02B60F020529FF007B391D6609D4097F5

Function 006A65C0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 118COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000), ref: 006A65FC

Part of subcall function 006E0ACC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,006A5EB2,00000000), ref: 006E0AE0
Part of subcall function 006E0ACC: GetProcAddress.KERNEL32(00000000), ref: 006E0AE7
Part of subcall function 006E0ACC: GetLastError.KERNEL32(?,?,?,006A5EB2,00000000), ref: 006E0AFE

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 006A6628
GetLastError.KERNEL32 ref: 006A6636
GetSystemWow64DirectoryW.KERNEL32(?,00000104,00000000), ref: 006A666E
GetLastError.KERNEL32 ref: 006A6678
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 006A66BB
GetLastError.KERNEL32 ref: 006A66C5

Strings

Failed to get 64-bit system folder., xrefs: 006A6664
Failed to backslash terminate system folder., xrefs: 006A6708
variable.cpp, xrefs: 006A665A, 006A669C
Failed to get 32-bit system folder., xrefs: 006A66A6
Failed to set system folder variant value., xrefs: 006A6724

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$DirectorySystem$AddressCurrentHandleModuleProcProcessWow64
String ID: Failed to backslash terminate system folder.$Failed to get 32-bit system folder.$Failed to get 64-bit system folder.$Failed to set system folder variant value.$variable.cpp
API String ID: 325818893-1590374846
Opcode ID: cc03b30b19ecb89a4bec86245557b28341f19e260cf4deb221f187d0a71e82f3
Instruction ID: 287ac1338c6831ec54d1eb25d7b924816f041e6a91ca88aa0126ac5508ad9d4d
Opcode Fuzzy Hash: cc03b30b19ecb89a4bec86245557b28341f19e260cf4deb221f187d0a71e82f3
Instruction Fuzzy Hash: B5312572D42335A7DB30A761CC49BDB77AAAF02760F1A1159BD04BB280D774DD408EE6

Function 006A6DB9 Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 166COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000001,?,00000000,006A5445,00000006,?,006A82B9,?,?,?,00000000,00000000,00000001), ref: 006A6DC8

Part of subcall function 006A56A9: CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,006A6595,006A6595,?,006A563D,?,?,00000000), ref: 006A56E5
Part of subcall function 006A56A9: GetLastError.KERNEL32(?,006A563D,?,?,00000000,?,?,006A6595,?,006A7F02,?,?,?,?,?), ref: 006A5714

LeaveCriticalSection.KERNEL32(00000001,?,00000000,00000001,00000000,00000000,?,006A82B9), ref: 006A6F59

Strings

Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 006A6F6B
Attempt to set built-in variable value: %ls, xrefs: 006A6E56
Setting hidden variable '%ls', xrefs: 006A6E86
Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 006A6ED0
Failed to set value of variable: %ls, xrefs: 006A6F41
Failed to insert variable '%ls'., xrefs: 006A6E0D
variable.cpp, xrefs: 006A6E4B
Failed to find variable value '%ls'., xrefs: 006A6DE3
Setting string variable '%ls' to value '%ls', xrefs: 006A6EED
Setting numeric variable '%ls' to value %lld, xrefs: 006A6EFA
Unsetting variable '%ls', xrefs: 006A6F15

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalSection$CompareEnterErrorLastLeaveString
String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$variable.cpp
API String ID: 2716280545-445000439
Opcode ID: 88e7ef9b85ef735972048d143adb3f3aaacdfa9537dae4c4eef7758b8b61fe3a
Instruction ID: 6e857e05a1845a0e546368d22dd1638f1765e54caebfb1bd5862ea9de53d4fa3
Opcode Fuzzy Hash: 88e7ef9b85ef735972048d143adb3f3aaacdfa9537dae4c4eef7758b8b61fe3a
Instruction Fuzzy Hash: DD51D471A44365ABDB30AE25CC4AFAB7BABEB56710F19005DF8045A281C271DC41CEA1

Function 006B2C1C Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 299COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,006C0064,000000FF,002C002B,000000FF,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 006B2C8A

Strings

Failed to add dependents ignored from command-line., xrefs: 006B2D3F
Failed to add self-dependent to ignore dependents., xrefs: 006B2D0E
Failed to add registration action for self dependent., xrefs: 006B2F57
Failed to allocate registration action., xrefs: 006B2CF3
Failed to add dependent bundle provider key to ignore dependents., xrefs: 006B2DF4
Failed to check for remaining dependents during planning., xrefs: 006B2E30
Failed to add registration action for dependent related bundle., xrefs: 006B2F8E
Failed to create the string dictionary., xrefs: 006B2CC3
wininet.dll, xrefs: 006B2ED7
crypt32.dll, xrefs: 006B2CD5, 006B2DCF, 006B2EC4, 006B2F39

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CompareString
String ID: Failed to add dependent bundle provider key to ignore dependents.$Failed to add dependents ignored from command-line.$Failed to add registration action for dependent related bundle.$Failed to add registration action for self dependent.$Failed to add self-dependent to ignore dependents.$Failed to allocate registration action.$Failed to check for remaining dependents during planning.$Failed to create the string dictionary.$crypt32.dll$wininet.dll
API String ID: 1825529933-1705955799
Opcode ID: 023f1f6a6227ef70e284e5d8ad7fafadffb52caf4e50eea04df20b71e4b46ed5
Instruction ID: d02f47b0246b18d617314751a2ee42ae665eb815f51b9aad0aaae247de4ac7e0
Opcode Fuzzy Hash: 023f1f6a6227ef70e284e5d8ad7fafadffb52caf4e50eea04df20b71e4b46ed5
Instruction Fuzzy Hash: EEB16AB0A00217EBDF299F25C8A1AEABBF6FF04710F008169F915AB251C730D991CB91

Function 006BF90B Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 187COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 006BF947
UuidCreate.RPCRT4(?), ref: 006BFA2A
StringFromGUID2.OLE32(?,?,00000027), ref: 006BFA4B
LeaveCriticalSection.KERNEL32(?,?), ref: 006BFAF4

Strings

update\%ls, xrefs: 006BF9A3
EngineForApplication.cpp, xrefs: 006BFA60
Failed to set update bundle., xrefs: 006BFACE
Failed to default local update source, xrefs: 006BF9B7
Failed to create bundle update guid., xrefs: 006BFA37
Failed to recreate command-line for update bundle., xrefs: 006BFA12
Failed to convert bundle update guid into string., xrefs: 006BFA6A

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalSection$CreateEnterFromLeaveStringUuid
String ID: EngineForApplication.cpp$Failed to convert bundle update guid into string.$Failed to create bundle update guid.$Failed to default local update source$Failed to recreate command-line for update bundle.$Failed to set update bundle.$update\%ls
API String ID: 171215650-2594647487
Opcode ID: 53a14ed2f0f5a72bc04ab69c6181281e06ee81917f69a1c05486a2ffb6054033
Instruction ID: 5ed0bc7504bea5167261901f53721c8ffced4c893b48081b916a9d3aab2ceb6c
Opcode Fuzzy Hash: 53a14ed2f0f5a72bc04ab69c6181281e06ee81917f69a1c05486a2ffb6054033
Instruction Fuzzy Hash: 9D618CB1940218EBCF259FA4CC45FEABBB6EF08710F114179F908AB262D7719C90CB91

Function 006A4AE5 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 144windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 006A4C64
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 006A4C75

Strings

Failed to open log., xrefs: 006A4B18
Failed to query registration., xrefs: 006A4BAE
Failed to set action variables., xrefs: 006A4BC4
Failed to check global conditions, xrefs: 006A4B49
Failed to set registration variables., xrefs: 006A4BDE
Failed to set layout directory variable to value provided from command-line., xrefs: 006A4C06
Failed while running , xrefs: 006A4C2A
WixBundleLayoutDirectory, xrefs: 006A4BF5
Failed to create the message window., xrefs: 006A4B98

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: MessagePostWindow
String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
API String ID: 3618638489-3051724725
Opcode ID: b996a4258cad091809ef198d3da53684d4ed7f6a8f6cee918f52182f3daca980
Instruction ID: 0a53f22e233dca638e7dcb1e1084b08ddd93550ae73ff35f39d5f5d09110c5ad
Opcode Fuzzy Hash: b996a4258cad091809ef198d3da53684d4ed7f6a8f6cee918f52182f3daca980
Instruction Fuzzy Hash: 3A41C47160261ABACB167A20CC45FEBB66FFF46760F011215F80596250EFE0ED519FA0

Function 006BF051 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 125COMMON

Download Yara Rule

APIs

Part of subcall function 006A394F: GetProcessHeap.KERNEL32(?,000001C7,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3960
Part of subcall function 006A394F: RtlAllocateHeap.NTDLL(00000000,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3967

EnterCriticalSection.KERNEL32(?,00000014,00000001), ref: 006BF06E
LeaveCriticalSection.KERNEL32(?), ref: 006BF19B

Strings

EngineForApplication.cpp, xrefs: 006BF17C
Failed to copy the arguments., xrefs: 006BF12D
Failed to copy the id., xrefs: 006BF100
Failed to post launch approved exe message., xrefs: 006BF186
UX requested unknown approved exe with id: %ls, xrefs: 006BF0CE
Engine is active, cannot change engine state., xrefs: 006BF089

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalHeapSection$AllocateEnterLeaveProcess
String ID: Engine is active, cannot change engine state.$EngineForApplication.cpp$Failed to copy the arguments.$Failed to copy the id.$Failed to post launch approved exe message.$UX requested unknown approved exe with id: %ls
API String ID: 1367039788-528931743
Opcode ID: 99f96c77f9819572892da5c8d54fc654dea6f90df1f6cb00454da51662c1d397
Instruction ID: ad96b3b183df80d5cd28c3e481e82e85b95be450152713f4a591014f32978b62
Opcode Fuzzy Hash: 99f96c77f9819572892da5c8d54fc654dea6f90df1f6cb00454da51662c1d397
Instruction Fuzzy Hash: FC31C9B2641265EFDB21AF68DC45EAB779AAF04720B018425FD04EF261EB71DD408B90

Function 006B969D Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 102fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000000,?,006BA7D4,00000000,00000000,00000000,?,00000000), ref: 006B96B8
GetLastError.KERNEL32(?,006BA7D4,00000000,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 006B96C6

Part of subcall function 006E4102: Sleep.KERNEL32(?,00000000,?,006B85EE,?,?,00000001,00000003,000007D0,?,?,?,?,?,?,006A4DBC), ref: 006E4119

CloseHandle.KERNEL32(00000000,00000000,00000001,00000003,000007D0,?,00000000,00000000,00000000), ref: 006B97A4

Strings

Failed to open container in working path: %ls, xrefs: 006B96F5
Moving, xrefs: 006B973A
cache.cpp, xrefs: 006B96EA
Failed to verify container hash: %ls, xrefs: 006B9727
Failed to copy %ls to %ls, xrefs: 006B9792
%ls container from working path '%ls' to path '%ls', xrefs: 006B974F
Failed to move %ls to %ls, xrefs: 006B977C
Copying, xrefs: 006B9743, 006B974E

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastSleep
String ID: %ls container from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open container in working path: %ls$Failed to verify container hash: %ls$Moving$cache.cpp
API String ID: 1275171361-1187406825
Opcode ID: fece4806df3dfaa7c679ba5efb74900202f7e1d95fd35c33c2e594707d2abe4e
Instruction ID: bfe889a126881d2ae0ea2fed59213b94189aa38deceeca1814579ecc4f170a1d
Opcode Fuzzy Hash: fece4806df3dfaa7c679ba5efb74900202f7e1d95fd35c33c2e594707d2abe4e
Instruction Fuzzy Hash: 3321FBB2A413697BEB311A258C46FFB269BDF41B60F110124FF00BE2D1DA519D4187F5

Function 006A6F85 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 227COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 006A6FB2
LeaveCriticalSection.KERNEL32(?), ref: 006A71BE

Strings

Unsupported variable type., xrefs: 006A7184
Failed to read variable value as number., xrefs: 006A7178
Failed to read variable count., xrefs: 006A6FD2
Failed to set variable value., xrefs: 006A7171
Failed to set variable., xrefs: 006A7192
Failed to read variable literal flag., xrefs: 006A7199
Failed to read variable value as string., xrefs: 006A718B
Failed to read variable value type., xrefs: 006A71A0
Failed to read variable name., xrefs: 006A71A7
Failed to read variable included flag., xrefs: 006A71AE

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to read variable count.$Failed to read variable included flag.$Failed to read variable literal flag.$Failed to read variable name.$Failed to read variable value as number.$Failed to read variable value as string.$Failed to read variable value type.$Failed to set variable value.$Failed to set variable.$Unsupported variable type.
API String ID: 3168844106-528957463
Opcode ID: 554883223f0e6db1d97e74bc7fabd549e7ef7a11f1e8681fc659159659ab28af
Instruction ID: 31261f075031a391e7ad402ed0c32689e64b09d61a3297d72ad4d8e90b819151
Opcode Fuzzy Hash: 554883223f0e6db1d97e74bc7fabd549e7ef7a11f1e8681fc659159659ab28af
Instruction Fuzzy Hash: 2F71BF71C0525AABDF11EEA4CC41EEEBBBBEF42710F144126F900A6260D731DE119FA0

Function 006B3F9B Relevance: 18.2, APIs: 1, Strings: 11, Instructions: 220sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 006B3AA6: RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,006B3FB5,feclient.dll,?,00000000,?,?,?,006A4B12), ref: 006B3B42

Sleep.KERNEL32(000007D0,00000001,feclient.dll,?,00000000,?,?,?,006A4B12,?,?,006EB488,?,00000001,00000000,00000000), ref: 006B404C

Strings

Setup, xrefs: 006B3FF9
Failed to get non-session specific TEMP folder., xrefs: 006B40F6
Failed to open log: %ls, xrefs: 006B40C8
log, xrefs: 006B3FF3
Failed to copy log path to prefix., xrefs: 006B416E
feclient.dll, xrefs: 006B3FAF, 006B405C
msasn1.dll, xrefs: 006B4162, 006B41A3
Failed to copy full log path to prefix., xrefs: 006B41AF
Failed to get current directory., xrefs: 006B402E
Failed to copy log extension to extension., xrefs: 006B4191
crypt32.dll, xrefs: 006B3FF2, 006B4057, 006B405F, 006B40C6, 006B4100, 006B4141, 006B4160, 006B419E, 006B41C8

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseSleep
String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$crypt32.dll$feclient.dll$log$msasn1.dll
API String ID: 2834455192-2618302845
Opcode ID: bd8ccad7548616d0d0833ee0e43737c17f6789de3302f4a1ea36161960fee1ed
Instruction ID: 1f0e3cc6a809f65afa3be09b08c87920241967eff4eceb860c83d3522a8e2422
Opcode Fuzzy Hash: bd8ccad7548616d0d0833ee0e43737c17f6789de3302f4a1ea36161960fee1ed
Instruction Fuzzy Hash: 4161A3B1A40226BADF21AF68CC42BF677ABEF15340B054159F900DB242EF71EDD08790

Function 006E44D1 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 255fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000080,00000000,?,?,00000000,?,00000000,?,?,?), ref: 006E4550
GetLastError.KERNEL32 ref: 006E4566
GetFileSizeEx.KERNEL32(00000000,?), ref: 006E45BF
GetLastError.KERNEL32 ref: 006E45C9
SetFilePointer.KERNEL32(00000000,?,?,00000001), ref: 006E461D
GetLastError.KERNEL32 ref: 006E4628
ReadFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,00000001), ref: 006E4717
CloseHandle.KERNEL32(?), ref: 006E478A

Strings

fileutil.cpp, xrefs: 006E44F1, 006E45A8, 006E45E9, 006E476D

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: File$ErrorLast$CloseCreateHandlePointerReadSize
String ID: fileutil.cpp
API String ID: 3286166115-2967768451
Opcode ID: 12242833e785e7410b61358147019a7fbacd94ab401d2972a70e5c02194f8a26
Instruction ID: 6a565fa5c4f16af0d72907124ec36c7a4c0df67240c2cabc044acc8b3a5aac32
Opcode Fuzzy Hash: 12242833e785e7410b61358147019a7fbacd94ab401d2972a70e5c02194f8a26
Instruction Fuzzy Hash: E2812771A023A6EBDF218E7A8C45BAB779AAF01760F210119FD15EB390DF74DD018AD4

Function 006E6D50 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 165COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,label,000000FF,?,?,?,7591DFD0,?,006E72C8,?,?), ref: 006E6DA6
SysFreeString.OLEAUT32(00000000), ref: 006E6E11
SysFreeString.OLEAUT32(00000000), ref: 006E6E89
SysFreeString.OLEAUT32(00000000), ref: 006E6EC8

Strings

scheme, xrefs: 006E6DB9
label, xrefs: 006E6D98
term, xrefs: 006E6DD9
`)u, xrefs: 006E6E11, 006E6E89, 006E6EC8

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: String$Free$Compare
String ID: `)u$label$scheme$term
API String ID: 1324494773-995481605
Opcode ID: e01f70c9a4cf109c95237430f59743516499cf7a1419fc17c264063e7abaab2f
Instruction ID: e45ddedbc104854078c38faba5c616b89b3f1d7e543d070e5a70ae7ebbba7504
Opcode Fuzzy Hash: e01f70c9a4cf109c95237430f59743516499cf7a1419fc17c264063e7abaab2f
Instruction Fuzzy Hash: 37516075906359EBCB15CB95CC49EEEBBB6AF14761F2002A8F521AB2A0D7309E00DB50

Function 006B4D8D Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 122COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 006B4DC0
StringFromGUID2.OLE32(?,?,00000027), ref: 006B4DEF
UuidCreate.RPCRT4(?), ref: 006B4E3A
StringFromGUID2.OLE32(?,?,00000027), ref: 006B4E66

Strings

Failed to allocate pipe secret., xrefs: 006B4E8F
BurnPipe.%s, xrefs: 006B4E1B
Failed to convert pipe guid into string., xrefs: 006B4E0C
Failed to allocate pipe name., xrefs: 006B4E2F
pipe.cpp, xrefs: 006B4E00, 006B4E4D
Failed to create pipe guid., xrefs: 006B4DCD

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CreateFromStringUuid
String ID: BurnPipe.%s$Failed to allocate pipe name.$Failed to allocate pipe secret.$Failed to convert pipe guid into string.$Failed to create pipe guid.$pipe.cpp
API String ID: 4041566446-2510341293
Opcode ID: 95214724512b576a69c8c69bbc34feaa5a5dac76fa17c44b7888c663833bccc0
Instruction ID: 6243025344c33f795c7995711723cca7506b4a64b632d7c5a03e12d30e55326e
Opcode Fuzzy Hash: 95214724512b576a69c8c69bbc34feaa5a5dac76fa17c44b7888c663833bccc0
Instruction Fuzzy Hash: 38418172D4031CABDB10DBE4C945EEEB7FAAF44710F21012AF905AB251DA749A86CB90

Function 006BEA7D Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 101threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,006A548E,?,?), ref: 006BEA9D
GetLastError.KERNEL32(?,006A548E,?,?), ref: 006BEAAA
CreateThread.KERNEL32(00000000,00000000,006BE7B4,?,00000000,00000000), ref: 006BEB03
GetLastError.KERNEL32(?,006A548E,?,?), ref: 006BEB10
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,006A548E,?,?), ref: 006BEB4B
CloseHandle.KERNEL32(00000000,?,006A548E,?,?), ref: 006BEB6A
CloseHandle.KERNEL32(?,?,006A548E,?,?), ref: 006BEB77

Strings

uithread.cpp, xrefs: 006BEACB, 006BEB31
Failed to create initialization event., xrefs: 006BEAD5
Failed to create the UI thread., xrefs: 006BEB3B

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create initialization event.$Failed to create the UI thread.$uithread.cpp
API String ID: 2351989216-3599963359
Opcode ID: eb524e6dbd1d91f50c889a7e82cd8be6d5eed8870dc3f812444cf256a299e8b1
Instruction ID: 80b218ab82f46ef2d202616aa1849343c0bc986e06ac4f12aef9b37306b2f3f1
Opcode Fuzzy Hash: eb524e6dbd1d91f50c889a7e82cd8be6d5eed8870dc3f812444cf256a299e8b1
Instruction Fuzzy Hash: AD3194B6D41229BBDB109FA98D85AEFBABDFF04350F110165FA04F7250E6319E408BA0

Function 006BE645 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 97threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,00000000,?,?,006A548E,?,?), ref: 006BE666
GetLastError.KERNEL32(?,?,006A548E,?,?), ref: 006BE673
CreateThread.KERNEL32(00000000,00000000,006BE3C8,00000000,00000000,00000000), ref: 006BE6D2
GetLastError.KERNEL32(?,?,006A548E,?,?), ref: 006BE6DF
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,006A548E,?,?), ref: 006BE71A
CloseHandle.KERNEL32(?,?,?,006A548E,?,?), ref: 006BE72E
CloseHandle.KERNEL32(?,?,?,006A548E,?,?), ref: 006BE73B

Strings

Failed to create UI thread., xrefs: 006BE70A
splashscreen.cpp, xrefs: 006BE694, 006BE700
Failed to create modal event., xrefs: 006BE69E

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create UI thread.$Failed to create modal event.$splashscreen.cpp
API String ID: 2351989216-1977201954
Opcode ID: 3ed2f6a711974eebbb22d2b855c415ffae1e837431017272257a69296878d6ad
Instruction ID: 50faa0bd19982a747cc960d4fb8f6774397d4bf6aa0dd4587260b2db5e94a35f
Opcode Fuzzy Hash: 3ed2f6a711974eebbb22d2b855c415ffae1e837431017272257a69296878d6ad
Instruction Fuzzy Hash: 2131A676D4022ABBDB209B99CC45AEFBBBAAF44710F114166FD10F6250E7355E40CBE0

Function 006C14E1 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 91threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,75922F60,?,?,006A5405,006A53BD,00000000,006A5445), ref: 006C1506
GetLastError.KERNEL32 ref: 006C1519
GetExitCodeThread.KERNEL32(006EB488,?), ref: 006C155B
GetLastError.KERNEL32 ref: 006C1569
ResetEvent.KERNEL32(006EB460), ref: 006C15A4
GetLastError.KERNEL32 ref: 006C15AE

Strings

cabextract.cpp, xrefs: 006C1540, 006C1590, 006C15D5
Failed to reset operation complete event., xrefs: 006C15DF
Failed to wait for operation complete event., xrefs: 006C154A
Failed to get extraction thread exit code., xrefs: 006C159A

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$cabextract.cpp
API String ID: 2979751695-3400260300
Opcode ID: a763e18384550d98c928a3f33953ee66fa3a9e64c06a43cbe783d988ef5accbe
Instruction ID: e9a9bf00b3380d80ae22ee9da24adf794a92a0ed2c014b65686fb464a43fc165
Opcode Fuzzy Hash: a763e18384550d98c928a3f33953ee66fa3a9e64c06a43cbe783d988ef5accbe
Instruction Fuzzy Hash: F331C4F0A00305ABD7109FA58D45BBF76EAEF46310B50406EF906DE261E770DA009B55

Function 006C15FE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(006EB478,?,00000000,?,006AC1D3,?,006A53BD,00000000,?,006B784D,?,006A566D,006A5479,006A5479,00000000,?), ref: 006C161B
GetLastError.KERNEL32(?,006AC1D3,?,006A53BD,00000000,?,006B784D,?,006A566D,006A5479,006A5479,00000000,?,006A5489,FFF9E89D,006A5489), ref: 006C1625
WaitForSingleObject.KERNEL32(006EB488,000000FF,?,006AC1D3,?,006A53BD,00000000,?,006B784D,?,006A566D,006A5479,006A5479,00000000,?,006A5489), ref: 006C165F
GetLastError.KERNEL32(?,006AC1D3,?,006A53BD,00000000,?,006B784D,?,006A566D,006A5479,006A5479,00000000,?,006A5489,FFF9E89D,006A5489), ref: 006C1669
CloseHandle.KERNEL32(00000000,006A5489,?,00000000,?,006AC1D3,?,006A53BD,00000000,?,006B784D,?,006A566D,006A5479,006A5479,00000000), ref: 006C16B4
CloseHandle.KERNEL32(00000000,006A5489,?,00000000,?,006AC1D3,?,006A53BD,00000000,?,006B784D,?,006A566D,006A5479,006A5479,00000000), ref: 006C16C3
CloseHandle.KERNEL32(00000000,006A5489,?,00000000,?,006AC1D3,?,006A53BD,00000000,?,006B784D,?,006A566D,006A5479,006A5479,00000000), ref: 006C16D2

Strings

Failed to wait for thread to terminate., xrefs: 006C1697
cabextract.cpp, xrefs: 006C1649, 006C168D
Failed to set begin operation event., xrefs: 006C1653

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseHandle$ErrorLast$EventObjectSingleWait
String ID: Failed to set begin operation event.$Failed to wait for thread to terminate.$cabextract.cpp
API String ID: 1206859064-226982402
Opcode ID: 4020a9a8507cab2578763b34d9ae6f98390fc0c1baff3d381bfe49ecbb7bf530
Instruction ID: 4ee228e38588252850ecfd152c9e2f3e7a9e7b92278de79efb3f3254bf8d8502
Opcode Fuzzy Hash: 4020a9a8507cab2578763b34d9ae6f98390fc0c1baff3d381bfe49ecbb7bf530
Instruction Fuzzy Hash: 07210732500632BBD7215B52CC49BB6B6A3FF07721F150229FA086AAA1D774EC50CAD9

Function 006B41EC Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 006E0523: EnterCriticalSection.KERNEL32(0070B5FC,00000000,?,?,?,006B4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,006A54FA,?), ref: 006E0533
Part of subcall function 006E0523: LeaveCriticalSection.KERNEL32(0070B5FC,?,?,0070B5F4,?,006B4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,006A54FA,?), ref: 006E067A

OpenEventLogW.ADVAPI32(00000000,Application), ref: 006B4212
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 006B421E
ReportEventW.ADVAPI32(00000000,00000001,00000001,00000001,00000000,00000001,00000000,006F39D4,00000000), ref: 006B426B
CloseEventLog.ADVAPI32(00000000), ref: 006B4272

Strings

Setup, xrefs: 006B41FC
txt, xrefs: 006B41F2
Failed to open Application event log, xrefs: 006B424C
_Failed, xrefs: 006B41F7
Application, xrefs: 006B420C
logging.cpp, xrefs: 006B4242

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Event$CriticalSection$CloseEnterErrorLastLeaveOpenReport
String ID: Application$Failed to open Application event log$Setup$_Failed$logging.cpp$txt
API String ID: 1844635321-1389066741
Opcode ID: c30a06841ea3f8fe2048812f05eae23deb68a76fc0ff15529bd5e63a83a3b5a2
Instruction ID: 7cb87c26c291f2d2637e65bbd18074cc963dd8ee278e5e3f37f267c83a1e9675
Opcode Fuzzy Hash: c30a06841ea3f8fe2048812f05eae23deb68a76fc0ff15529bd5e63a83a3b5a2
Instruction Fuzzy Hash: 08F08172A817B17A673226A25C1EEBB586FDA96F317020118FE10E6282DB549E4191F8

Function 006B93FE Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 226COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,?,00000000,00000000,00000003,00000000,00000000), ref: 006B949E
GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,000007D0,00000001), ref: 006B94C6

Strings

Could not verify file %ls., xrefs: 006B9607
$, xrefs: 006B959D
Failed to encode file hash., xrefs: 006B9551
Failed to get file hash., xrefs: 006B94F0
cache.cpp, xrefs: 006B94E6, 006B95FA, 006B964B
Failed to allocate memory, xrefs: 006B946F
0, xrefs: 006B955E
Could not close verify handle., xrefs: 006B9655
Failed to allocate string., xrefs: 006B9534

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast
String ID: $$0$Could not close verify handle.$Could not verify file %ls.$Failed to allocate memory$Failed to allocate string.$Failed to encode file hash.$Failed to get file hash.$cache.cpp
API String ID: 1452528299-4263581490
Opcode ID: 163f27460c4a4d17720fa0cce515f334838c38084ef48c323e1d944a1302ff47
Instruction ID: 3e7ada86a012e7caae59a7cedb507367d907a835cbf278dc74489489ab92e26b
Opcode Fuzzy Hash: 163f27460c4a4d17720fa0cce515f334838c38084ef48c323e1d944a1302ff47
Instruction Fuzzy Hash: 447186B2D41229ABDB21DFD4C841BEEB7B6AF09710F11012AFA15F7241E7349D418BB4

Function 006BE56C Relevance: 16.6, APIs: 11, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 006BE577
DefWindowProcW.USER32(?,00000082,?,?), ref: 006BE5B5
SetWindowLongW.USER32(?,000000EB,00000000), ref: 006BE5C2
SetWindowLongW.USER32(?,000000EB,?), ref: 006BE5D1
DefWindowProcW.USER32(?,?,?,?), ref: 006BE5DF
CreateCompatibleDC.GDI32(?), ref: 006BE5EB
SelectObject.GDI32(00000000,00000000), ref: 006BE5FC
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 006BE61E
SelectObject.GDI32(00000000,00000000), ref: 006BE626
DeleteDC.GDI32(00000000), ref: 006BE629
PostQuitMessage.USER32(00000000), ref: 006BE637

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Window$Long$ObjectProcSelect$CompatibleCreateDeleteMessagePostQuitStretch
String ID:
API String ID: 409979828-0
Opcode ID: a25a1fc06e8667795d13bd5f8617d453e8f3798b3221f243e193eb874228b37c
Instruction ID: ec9e272bf4450ff3312d1a47c0e4433bfe3581aa4d72cb185a35342cb6524e98
Opcode Fuzzy Hash: a25a1fc06e8667795d13bd5f8617d453e8f3798b3221f243e193eb874228b37c
Instruction Fuzzy Hash: 71219D72100244BFDB255F68DC8DDFB3F6AEF49360B056618F6169A2B4D7329850EB60

Function 006BA13A Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 222COMMON

Download Yara Rule

Strings

Failed to copy source path., xrefs: 006BA31A
Failed to get current process directory., xrefs: 006BA1F3
Failed to combine last source with source., xrefs: 006BA210
Failed to combine layout source with source., xrefs: 006BA2A4
WixBundleLastUsedSource, xrefs: 006BA1A1
WixBundleOriginalSource, xrefs: 006BA1B7
WixBundleLayoutDirectory, xrefs: 006BA26C
Failed to get bundle layout directory property., xrefs: 006BA287

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Find$CloseFileFirstlstrlen
String ID: Failed to combine last source with source.$Failed to combine layout source with source.$Failed to copy source path.$Failed to get bundle layout directory property.$Failed to get current process directory.$WixBundleLastUsedSource$WixBundleLayoutDirectory$WixBundleOriginalSource
API String ID: 2767606509-3003062821
Opcode ID: d272db2d685ef4aa17865c406032676d89923604c3d0577c0e70916912f0b6a1
Instruction ID: 3ce188947d58b69a225fffe10b03564a3adc8231d951afd553f2a8788f5e668d
Opcode Fuzzy Hash: d272db2d685ef4aa17865c406032676d89923604c3d0577c0e70916912f0b6a1
Instruction Fuzzy Hash: E2715CB1D01229ABCF11AFE8C845AFEB7FAAF08310F150129F901F7250D7719D818B66

Function 006A3076 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000040,00000000,00000000), ref: 006A30C1
GetLastError.KERNEL32 ref: 006A30C7
ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000000), ref: 006A3121
GetLastError.KERNEL32 ref: 006A3127
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006A31DB
GetLastError.KERNEL32 ref: 006A31E5
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 006A323B
GetLastError.KERNEL32 ref: 006A3245

Strings

pathutil.cpp, xrefs: 006A30EB

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$EnvironmentExpandFullNamePathStrings
String ID: pathutil.cpp
API String ID: 1547313835-741606033
Opcode ID: fce343539f4101eed951ccef989f79febf9462fe6388ffe31cdbaa9e0d95eaa3
Instruction ID: 8b2426e6543dd13a10f2c5c21e34b1e52dd5706143d34840f4ae56cb01201333
Opcode Fuzzy Hash: fce343539f4101eed951ccef989f79febf9462fe6388ffe31cdbaa9e0d95eaa3
Instruction Fuzzy Hash: 4C619273D00239ABDB21AAE58845BDEBAA6AF06760F114165FE00BB350E735DF009FD4

Function 006A2DBF Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 203sleepfiletimeCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000000,00000000,00000000), ref: 006A2E5F
GetLastError.KERNEL32 ref: 006A2E69
GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 006A2F09
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 006A2F96
GetLastError.KERNEL32 ref: 006A2FA3
Sleep.KERNEL32(00000064), ref: 006A2FB7
CloseHandle.KERNEL32(?), ref: 006A301F

Strings

pathutil.cpp, xrefs: 006A2E8D
%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls, xrefs: 006A2F66

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
String ID: %ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$pathutil.cpp
API String ID: 3480017824-1101990113
Opcode ID: 9f54b463e139c08e5fe8e7ce9720d9c87f040a341328a2d118764564b39c110c
Instruction ID: 13b39e425eea5712e73040905da399229c36b39063b0f59aec37c81ce4468603
Opcode Fuzzy Hash: 9f54b463e139c08e5fe8e7ce9720d9c87f040a341328a2d118764564b39c110c
Instruction Fuzzy Hash: 71717872D41239ABDB30AF98DC49BEEB7B6AB09710F1001D5F904E7290D7349E808F54

Function 006ACBC5 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 144COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,00000001,000000FF,?,00000001,006A53BD,00000000,006A5489,006A5445,WixBundleUILevel,840F01E8,?,00000001), ref: 006ACC1C

Strings

Payload was not found in container: %ls, xrefs: 006ACD29
Failed to get next stream., xrefs: 006ACD03
Failed to ensure directory exists, xrefs: 006ACCEE
Failed to extract file., xrefs: 006ACCE7
Failed to find embedded payload: %ls, xrefs: 006ACC48
payload.cpp, xrefs: 006ACD1D
Failed to get directory portion of local file path, xrefs: 006ACCF5
Failed to concat file paths., xrefs: 006ACCFC

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CompareString
String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$payload.cpp
API String ID: 1825529933-1711239286
Opcode ID: e59940dfa59c01cc33bfe91b84bd41babbdf90ad24ec7add48d49514dc6aae8e
Instruction ID: 6c1030ee3129e82bdc30527feadfba8dad8fef8bb01b2e96f972f119bceb9816
Opcode Fuzzy Hash: e59940dfa59c01cc33bfe91b84bd41babbdf90ad24ec7add48d49514dc6aae8e
Instruction Fuzzy Hash: 1A41E031941219EFCF25BF49CC819AEBBA7BF42730B1181A9E816AB351D7709E40DF90

Function 006A4796 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 128windowthreadCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 006A47BB
GetCurrentThreadId.KERNEL32 ref: 006A47C1
GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 006A484F

Strings

Failed to start bootstrapper application., xrefs: 006A481D
Failed to create engine for UX., xrefs: 006A47DB
Unexpected return value from message pump., xrefs: 006A48A5
Failed to load UX., xrefs: 006A4804
engine.cpp, xrefs: 006A489B
wininet.dll, xrefs: 006A47EE

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Message$CurrentPeekThread
String ID: Failed to create engine for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$engine.cpp$wininet.dll
API String ID: 673430819-2573580774
Opcode ID: 4016a0e7bf8c0be143a75156c9725bb37ba4bb0f3b26084a4103aa6702bbd2e7
Instruction ID: 828d477f5ca5d7ef16078e1600e8dc02ceae14600073334879a4d550f619c312
Opcode Fuzzy Hash: 4016a0e7bf8c0be143a75156c9725bb37ba4bb0f3b26084a4103aa6702bbd2e7
Instruction Fuzzy Hash: 2041E371601255BFEB50ABA4DC85EFBB3AEEF46314F100129F905E7290DB68ED018BA4

Function 006C9C84 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 128COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,?,006CB03E,?,00000001,00000000), ref: 006C9D0F
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,006CB03E,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 006C9D19
CopyFileExW.KERNEL32(00000000,00000000,006C9B69,?,?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 006C9D67
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,006CB03E,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 006C9D96

Strings

apply.cpp, xrefs: 006C9D3D, 006C9D81, 006C9DBA
BA aborted copy of payload from: '%ls' to: %ls., xrefs: 006C9D8F
Failed to clear readonly bit on payload destination path: %ls, xrefs: 006C9D48
copy, xrefs: 006C9CDD
Failed attempt to copy payload from: '%ls' to: %ls., xrefs: 006C9DC8

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFileLast$AttributesCopy
String ID: BA aborted copy of payload from: '%ls' to: %ls.$Failed attempt to copy payload from: '%ls' to: %ls.$Failed to clear readonly bit on payload destination path: %ls$apply.cpp$copy
API String ID: 1969131206-836986073
Opcode ID: 0eaf8c8d35735dc280ce6e5e929727513e07e80cb0f6fa294fc8e102d9c1ea4b
Instruction ID: a02a7f79ef95a56012b13dfbbb42696dbe5bdf07c1ab22810da632127c340d59
Opcode Fuzzy Hash: 0eaf8c8d35735dc280ce6e5e929727513e07e80cb0f6fa294fc8e102d9c1ea4b
Instruction Fuzzy Hash: 79311372A01625B7DB209AA28C49FBB76ABEF42B10B15415CBD05EB350D620DD01CAF4

Function 006B8EBC Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 126COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,?,00000001,80000005,?,00000000,00000000,00000000,00000003,000007D0), ref: 006B9007

Strings

Failed to secure cache path: %ls, xrefs: 006B8FEA
Failed to allocate access for SYSTEM group to path: %ls, xrefs: 006B8F30
cache.cpp, xrefs: 006B8FB0
Failed to allocate access for Everyone group to path: %ls, xrefs: 006B8F51
Failed to allocate access for Administrators group to path: %ls, xrefs: 006B8F0F
Failed to create ACL to secure cache path: %ls, xrefs: 006B8FBB
Failed to allocate access for Users group to path: %ls, xrefs: 006B8F72

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: FreeLocal
String ID: Failed to allocate access for Administrators group to path: %ls$Failed to allocate access for Everyone group to path: %ls$Failed to allocate access for SYSTEM group to path: %ls$Failed to allocate access for Users group to path: %ls$Failed to create ACL to secure cache path: %ls$Failed to secure cache path: %ls$cache.cpp
API String ID: 2826327444-4113288589
Opcode ID: 4722497e51f4a0e12a8273e346575b34a6843d023d747c13ec72d2cbe1775bb2
Instruction ID: 95fd3044b6b30a308664c3a637b123f671ff8c6fe87f90f384a5a80d21428161
Opcode Fuzzy Hash: 4722497e51f4a0e12a8273e346575b34a6843d023d747c13ec72d2cbe1775bb2
Instruction Fuzzy Hash: B041C7B2A41329BADB2156548C06FFA766FEB51B50F114068FB04FB281DF61AE84C7A4

Function 006B492F Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 117fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,crypt32.dll,00000008,?,00000000,?,00000000,00000000,crypt32.dll,00000000,?,?,?,00000000,?,00000000), ref: 006B495A
GetLastError.KERNEL32 ref: 006B4967
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,00000000), ref: 006B4A12
GetLastError.KERNEL32 ref: 006B4A1C

Strings

Failed to read data for message., xrefs: 006B4A4A
Failed to allocate data for message., xrefs: 006B49D0
pipe.cpp, xrefs: 006B49C6, 006B49DD, 006B4A40
Failed to read message from pipe., xrefs: 006B49E7
crypt32.dll, xrefs: 006B4956

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: Failed to allocate data for message.$Failed to read data for message.$Failed to read message from pipe.$crypt32.dll$pipe.cpp
API String ID: 1948546556-773887359
Opcode ID: 6df0aeef6e232b440b933778316efcbc510c807e7d329080d13dd9c9e032b23e
Instruction ID: ebe17b25445352e4a4889642742a2fc75cd8e3f2c981c83ad61ea5d44ef553c8
Opcode Fuzzy Hash: 6df0aeef6e232b440b933778316efcbc510c807e7d329080d13dd9c9e032b23e
Instruction Fuzzy Hash: 23310772D80229BBDB20AB95CC45BFFF76ABB04720F118129FD50A6242DF709D808BD4

Function 006E6C29 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 114COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,name,000000FF,00000000,00000000,00000000,?,7591DFD0), ref: 006E6C88
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,email,000000FF), ref: 006E6CA5
SysFreeString.OLEAUT32(00000000), ref: 006E6CE3
SysFreeString.OLEAUT32(00000000), ref: 006E6D27

Strings

name, xrefs: 006E6C7A
uri, xrefs: 006E6CB3
`)u, xrefs: 006E6CE3, 006E6D27
email, xrefs: 006E6C97

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: String$CompareFree
String ID: `)u$email$name$uri
API String ID: 3589242889-2762311025
Opcode ID: cee4a3228b2411ac113bc3e8c89f5a151320d90e876d27267834c9317e605a1c
Instruction ID: 05df11f2dc382edb28e8080fd712de6a40aeb6368ad353e52d4e265fe70f9c09
Opcode Fuzzy Hash: cee4a3228b2411ac113bc3e8c89f5a151320d90e876d27267834c9317e605a1c
Instruction Fuzzy Hash: 82418E31A02359BBCB119B91CD45FAEB776EF14761F2042A4F920AB2E0C7319E04DB50

Function 006BE2AF Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 104windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(?,00000001), ref: 006BE2E5
GetLastError.KERNEL32 ref: 006BE2F1
GetObjectW.GDI32(00000000,00000018,?), ref: 006BE338
GetCursorPos.USER32(?), ref: 006BE359
MonitorFromPoint.USER32(?,?,00000002), ref: 006BE36B
GetMonitorInfoW.USER32(00000000,?), ref: 006BE381

Strings

splashscreen.cpp, xrefs: 006BE315
Failed to load splash screen bitmap., xrefs: 006BE31F
(, xrefs: 006BE378

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Monitor$BitmapCursorErrorFromInfoLastLoadObjectPoint
String ID: ($Failed to load splash screen bitmap.$splashscreen.cpp
API String ID: 2342928100-598475503
Opcode ID: 770be55d981760f165d3db89822e8c5159bfc9e469a104e70227cfe03bc2e674
Instruction ID: f468df76cf0070dcf4b53eedbf5eefbb90a2951568f7080f875df07d71dae521
Opcode Fuzzy Hash: 770be55d981760f165d3db89822e8c5159bfc9e469a104e70227cfe03bc2e674
Instruction Fuzzy Hash: 60314371A006199FDB10DFB8D989ADEBBF5EF08711F158119F904EB285DB71E9408BA0

Function 006B50CA Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,?,?,006EB500), ref: 006B50D3
GetProcessId.KERNEL32(000000FF,?,?,open,00000000,00000000,?,000000FF,?,?), ref: 006B5171
CloseHandle.KERNEL32(00000000), ref: 006B518A

Strings

open, xrefs: 006B513B, 006B5149
burn.elevated, xrefs: 006B50F3
Failed to allocate parameters for elevated process., xrefs: 006B510C
Failed to launch elevated child process: %ls, xrefs: 006B515E
runas, xrefs: 006B5131
-q -%ls %ls %ls %u, xrefs: 006B50F8

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Process$CloseCurrentHandle
String ID: -q -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to launch elevated child process: %ls$burn.elevated$open$runas
API String ID: 2815245435-1352204306
Opcode ID: 9f5f20a9ace1a5bc417b8940eaa1c4b34da4322e25533917f19ec167cbd2b09b
Instruction ID: 5b79ed8f7d2e230fa85585728f279bb02fcd3d6690111d63fb979e9711707b81
Opcode Fuzzy Hash: 9f5f20a9ace1a5bc417b8940eaa1c4b34da4322e25533917f19ec167cbd2b09b
Instruction Fuzzy Hash: 4F217CB1D0161DBF8F119F99CC85AEEBBBAEF08354B10416AF911A6211DB319F909B90

Function 006A6882 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 75libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(msi,DllGetVersion), ref: 006A68AC
GetProcAddress.KERNEL32(00000000), ref: 006A68B3
GetLastError.KERNEL32 ref: 006A68BD

Strings

Failed to find DllGetVersion entry point in msi.dll., xrefs: 006A68EB
Failed to get msi.dll version info., xrefs: 006A6905
variable.cpp, xrefs: 006A68E1
msi, xrefs: 006A68A3
Failed to set variant value., xrefs: 006A6929
DllGetVersion, xrefs: 006A689E

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: DllGetVersion$Failed to find DllGetVersion entry point in msi.dll.$Failed to get msi.dll version info.$Failed to set variant value.$msi$variable.cpp
API String ID: 4275029093-842451892
Opcode ID: a1ae155994fc0d38094c784a76c80e9d156ca6798d280bad6e263f6f47e7be4c
Instruction ID: ae65f7b26d70d9b1eb48e99583a16e1bcea6afb97b12e0444b3516e45e0d0114
Opcode Fuzzy Hash: a1ae155994fc0d38094c784a76c80e9d156ca6798d280bad6e263f6f47e7be4c
Instruction Fuzzy Hash: FA110A72E01379BAD720BBB9CC46ABFB7AA9B04B10F110119FE00FB281D6749C0086E5

Function 006AD6C9 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000008,00000000,?,006A47FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,006A548E,?), ref: 006AD6DA
GetLastError.KERNEL32(?,006A47FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,006A548E,?,?), ref: 006AD6E7
GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 006AD71F
GetLastError.KERNEL32(?,006A47FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,006A548E,?,?), ref: 006AD72B

Strings

Failed to get BootstrapperApplicationCreate entry-point, xrefs: 006AD756
BootstrapperApplicationCreate, xrefs: 006AD719
userexperience.cpp, xrefs: 006AD708, 006AD74C
Failed to create UX., xrefs: 006AD76F
Failed to load UX DLL., xrefs: 006AD712

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$userexperience.cpp
API String ID: 1866314245-2276003667
Opcode ID: a0aa22458d638bdb46cf68c00d0316cad7f9eb3441f7305ed4f21e4ff01a63fa
Instruction ID: 67bbf8e0c618f2f79db9a925dd5b8556b2f5aeda81e0376e850c526f95897fb6
Opcode Fuzzy Hash: a0aa22458d638bdb46cf68c00d0316cad7f9eb3441f7305ed4f21e4ff01a63fa
Instruction Fuzzy Hash: C5113D37A81772A7CB3567954C05F5B6696AF06B21F024525FE11FF6C0D720DC008ED4

Function 006A1175 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 53libraryloadermemoryCOMMON

Download Yara Rule

APIs

HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,006A111A,cabinet.dll,00000009,?,?,00000000), ref: 006A1186
GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,006A111A,cabinet.dll,00000009,?,?,00000000), ref: 006A1191
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 006A119F
GetLastError.KERNEL32(?,?,?,?,?,006A111A,cabinet.dll,00000009,?,?,00000000), ref: 006A11BA
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 006A11C2
GetLastError.KERNEL32(?,?,?,?,?,006A111A,cabinet.dll,00000009,?,?,00000000), ref: 006A11D7

Strings

SetDllDirectoryW, xrefs: 006A11BC
kernel32, xrefs: 006A118C
SetDefaultDllDirectories, xrefs: 006A1199

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AddressErrorLastProc$HandleHeapInformationModule
String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
API String ID: 3104334766-1824683568
Opcode ID: 28b719e97f1feca8e4996376b4fd923de8254deb859a9d5ae2056926a23aad99
Instruction ID: 83adfd980ea73c5d9e7a7f33702eeeaa71dc442316cd07ad3d924e3d905f304c
Opcode Fuzzy Hash: 28b719e97f1feca8e4996376b4fd923de8254deb859a9d5ae2056926a23aad99
Instruction Fuzzy Hash: 19019231201356BA9B117FA69C49DAF7B5EEF42760B016011B9159A250E770AE018EA4

Function 006BF639 Relevance: 15.2, APIs: 2, Strings: 8, Instructions: 155COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 006BF64E
LeaveCriticalSection.KERNEL32(?), ref: 006BF7C9

Strings

Failed to set download password., xrefs: 006BF777
Failed to set download URL., xrefs: 006BF728
UX requested unknown payload with id: %ls, xrefs: 006BF6A3
UX did not provide container or payload id., xrefs: 006BF7B8
Engine is active, cannot change engine state., xrefs: 006BF668
UX requested unknown container with id: %ls, xrefs: 006BF6F3
Failed to set download user., xrefs: 006BF751
UX denied while trying to set download URL on embedded payload: %ls, xrefs: 006BF6B9

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set download URL.$Failed to set download password.$Failed to set download user.$UX denied while trying to set download URL on embedded payload: %ls$UX did not provide container or payload id.$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-2615595102
Opcode ID: 9d49b0bc146078d11af81d400532cd94aaa56a3fd7739816248f5e1cd8f78dfd
Instruction ID: d830c89d95f46f40e8a21c49572e9e5c1bfbce87cb2582c062e1e6577a1ad8f8
Opcode Fuzzy Hash: 9d49b0bc146078d11af81d400532cd94aaa56a3fd7739816248f5e1cd8f78dfd
Instruction Fuzzy Hash: 10411AB2500616ABCB619F64DC45EEAB3ABEF00710B1541B9F804EB271EF71DD90CB91

Function 006E5A5E Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 196filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(000000FF,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,00000000,00000000,00000078,00000410,000000FF,?,00000000,00000000), ref: 006E5A9B
GetLastError.KERNEL32 ref: 006E5AA9
VirtualAlloc.KERNEL32(00000000,00010000,00003000,00000004), ref: 006E5AEA
GetLastError.KERNEL32 ref: 006E5AF7
VirtualFree.KERNEL32(?,00000000,00008000), ref: 006E5C6A
CloseHandle.KERNEL32(?), ref: 006E5C79

Strings

GET, xrefs: 006E5B9E
dlutil.cpp, xrefs: 006E5ACD

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLastVirtual$AllocCloseCreateFileFreeHandle
String ID: GET$dlutil.cpp
API String ID: 2028584396-3303425918
Opcode ID: 4c802c48a88bbb7da4a7630915b545a43448bd74c372fb318a97a46ca92deea0
Instruction ID: a6cbcd8840f52ed4b1800703ebf0c3f890f98c6b230d7281cc84b5c84c151956
Opcode Fuzzy Hash: 4c802c48a88bbb7da4a7630915b545a43448bd74c372fb318a97a46ca92deea0
Instruction Fuzzy Hash: D0619F71A02759ABDB11CFA6CC94BEE7BBAAF48718F110119FD06B7240E730D9408F90

Function 006B0C50 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 183COMMON

Download Yara Rule

APIs

Part of subcall function 006B1020: CompareStringW.KERNEL32(00000000,00000000,feclient.dll,000000FF,00000000,000000FF,00000000,00000000,?,?,006B0C6F,?,00000000,?,00000000,00000000), ref: 006B104F

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,00000000,?,00000000,00000001,?,?,00000000,?,00000000), ref: 006B0DF3
GetLastError.KERNEL32 ref: 006B0E00

Strings

Failed to append payload cache action., xrefs: 006B0DAA
Failed to append cache action., xrefs: 006B0D4A
Failed to append rollback cache action., xrefs: 006B0CCF
plan.cpp, xrefs: 006B0E24
Failed to append package start action., xrefs: 006B0C95
Failed to create syncpoint event., xrefs: 006B0E2E

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CompareCreateErrorEventLastString
String ID: Failed to append cache action.$Failed to append package start action.$Failed to append payload cache action.$Failed to append rollback cache action.$Failed to create syncpoint event.$plan.cpp
API String ID: 801187047-2489563283
Opcode ID: 1ae4ea1aef7e0f5e14deda9a200d57af74ebf48e275e5b31db6851863f81af51
Instruction ID: 2e5f78aa8e8dbbe012521d413f2f4d23deedb01004570c422193b72206d9a545
Opcode Fuzzy Hash: 1ae4ea1aef7e0f5e14deda9a200d57af74ebf48e275e5b31db6851863f81af51
Instruction Fuzzy Hash: ED6190B5500605EFDB05DF58C9909ABBBFAFF84310F218459E9099B312EB31EE82CB50

Function 006E6EFF Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,7591DFD0,000000FF,type,000000FF,?,7591DFD0,7591DFD0,7591DFD0), ref: 006E6F55
SysFreeString.OLEAUT32(00000000), ref: 006E6FA0
SysFreeString.OLEAUT32(00000000), ref: 006E701C
SysFreeString.OLEAUT32(00000000), ref: 006E7068

Strings

url, xrefs: 006E6F68
type, xrefs: 006E6F47
`)u, xrefs: 006E6FA0, 006E701C, 006E7068

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: String$Free$Compare
String ID: `)u$type$url
API String ID: 1324494773-3139739812
Opcode ID: c156b9483c0546d70d30d3281ebdda61240750a8f2a712ad0798187291e7820a
Instruction ID: 4659ecae06e89c6e80b64b7f43bd95e80aefb16cdb958c5cc85960b54d20a8a5
Opcode Fuzzy Hash: c156b9483c0546d70d30d3281ebdda61240750a8f2a712ad0798187291e7820a
Instruction Fuzzy Hash: 9B516E75906359EFCB25DF95D888EEEBBBAAF04311F104299F511AB2A0D7319E00DB50

Function 006B05A2 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 133registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,006EB500,00000000,?), ref: 006B06D3
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,006EB500,00000000,?), ref: 006B06E2

Part of subcall function 006E0BE9: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,006B061A,?,00000000,00020006), ref: 006E0C0E

Strings

Failed to delete registration key: %ls, xrefs: 006B0681
Failed to open registration key., xrefs: 006B071A
Failed to write volatile reboot required registry key., xrefs: 006B061E
%ls.RebootRequired, xrefs: 006B05F0
Failed to update resume mode., xrefs: 006B06B7
crypt32.dll, xrefs: 006B05AC

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Close$Create
String ID: %ls.RebootRequired$Failed to delete registration key: %ls$Failed to open registration key.$Failed to update resume mode.$Failed to write volatile reboot required registry key.$crypt32.dll
API String ID: 359002179-3398658923
Opcode ID: 832e925fdd853b8e95fb21e97ae70db36630ebb1d4ca2f8a76b6f6150b124843
Instruction ID: 2db9c2eaa46a3efe87a1f36112b6a3b56e7e18fb1bfea634252ecbd57478c427
Opcode Fuzzy Hash: 832e925fdd853b8e95fb21e97ae70db36630ebb1d4ca2f8a76b6f6150b124843
Instruction Fuzzy Hash: B0417EB1900318FAEF22AFA1CC06EEF7BBBAF85310F10441DF50561161E7729AA09B95

Function 006BD24B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 118threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,006BAD40,?,00000000,00000000), ref: 006BD2E9
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 006BD2F5

Part of subcall function 006BCF25: WaitForSingleObject.KERNEL32(00000001,000493E0,00000000,?,?,006BD365,00000000,?,?,006BC7C9,00000001,?,?,?,?,?), ref: 006BCF37
Part of subcall function 006BCF25: GetLastError.KERNEL32(?,?,006BD365,00000000,?,?,006BC7C9,00000001,?,?,?,?,?,00000000,00000000,?), ref: 006BCF41

CloseHandle.KERNEL32(00000000,00000000,?,?,006BC7C9,00000001,?,?,?,?,?,00000000,00000000,?,?,?), ref: 006BD376

Strings

Failed to create elevated cache thread., xrefs: 006BD323
fTj, xrefs: 006BD2A1
QEj, xrefs: 006BD283
elevation.cpp, xrefs: 006BD319
Failed to pump messages in child process., xrefs: 006BD34D

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$CloseCreateHandleObjectSingleThreadWait
String ID: Failed to create elevated cache thread.$Failed to pump messages in child process.$QEj$elevation.cpp$fTj
API String ID: 3606931770-3154854383
Opcode ID: 10c7654f46e234ad958d68d37d1317122f8bc7cd87d19686c2e1a9c0ab2bb279
Instruction ID: 81d36db4b2e793893d77816d21bd58c4eb7410fe079d096d3f20ba8432d08076
Opcode Fuzzy Hash: 10c7654f46e234ad958d68d37d1317122f8bc7cd87d19686c2e1a9c0ab2bb279
Instruction Fuzzy Hash: 4541F7B6D01219AFCB50DF99D8859EEBBFAFF08310F10416AF914E7340E770A9408B94

Function 006E159E Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 117stringregistryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000000,BundleUpgradeCode), ref: 006E15DA
lstrlenW.KERNEL32(?,00000002,00000001,?,00000002,00000001,00000000,00000000,BundleUpgradeCode), ref: 006E163C
lstrlenW.KERNEL32(?), ref: 006E1648
RegSetValueExW.ADVAPI32(?,?,00000000,00000007,?,?,00000001,?,?,00000002,00000001,00000000,00000000,BundleUpgradeCode), ref: 006E168B

Strings

regutil.cpp, xrefs: 006E16B3
@fp, xrefs: 006E15B8
BundleUpgradeCode, xrefs: 006E15A7
@fp, xrefs: 006E161C, 006E1633

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: lstrlen$Value
String ID: @fp$@fp$BundleUpgradeCode$regutil.cpp
API String ID: 198323757-830574712
Opcode ID: e9080a10c4d7096207d7caeb3fb3178184d0ccbb8539dd51baddd9de0435917e
Instruction ID: 2e6cbc07dab8ba12f25937c2d1865da66305881bb3b42d19cd18f4484dba8253
Opcode Fuzzy Hash: e9080a10c4d7096207d7caeb3fb3178184d0ccbb8539dd51baddd9de0435917e
Instruction Fuzzy Hash: 1B419F72901369AFCB119F998C85AEEBBBABB45750F050169FD11AF210D730ED11ABA0

Function 006AF451 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 109stringCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006AF48A

Part of subcall function 006A4115: CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,006BA0E8,00000000,00000000,?,00000000,006A53BD,00000000,?,?,006AD5B5,?), ref: 006A4123
Part of subcall function 006A4115: GetLastError.KERNEL32(?,006BA0E8,00000000,00000000,?,00000000,006A53BD,00000000,?,?,006AD5B5,?,00000000,00000000), ref: 006A4131

lstrlenA.KERNEL32(006EB500,00000000,00000094,00000000,00000094,?,?,006B04BF,swidtag,00000094,?,006EB518,006B04BF,00000000,?,00000000), ref: 006AF4DD

Part of subcall function 006E4DB3: CreateFileW.KERNEL32(006EB500,40000000,00000001,00000000,00000002,00000080,00000000,006B04BF,00000000,?,006AF4F4,?,00000080,006EB500,00000000), ref: 006E4DCB
Part of subcall function 006E4DB3: GetLastError.KERNEL32(?,006AF4F4,?,00000080,006EB500,00000000,?,006B04BF,?,00000094,?,?,?,?,?,00000000), ref: 006E4DD8

Strings

Failed to write tag xml to file: %ls, xrefs: 006AF51B
Failed to allocate regid file path., xrefs: 006AF535
Failed to format tag folder path., xrefs: 006AF543
Failed to create regid folder: %ls, xrefs: 006AF525
swidtag, xrefs: 006AF49D
Failed to allocate regid folder path., xrefs: 006AF53C

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CreateErrorLast$DirectoryFileOpen@16lstrlen
String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to create regid folder: %ls$Failed to format tag folder path.$Failed to write tag xml to file: %ls$swidtag
API String ID: 904508749-1201533908
Opcode ID: 9537a18a600dafd27f1a064ae5f74d9b738548f39f00e4f9d31f3f107545dc30
Instruction ID: 00794ce00b84a4bce5792c52c8a1c82cce06b530700541d6afd695f434fad51e
Opcode Fuzzy Hash: 9537a18a600dafd27f1a064ae5f74d9b738548f39f00e4f9d31f3f107545dc30
Instruction Fuzzy Hash: B931AA32C0121AFBCF11AFA4CC45BADBBB6AF16310F1081A9E910BA261D7719E509F95

Function 006B53E2 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 91synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0002BF20,?,F0000003,00000000,00000000,?,00000000,00000000,00000000,006A548E,00000000,00000000,?,00000000), ref: 006B548B
GetLastError.KERNEL32(?,?,?,006A4C61,?,?,00000000,?,?,?,?,?,?,006EB4A0,?,?), ref: 006B5496

Strings

Failed to post terminate message to child process., xrefs: 006B5476
Failed to write restart to message buffer., xrefs: 006B542E
pipe.cpp, xrefs: 006B54BA
Failed to write exit code to message buffer., xrefs: 006B5406
Failed to post terminate message to child process cache thread., xrefs: 006B545A
Failed to wait for child process exit., xrefs: 006B54C4

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: Failed to post terminate message to child process cache thread.$Failed to post terminate message to child process.$Failed to wait for child process exit.$Failed to write exit code to message buffer.$Failed to write restart to message buffer.$pipe.cpp
API String ID: 1211598281-2161881128
Opcode ID: b47303f3bfaf4bb1b51ff694897cbdd9b70a7ca7fe943c6b54d3d5cbfb3bfbdf
Instruction ID: 9debe0a8699012e80543471be523f3db12b0c07cf73cb10792e678854cfb157e
Opcode Fuzzy Hash: b47303f3bfaf4bb1b51ff694897cbdd9b70a7ca7fe943c6b54d3d5cbfb3bfbdf
Instruction Fuzzy Hash: 3421F772940A29BBDF225A50DC05FEE77ABAF00721F114255F901B6290DB30AED097D4

Function 006B9098 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 89fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000101,?,006B9F04,00000003,000007D0,00000003,?,000007D0), ref: 006B90B2
GetLastError.KERNEL32(?,006B9F04,00000003,000007D0,00000003,?,000007D0,00000000,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001,?), ref: 006B90BF
CloseHandle.KERNEL32(00000000,?,006B9F04,00000003,000007D0,00000003,?,000007D0,00000000,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001), ref: 006B9187

Strings

Failed to verify hash of payload: %ls, xrefs: 006B9172
cache.cpp, xrefs: 006B90F6
Failed to verify signature of payload: %ls, xrefs: 006B912F
Failed to open payload at path: %ls, xrefs: 006B9103
Failed to verify catalog signature of payload: %ls, xrefs: 006B914E

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: Failed to open payload at path: %ls$Failed to verify catalog signature of payload: %ls$Failed to verify hash of payload: %ls$Failed to verify signature of payload: %ls$cache.cpp
API String ID: 2528220319-2757871984
Opcode ID: d9e4dec5cd947099ddb01f792f1f220c623a3a6fb9a1b7987b063ccaa5398e39
Instruction ID: 5ae1a3bb4658325343571892cfeadc5c3ba7324d7ca220d6511955852d26cb75
Opcode Fuzzy Hash: d9e4dec5cd947099ddb01f792f1f220c623a3a6fb9a1b7987b063ccaa5398e39
Instruction Fuzzy Hash: F821F672540637B7CB321A6C8C8DBEA7A5BAF01760F114211FF10652A093219CA1FBF5

Function 006A6B1E Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 006A6B69
GetLastError.KERNEL32 ref: 006A6B73
GetVolumePathNameW.KERNEL32(?,?,00000104), ref: 006A6BB7
GetLastError.KERNEL32 ref: 006A6BC1

Strings

Failed to get windows directory., xrefs: 006A6BA1
variable.cpp, xrefs: 006A6B97, 006A6BE5
Failed to set variant value., xrefs: 006A6C0B
Failed to get volume path name., xrefs: 006A6BEF

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$DirectoryNamePathVolumeWindows
String ID: Failed to get volume path name.$Failed to get windows directory.$Failed to set variant value.$variable.cpp
API String ID: 124030351-4026719079
Opcode ID: 5da49a736f02c240eeb0140e2839c0c78d5a25ad27a5fa951fb2cb3e523d183b
Instruction ID: cc92b6491f519bf29107fc858cc59c22451bd2349b84bd1692ea55e01a974842
Opcode Fuzzy Hash: 5da49a736f02c240eeb0140e2839c0c78d5a25ad27a5fa951fb2cb3e523d183b
Instruction Fuzzy Hash: 1921E777E4233967D730A6559D06FDB73AE9B01B20F110169BD04FB241EA34AE404AF9

Function 006A9C6D Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 82COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006A9C88
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,000002C0,?,006AA895,00000100,000002C0,000002C0,?,000002C0), ref: 006A9CA0
GetLastError.KERNEL32(?,006AA895,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 006A9CAB

Strings

Failed to set variable., xrefs: 006A9D2B
search.cpp, xrefs: 006A9CDB
Failed get to file attributes. '%ls', xrefs: 006A9CE8
File search: %ls, did not find path: %ls, xrefs: 006A9CFD
Failed to format variable string., xrefs: 006A9C93

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed get to file attributes. '%ls'$Failed to format variable string.$Failed to set variable.$File search: %ls, did not find path: %ls$search.cpp
API String ID: 1811509786-2053429945
Opcode ID: 43067c71905887de7c5b7ec66ea031fbed4ec9d778a6444a1357a944f9e6e54f
Instruction ID: 64c8c3dd5def6e2ca9a76494e379a15cd85c71cc6eccf507cf19f346380de384
Opcode Fuzzy Hash: 43067c71905887de7c5b7ec66ea031fbed4ec9d778a6444a1357a944f9e6e54f
Instruction Fuzzy Hash: 23214633941B24BAEB2136958C46FAEB66BEF13730F310215FE047A290D7615E909AF5

Function 006BAD40 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 006BAD57
GetLastError.KERNEL32 ref: 006BAD61
CoInitializeEx.OLE32(00000000,00000000), ref: 006BADA0
CoUninitialize.OLE32(?,006BC721,?,?), ref: 006BADDD

Strings

Failed to initialize COM., xrefs: 006BADAC
elevation.cpp, xrefs: 006BAD85
Failed to pump messages in child process., xrefs: 006BADCB
Failed to set elevated cache pipe into thread local storage for logging., xrefs: 006BAD8F

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorInitializeLastUninitializeValue
String ID: Failed to initialize COM.$Failed to pump messages in child process.$Failed to set elevated cache pipe into thread local storage for logging.$elevation.cpp
API String ID: 876858697-113251691
Opcode ID: e73a9ba201a940f9263d6ed406a8d3075b5aea516772594da2b0c1e671ddc75c
Instruction ID: 5e46d96779962856ecfb1f990e79cce4ac8b9cc1992e4dc731d59e8daaf5e218
Opcode Fuzzy Hash: e73a9ba201a940f9263d6ed406a8d3075b5aea516772594da2b0c1e671ddc75c
Instruction Fuzzy Hash: 8E1136B2942635BBCB2217C5CC4A8DFBA6AEF05B717120159FD00BB210DB60AD8087D5

Function 006A5CE2 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 54registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 006A5D68

Part of subcall function 006E10B5: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 006E112B
Part of subcall function 006E10B5: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 006E1163

Strings

Failed to read folder path for '%ls'., xrefs: 006A5D34
SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 006A5D05
ProgramFilesDir, xrefs: 006A5CF7
Failed to ensure path was backslash terminated., xrefs: 006A5D52
CommonFilesDir, xrefs: 006A5CF0, 006A5D24, 006A5D33
+, xrefs: 006A5CEA
Failed to open Windows folder key., xrefs: 006A5D1A

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: QueryValue$Close
String ID: +$CommonFilesDir$Failed to ensure path was backslash terminated.$Failed to open Windows folder key.$Failed to read folder path for '%ls'.$ProgramFilesDir$SOFTWARE\Microsoft\Windows\CurrentVersion
API String ID: 1979452859-3209209246
Opcode ID: b079732e3a9dc8144a43686dad3cc930f835764a16c223d92940c3c6187be1c3
Instruction ID: b6d791b31352fad0215ce2add310ea487f3ab6ce1dd942560357707f88453e57
Opcode Fuzzy Hash: b079732e3a9dc8144a43686dad3cc930f835764a16c223d92940c3c6187be1c3
Instruction Fuzzy Hash: 72016D329427A9B7CF11BA55DC0AD9E7B6BCF02720F150169FD017A220D7718F00DAD8

Function 006DA20B Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,y4m,006D3479,?,?,?,006DA45C,00000001,00000001,ECE85006), ref: 006DA265
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,006DA45C,00000001,00000001,ECE85006,?,?,?), ref: 006DA2EB
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,ECE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 006DA3E5
__freea.LIBCMT ref: 006DA3F2

Part of subcall function 006D521A: HeapAlloc.KERNEL32(00000000,?,?,?,006D1F87,?,0000015D,?,?,?,?,006D33E0,000000FF,00000000,?,?), ref: 006D524C

__freea.LIBCMT ref: 006DA3FB
__freea.LIBCMT ref: 006DA420

Strings

y4m, xrefs: 006DA21D

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocHeap
String ID: y4m
API String ID: 3147120248-742941919
Opcode ID: 69add279734fe749b5ce954532b7e7858ea17f864505c91e0f92981b3ddcbb20
Instruction ID: 59815a58d775ff55caa1ca36732096b012037a33c14f93871a0c1b8ba3423732
Opcode Fuzzy Hash: 69add279734fe749b5ce954532b7e7858ea17f864505c91e0f92981b3ddcbb20
Instruction Fuzzy Hash: 2A51D172A14216AFDB258EA4CC81EEF77ABEB44750B1A462EFD04D6340EB35DC80C661

Function 006CA271 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 174COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 006CA33E
GetLastError.KERNEL32(?,?,?,?,00000000,00000000), ref: 006CA348

Strings

apply.cpp, xrefs: 006CA36C
Failed attempt to download URL: '%ls' to: '%ls', xrefs: 006CA425
:, xrefs: 006CA3C1
download, xrefs: 006CA308
Failed to clear readonly bit on payload destination path: %ls, xrefs: 006CA377

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: :$Failed attempt to download URL: '%ls' to: '%ls'$Failed to clear readonly bit on payload destination path: %ls$apply.cpp$download
API String ID: 1799206407-1905830404
Opcode ID: ddca28487b4550e7a092af8e005a30b1c728f840509ef49a30862df2ca316b73
Instruction ID: 6ae76beea3be2e7742e36b288fbdafda87d2482be27c564d6d9f718b33ff2806
Opcode Fuzzy Hash: ddca28487b4550e7a092af8e005a30b1c728f840509ef49a30862df2ca316b73
Instruction Fuzzy Hash: FA516871A00619ABDB10DFE9C885FFAB7BAEF04714F14805AE904EB250E375EA408B91

Function 006E84C7 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 156COMMON

Download Yara Rule

APIs

Part of subcall function 006A394F: GetProcessHeap.KERNEL32(?,000001C7,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3960
Part of subcall function 006A394F: RtlAllocateHeap.NTDLL(00000000,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3967

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000010,00000001,00000000,00000000,00000410,?,?,006C9063,000002C0,00000100), ref: 006E84F5
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF,?,?,006C9063,000002C0,00000100,000002C0,000002C0,00000100,000002C0,00000410), ref: 006E8510

Strings

apuputil.cpp, xrefs: 006E85AB
http://appsyndication.org/2006/appsyn, xrefs: 006E84E8
type, xrefs: 006E8537
application, xrefs: 006E8502

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CompareHeapString$AllocateProcess
String ID: application$apuputil.cpp$http://appsyndication.org/2006/appsyn$type
API String ID: 2664528157-4206478990
Opcode ID: b87c46b14145960f6e8537e4360a99bcbedf88a927ede35aeb5c4bacfbefaf66
Instruction ID: 9a72bb57d68af2bbcf9f04a8640e9dd6d5f261aaa02cb020cdcd1dbb3363e639
Opcode Fuzzy Hash: b87c46b14145960f6e8537e4360a99bcbedf88a927ede35aeb5c4bacfbefaf66
Instruction Fuzzy Hash: D751D071645341AFDB609F56CC81F5A7BA7AB00720F208618FA29EB3E2DF71ED408B54

Function 006E64B7 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 154fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 006E6513
DeleteFileW.KERNEL32(00000410,00000000,00000000,?,?,00000078,000000FF,00000410,?,?,?,00000078,000000FF,?,?,00000078), ref: 006E660A
CloseHandle.KERNEL32(000000FF,00000000,00000000,?,?,00000078,000000FF,00000410,?,?,?,00000078,000000FF,?,?,00000078), ref: 006E6619

Strings

WiX\Burn, xrefs: 006E6551
Burn, xrefs: 006E6502
DownloadTimeout, xrefs: 006E654C
dlutil.cpp, xrefs: 006E6537

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseDeleteErrorFileHandleLast
String ID: Burn$DownloadTimeout$WiX\Burn$dlutil.cpp
API String ID: 3522763407-1704223933
Opcode ID: 0689bdbbda1db5a6aa151371985eedcaf66bc8c1e67d2fef3ea3ce80a81086b7
Instruction ID: 56b3d813b72b47a331eccc9a25ffea6976ca8a2a33a39a1ff79bc69f29728252
Opcode Fuzzy Hash: 0689bdbbda1db5a6aa151371985eedcaf66bc8c1e67d2fef3ea3ce80a81086b7
Instruction Fuzzy Hash: DA518A72D01219BFCF12DFA5CC45EEEBBBAEF08750F004155FA14E6290E7348A119BA5

Function 006A9EC7 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 147COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006A9EED
_MREFOpen@16.MSPDB140-MSVCRT ref: 006A9F12

Strings

MsiComponentSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 006AA006
Failed to set variable., xrefs: 006A9FF6
Failed to format component id string., xrefs: 006A9EF8
Failed to get component path: %d, xrefs: 006A9F76
Failed to format product code string., xrefs: 006A9F1D

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Open@16
String ID: Failed to format component id string.$Failed to format product code string.$Failed to get component path: %d$Failed to set variable.$MsiComponentSearch failed: ID '%ls', HRESULT 0x%x
API String ID: 3613110473-1671347822
Opcode ID: f6c147c24c23225f232abf823fe79e61c70aeed8d6b2f5adfeb1ed7ef736b5f9
Instruction ID: 9f3e175a50b5661c5dbeeeb9a9a8d7f328f997dd298d1590def03a0e073737ce
Opcode Fuzzy Hash: f6c147c24c23225f232abf823fe79e61c70aeed8d6b2f5adfeb1ed7ef736b5f9
Instruction Fuzzy Hash: F341CF32900215AECF25BAA98C46AFEB66BEF06310F344216F515E2290D7319E50DEA5

Function 006AF812 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 117registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 006AF942
RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 006AF94F

Strings

Failed to open registration key., xrefs: 006AF8AB
%ls.RebootRequired, xrefs: 006AF82F
Failed to format pending restart registry key to read., xrefs: 006AF846
Failed to read Resume value., xrefs: 006AF8D8
Resume, xrefs: 006AF8B6

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Close
String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
API String ID: 3535843008-3890505273
Opcode ID: d4a378a76bc17ccab7dd895e3037217c86a881eb5d54061c12c8351cadf45f98
Instruction ID: 7051b3b7f84bf3415ab4d64ea9b972aaac722717b7b23d319821c464918ab738
Opcode Fuzzy Hash: d4a378a76bc17ccab7dd895e3037217c86a881eb5d54061c12c8351cadf45f98
Instruction Fuzzy Hash: 9B416E71901259FFDB21AFD8C880BAEFBB6EB06310F15417AE914AB210C3759E41DF82

Function 006BAA00 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 111COMMON

Download Yara Rule

Strings

Failed to determine length of relative path., xrefs: 006BAA4D
Failed to set last source., xrefs: 006BAAF0
Failed to determine length of source path., xrefs: 006BAA30
WixBundleLastUsedSource, xrefs: 006BAA9F, 006BAAA5, 006BAAE1
Failed to trim source folder., xrefs: 006BAA95

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID:
String ID: Failed to determine length of relative path.$Failed to determine length of source path.$Failed to set last source.$Failed to trim source folder.$WixBundleLastUsedSource
API String ID: 0-660234312
Opcode ID: 3ff48c91e002f6140e96b1d356d819f133ca34d9fed31084f6740f592e7b4d4a
Instruction ID: 22312efadb4267f561b6fe1811d6ec3a1ed8ae2048312a41b0940eba9782035e
Opcode Fuzzy Hash: 3ff48c91e002f6140e96b1d356d819f133ca34d9fed31084f6740f592e7b4d4a
Instruction Fuzzy Hash: CD31D871900269BFCF219AD4CD45EEE7B7BDB01720F110255F920F6291DB719D80C7A1

Function 006CD8B0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 106comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00700C4C,00000000,00000017,00700C5C,?,?,00000000,00000000,?,?,?,?,?,006CDEE7,00000000,00000000), ref: 006CD8E8

Strings

Failed to set notification flags for BITS job., xrefs: 006CD93A
WixBurn, xrefs: 006CD913
Failed to set BITS job to foreground., xrefs: 006CD969
Failed to create BITS job., xrefs: 006CD922
Failed to set progress timeout., xrefs: 006CD952
Failed to create IBackgroundCopyManager., xrefs: 006CD8F4

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CreateInstance
String ID: Failed to create BITS job.$Failed to create IBackgroundCopyManager.$Failed to set BITS job to foreground.$Failed to set notification flags for BITS job.$Failed to set progress timeout.$WixBurn
API String ID: 542301482-468763447
Opcode ID: e0e26c6b7e43afd145e23b8423fd2c3ec42a989c25282d3340608841a4b59435
Instruction ID: 8d88c76a4aa72f0700da977669895dc51fe361f48b601d6263421108630d9d1c
Opcode Fuzzy Hash: e0e26c6b7e43afd145e23b8423fd2c3ec42a989c25282d3340608841a4b59435
Instruction Fuzzy Hash: 26316E75A41315EFDB14DBA8C845EBFBBB5EF48710B00026DEA01EB390DA349C058B91

Function 006E5DAE Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,?,?,?,?,?,WiX\Burn,DownloadTimeout,00000078), ref: 006E5DF8
GetLastError.KERNEL32 ref: 006E5E05
ReadFile.KERNEL32(00000000,00000008,00000008,?,00000000), ref: 006E5E4C
GetLastError.KERNEL32 ref: 006E5E80
CloseHandle.KERNEL32(00000000,dlutil.cpp,000000C8,00000000), ref: 006E5EB4

Strings

%ls.R, xrefs: 006E5DCC
dlutil.cpp, xrefs: 006E5E29, 006E5EA4

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleRead
String ID: %ls.R$dlutil.cpp
API String ID: 3160720760-657863730
Opcode ID: c8f5dd8e81a1c78611401c323dfa1a63976c3f9f6b0d8a8dd3bfea35a8f5ff74
Instruction ID: 8eac50489d6975329623759642eb1d2907f3a4ec7c83c3e1c26d911cf0479d80
Opcode Fuzzy Hash: c8f5dd8e81a1c78611401c323dfa1a63976c3f9f6b0d8a8dd3bfea35a8f5ff74
Instruction Fuzzy Hash: 9331F572902764ABDB308B55CC45BAE7AA6AB01735F114259FE02AF2C0D7709E0086A4

Function 006AC8E6 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 98fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006ACD5E: CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,006AE444,000000FF,00000000,00000000,006AE444,?,?,006ADBEB,?,?,?,?), ref: 006ACD89

CreateFileW.KERNEL32(E9006EBA,80000000,00000005,00000000,00000003,08000000,00000000,006A53C5,?,00000000,840F01E8,14680A79,00000001,006A53BD,00000000,006A5489), ref: 006AC956
GetLastError.KERNEL32(?,?,?,006B7809,006A566D,006A5479,006A5479,00000000,?,006A5489,FFF9E89D,006A5489,006A54BD,006A5445,?,006A5445), ref: 006AC99B

Strings

catalog.cpp, xrefs: 006AC9BC
Failed to open catalog in working path: %ls, xrefs: 006AC9C9
Failed to verify catalog signature: %ls, xrefs: 006AC994
Failed to get catalog local file path, xrefs: 006AC9D9
Failed to find payload for catalog file., xrefs: 006AC9E0

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CompareCreateErrorFileLastString
String ID: Failed to find payload for catalog file.$Failed to get catalog local file path$Failed to open catalog in working path: %ls$Failed to verify catalog signature: %ls$catalog.cpp
API String ID: 1774366664-48089280
Opcode ID: 6de71a35b0c986b5daf2ea7e332593c18450219653980270cde571a0f0bbdd60
Instruction ID: 4fb353fec8b6d06f1840f4be9377b84c717c4c479e2d2bb20c2f4fe9d44e89ec
Opcode Fuzzy Hash: 6de71a35b0c986b5daf2ea7e332593c18450219653980270cde571a0f0bbdd60
Instruction Fuzzy Hash: BC312532901725BFDB20AB55CC42B5ABBA2FF05730F218129F914EB240E770AD008FD0

Function 006CD33E Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 92synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,759230B0,00000000,?,?,?,?,006CD642,?), ref: 006CD357
ReleaseMutex.KERNEL32(?,?,?,?,006CD642,?), ref: 006CD375
WaitForSingleObject.KERNEL32(?,000000FF), ref: 006CD3B6
ReleaseMutex.KERNEL32(?), ref: 006CD3CD
SetEvent.KERNEL32(?), ref: 006CD3D6

Strings

Failed to send files in use message from netfx chainer., xrefs: 006CD41C
Failed to get message from netfx chainer., xrefs: 006CD3F7

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: MutexObjectReleaseSingleWait$Event
String ID: Failed to get message from netfx chainer.$Failed to send files in use message from netfx chainer.
API String ID: 2608678126-3424578679
Opcode ID: 83f5ee9ed8cc1686e37f92f7299483b5754367609f64b41a49c67aa7ad26b787
Instruction ID: a70e0552eea511fc2117ff468396ca3559d4f3cf9164700dab33b2cf1622af0f
Opcode Fuzzy Hash: 83f5ee9ed8cc1686e37f92f7299483b5754367609f64b41a49c67aa7ad26b787
Instruction Fuzzy Hash: 7231C431900759BFCB119F94DC48EEFBBF6EF45320F108269FA65E62A0C7759A508B90

Function 006E093B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 92processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 006E09AB
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 006E09B5
CloseHandle.KERNEL32(?,?,?,?,?,00000000,00000000,00000000), ref: 006E09FE
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 006E0A0B

Strings

procutil.cpp, xrefs: 006E09D9
"%ls" %ls, xrefs: 006E0974
D, xrefs: 006E0993

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseHandle$CreateErrorLastProcess
String ID: "%ls" %ls$D$procutil.cpp
API String ID: 161867955-2732225242
Opcode ID: 68fdd657fc9cb3043879f4f3dc9cf5dbf0ae55a6bd0b03dfb8e4ec06bc18a292
Instruction ID: 0b96e7ba5ded673350969446400f0c023899890ca432482265af8204748c655b
Opcode Fuzzy Hash: 68fdd657fc9cb3043879f4f3dc9cf5dbf0ae55a6bd0b03dfb8e4ec06bc18a292
Instruction Fuzzy Hash: E0213071D0239EABEB11DFD5CD41AEFBBBAEF04710F101129E901B7252D3B09E508AA5

Function 006A9B9A Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 75COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006A9BB3
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,?,006AA8AB,00000100,000002C0,000002C0,00000100), ref: 006A9BD3
GetLastError.KERNEL32(?,006AA8AB,00000100,000002C0,000002C0,00000100), ref: 006A9BDE

Strings

Failed to set directory search path variable., xrefs: 006A9C0F
Failed while searching directory search: %ls, for path: %ls, xrefs: 006A9C34
Directory search: %ls, did not find path: %ls, reason: 0x%x, xrefs: 006A9C4A
Failed to format variable string., xrefs: 006A9BBE

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Directory search: %ls, did not find path: %ls, reason: 0x%x$Failed to format variable string.$Failed to set directory search path variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-2966038646
Opcode ID: 35f8a1472a8a63103b8858cca099939d0aa67498327b0d47903cc5a8a1c623db
Instruction ID: b09e58f1991b16ba56d8b7a59a71ab12cc6246eed1aaa138014347f7c66fe227
Opcode Fuzzy Hash: 35f8a1472a8a63103b8858cca099939d0aa67498327b0d47903cc5a8a1c623db
Instruction Fuzzy Hash: A6212933941561B7CF2236998D06B9EBBAB9F02330F310205FD1177191C7625E50AEF9

Function 006A9D4B Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 72COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006A9D64
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,?,006AA883,00000100,000002C0,000002C0,?,000002C0,00000100), ref: 006A9D84
GetLastError.KERNEL32(?,006AA883,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 006A9D8F

Strings

Failed to set variable to file search path., xrefs: 006A9DE7
File search: %ls, did not find path: %ls, xrefs: 006A9DF3
Failed while searching file search: %ls, for path: %ls, xrefs: 006A9DBD
Failed to format variable string., xrefs: 006A9D6F

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable to file search path.$Failed while searching file search: %ls, for path: %ls$File search: %ls, did not find path: %ls
API String ID: 1811509786-3425311760
Opcode ID: 0cde4b3f3e473eb9776762cee46748efec6ef3ddf3223479b118ab4a2a314539
Instruction ID: 06a31545d9b45ef8c66166438bc826a4f26a5d63cac0c785103b1e4e4bfad46e
Opcode Fuzzy Hash: 0cde4b3f3e473eb9776762cee46748efec6ef3ddf3223479b118ab4a2a314539
Instruction Fuzzy Hash: 04115B33941665BBDF227699CD02B9EBB67AF02320F310205FD0076161E7325E90AEE4

Function 006A9A4D Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 57COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 006A9AC4

Strings

Condition, xrefs: 006A9A5F
Failed to select condition node., xrefs: 006A9A7B
Failed to get Condition inner text., xrefs: 006A9A94
Failed to copy condition string from BSTR, xrefs: 006A9AAE
`)u, xrefs: 006A9AC4
ETj, xrefs: 006A9A4D

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: FreeString
String ID: Condition$ETj$Failed to copy condition string from BSTR$Failed to get Condition inner text.$Failed to select condition node.$`)u
API String ID: 3341692771-3059939704
Opcode ID: 1c31abcf7f5413ce371a9a8bfc28ad0f8c1b18a0fdd319d68b1cda5b807b2ca7
Instruction ID: 16da9a52a2f4697e36b45d6ea9eb2cc1575f5908793ce90b654a170def084613
Opcode Fuzzy Hash: 1c31abcf7f5413ce371a9a8bfc28ad0f8c1b18a0fdd319d68b1cda5b807b2ca7
Instruction Fuzzy Hash: 6711C232902368BBCB11AA90CC06FADB77AEF01750F314156FD01AA250CBB19E00DAA4

Function 006BCF25 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 55synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,000493E0,00000000,?,?,006BD365,00000000,?,?,006BC7C9,00000001,?,?,?,?,?), ref: 006BCF37
GetLastError.KERNEL32(?,?,006BD365,00000000,?,?,006BC7C9,00000001,?,?,?,?,?,00000000,00000000,?), ref: 006BCF41
GetExitCodeThread.KERNEL32(00000001,?,?,?,006BD365,00000000,?,?,006BC7C9,00000001,?,?,?,?,?,00000000), ref: 006BCF7D
GetLastError.KERNEL32(?,?,006BD365,00000000,?,?,006BC7C9,00000001,?,?,?,?,?,00000000,00000000,?), ref: 006BCF87

Strings

Failed to get cache thread exit code., xrefs: 006BCFB5
Failed to wait for cache thread to terminate., xrefs: 006BCF6F
elevation.cpp, xrefs: 006BCF65, 006BCFAB

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$elevation.cpp
API String ID: 3686190907-1954264426
Opcode ID: b0fc2f9e0ef0e78f7bdcfb4a55992748a722bbb94a8f8b1d00bfb30013ae773a
Instruction ID: 0ed65ae24bce55d80546568f2a59e8697414cde6850d57a41ae6f78cb32ade5d
Opcode Fuzzy Hash: b0fc2f9e0ef0e78f7bdcfb4a55992748a722bbb94a8f8b1d00bfb30013ae773a
Instruction Fuzzy Hash: E40126B3A4173967D7305B858D0AAFF7A5F9F05B71B120195BF04BE280E7549E4086E8

Function 006B69AE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,000000FF,00000000,?,006B6EED,crypt32.dll,?,00000000,?,00000000,00000001), ref: 006B69BB
GetLastError.KERNEL32(?,006B6EED,crypt32.dll,?,00000000,?,00000000,00000001), ref: 006B69C5
GetExitCodeThread.KERNEL32(00000001,00000000,?,006B6EED,crypt32.dll,?,00000000,?,00000000,00000001), ref: 006B6A04
GetLastError.KERNEL32(?,006B6EED,crypt32.dll,?,00000000,?,00000000,00000001), ref: 006B6A0E

Strings

Failed to get cache thread exit code., xrefs: 006B6A3F
Failed to wait for cache thread to terminate., xrefs: 006B69F6
core.cpp, xrefs: 006B69EC, 006B6A35

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$core.cpp
API String ID: 3686190907-2546940223
Opcode ID: 70f8b95d9654feaf3c367c9e44b97029baa54c74a68497aa5a01faaa6c5232d2
Instruction ID: 2c0fd68313df5051f63da6b13560691d6f3d436ff19bd9eff6fa7d1466325a8e
Opcode Fuzzy Hash: 70f8b95d9654feaf3c367c9e44b97029baa54c74a68497aa5a01faaa6c5232d2
Instruction Fuzzy Hash: 7611A9B074020AFBDB109FA5DE06BBF36AAEF00710F205169BA14E9260DB39CF409754

Function 006BAB9E Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 140COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(yTj,000000FF,00AAC56B,E9006EBA,006A53BD,00000000,?,E9006EBA,00000000), ref: 006BAC94
GetLastError.KERNEL32(00000000,00000000,00000000,00000000,yTj,000000FF,00AAC56B,E9006EBA,006A53BD,00000000,?,E9006EBA,00000000), ref: 006BACD8

Strings

yTj, xrefs: 006BAC88
Failed to get provider state from authenticode certificate., xrefs: 006BACC2
cache.cpp, xrefs: 006BAC6A, 006BACB8, 006BACFC
Failed authenticode verification of payload: %ls, xrefs: 006BAC75
Failed to get signer chain from authenticode certificate., xrefs: 006BAD06
Failed to verify expected payload against actual certificate chain., xrefs: 006BAD1E

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast
String ID: Failed authenticode verification of payload: %ls$Failed to get provider state from authenticode certificate.$Failed to get signer chain from authenticode certificate.$Failed to verify expected payload against actual certificate chain.$cache.cpp$yTj
API String ID: 1452528299-2869358525
Opcode ID: e2d91942a751b7abf777dd2aff0d268bf6363a4a347afaa17adb2a92c7d42cc8
Instruction ID: 8a5e34170c01444e5f3f67603660c110a5c7d053b74f90cdfe93fdfe04965dde
Opcode Fuzzy Hash: e2d91942a751b7abf777dd2aff0d268bf6363a4a347afaa17adb2a92c7d42cc8
Instruction Fuzzy Hash: 8A41A7B2D01229ABDB119FD4CC46AEEBBBAEF08720F110129F901BB280D7745D448BE5

Function 006BF7D9 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 118COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 006BF7EE
LeaveCriticalSection.KERNEL32(?), ref: 006BF8FB

Strings

Failed to set source path for payload., xrefs: 006BF88A
UX requested unknown payload with id: %ls, xrefs: 006BF85A
Engine is active, cannot change engine state., xrefs: 006BF808
Failed to set source path for container., xrefs: 006BF8E0
UX requested unknown container with id: %ls, xrefs: 006BF8BA
UX denied while trying to set source on embedded payload: %ls, xrefs: 006BF870

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set source path for container.$Failed to set source path for payload.$UX denied while trying to set source on embedded payload: %ls$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-4121889706
Opcode ID: 1a3f040ae941d3b0273710fa11a7a735ffe7ed1cb2de970f6a33c2bbeeead0dc
Instruction ID: 6f7c3430e73de62bc766c5301e5604ab73926d03496262bf308dfa9aa86ddb36
Opcode Fuzzy Hash: 1a3f040ae941d3b0273710fa11a7a735ffe7ed1cb2de970f6a33c2bbeeead0dc
Instruction Fuzzy Hash: 8531E9B2A40655AF8B11AB58CC45DEA77BFEF04720715813AF804EB351DB75DE808791

Function 006A71FD Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 99stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 006A7210

Strings

Failed to append escape sequence., xrefs: 006A72A3
Failed to format escape sequence., xrefs: 006A72AA
Failed to copy string., xrefs: 006A72C4
[\%c], xrefs: 006A726F
[]{}, xrefs: 006A723A
Failed to append characters., xrefs: 006A729C
Failed to allocate buffer for escaped string., xrefs: 006A7227

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: lstrlen
String ID: Failed to allocate buffer for escaped string.$Failed to append characters.$Failed to append escape sequence.$Failed to copy string.$Failed to format escape sequence.$[\%c]$[]{}
API String ID: 1659193697-3250950999
Opcode ID: 0080b0835a48cfe7a20a4d0f11a8d2c55eb289584428b956a52451c6640c95a1
Instruction ID: 33d03fe4d8be1663ecdb5d0df12bff4c3b0eb0ff5e9f7750b92d9d5a386da635
Opcode Fuzzy Hash: 0080b0835a48cfe7a20a4d0f11a8d2c55eb289584428b956a52451c6640c95a1
Instruction Fuzzy Hash: AB210633D4A359BBDB2176918C46FEE77AB9F12731F210019F900B6180DB74AF019AD8

Function 006C5BDC Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 207COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,006EB500,000000FF,feclient.dll,000000FF,00000000,00000000,?,?,?,006C67DE,?,00000001,?,006EB4A0), ref: 006C5C45

Strings

Failed to plan action for target product., xrefs: 006C5CF0
Failed to insert execute action., xrefs: 006C5C9A
Failed to copy target product code., xrefs: 006C5D78
Failed grow array of ordered patches., xrefs: 006C5CDE
feclient.dll, xrefs: 006C5C3B, 006C5D65

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CompareString
String ID: Failed grow array of ordered patches.$Failed to copy target product code.$Failed to insert execute action.$Failed to plan action for target product.$feclient.dll
API String ID: 1825529933-3477540455
Opcode ID: 094001b0a54eca1f981d64e222cabe14980e356030ef72f177cbd01334092064
Instruction ID: e97ec2bc6ef79bf105355ab0b83135cdb7c466ab15c9599c4fd7f83ffa4b9bef
Opcode Fuzzy Hash: 094001b0a54eca1f981d64e222cabe14980e356030ef72f177cbd01334092064
Instruction Fuzzy Hash: 518102B560474A9FCB14CF58C880EAA77A6FF08324B11866DED268B352D770FD91CB90

Function 006DCAED Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,006DD262,00000000,00000000,00000000,00000000,00000000,006D2F1D), ref: 006DCB2F
__fassign.LIBCMT ref: 006DCBAA
__fassign.LIBCMT ref: 006DCBC5
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 006DCBEB
WriteFile.KERNEL32(?,00000000,00000000,006DD262,00000000,?,?,?,?,?,?,?,?,?,006DD262,00000000), ref: 006DCC0A
WriteFile.KERNEL32(?,00000000,00000001,006DD262,00000000,?,?,?,?,?,?,?,?,?,006DD262,00000000), ref: 006DCC43

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: dda1fcfc3b97e14c9942fe5a9b715b9dcc0ef2b0e716827358a3f5b5c5bc4410
Instruction ID: 904847a28fcceed7a319c310d858737c61449b581e1190a6603a15af7a4d0cbd
Opcode Fuzzy Hash: dda1fcfc3b97e14c9942fe5a9b715b9dcc0ef2b0e716827358a3f5b5c5bc4410
Instruction Fuzzy Hash: E551BE71E0024A9FCB10CFA8D885AEEBBFAEF09310F14415BEA55E7351E7309941CBA4

Function 006C9279 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 150COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,00000000,00000100,00000000,?,?,?,006B7113,000000B8,0000001C,00000100), ref: 006C92A4
CompareStringW.KERNEL32(00000000,00000001,?,000000FF,006EB4B8,000000FF,?,?,?,006B7113,000000B8,0000001C,00000100,00000100,00000100,000000B0), ref: 006C932E

Strings

BA aborted detect forward compatible bundle., xrefs: 006C9398
detect.cpp, xrefs: 006C938E
comres.dll, xrefs: 006C93B0
Failed to initialize update bundle., xrefs: 006C93D1

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CompareString
String ID: BA aborted detect forward compatible bundle.$Failed to initialize update bundle.$comres.dll$detect.cpp
API String ID: 1825529933-439563586
Opcode ID: 5cebc24dc81869ade1254a13e71a1f63ef4df55b3fb33f66d7293ad239db8cb9
Instruction ID: 536e5a086106c23c4ec88dfcecc96eea619dc2c5bcdfff254935aece94fb4564
Opcode Fuzzy Hash: 5cebc24dc81869ade1254a13e71a1f63ef4df55b3fb33f66d7293ad239db8cb9
Instruction Fuzzy Hash: 06519D71600211BBDF159F64CC89FBAB7A7FF06310F14425DF9289A2A1C771E961DBA0

Function 006BD437 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,?,00000001,006EB500,?,00000001,000000FF,?,?,75A8B390,00000000,00000001,00000000,?,006B74E6), ref: 006BD560

Strings

Failed to create pipe and cache pipe., xrefs: 006BD4BD
Failed to elevate., xrefs: 006BD542
Failed to connect to elevated child process., xrefs: 006BD549
elevation.cpp, xrefs: 006BD46B
UX aborted elevation requirement., xrefs: 006BD475
Failed to create pipe name and client token., xrefs: 006BD4A1

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseHandle
String ID: Failed to connect to elevated child process.$Failed to create pipe and cache pipe.$Failed to create pipe name and client token.$Failed to elevate.$UX aborted elevation requirement.$elevation.cpp
API String ID: 2962429428-3003415917
Opcode ID: 61d0010b948f3b82001357b9d7cb49e7a6fef7691482e3e777ad314664ac5a04
Instruction ID: b6e54469632a3d7457188d9432afd18a01b0cb7ac5a710d3816ce7bb25079a8a
Opcode Fuzzy Hash: 61d0010b948f3b82001357b9d7cb49e7a6fef7691482e3e777ad314664ac5a04
Instruction Fuzzy Hash: 44316BF36447257BE721A664CC47FFA735FAF01324F104209FA05AE181EA61AE8087D9

Function 006E0523 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0070B5FC,00000000,?,?,?,006B4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,006A54FA,?), ref: 006E0533
CreateFileW.KERNEL32(40000000,00000001,00000000,00000000,00000080,00000000,?,00000000,?,?,?,0070B5F4,?,006B4207,00000000,Setup), ref: 006E05D7
GetLastError.KERNEL32(?,006B4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,006A54FA,?,?,?), ref: 006E05E7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,006B4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,006A54FA,?), ref: 006E0621

Part of subcall function 006A2DBF: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 006A2F09

LeaveCriticalSection.KERNEL32(0070B5FC,?,?,0070B5F4,?,006B4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,006A54FA,?), ref: 006E067A

Strings

logutil.cpp, xrefs: 006E0606

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
String ID: logutil.cpp
API String ID: 4111229724-3545173039
Opcode ID: 037362fa589c7e06d3ede25d66b97d888aefab71b0edb25f206c5de72a8cb561
Instruction ID: b718f0aca39b50655287a089e83234cded3e757c5b13239facf6c23a9ab5ae26
Opcode Fuzzy Hash: 037362fa589c7e06d3ede25d66b97d888aefab71b0edb25f206c5de72a8cb561
Instruction Fuzzy Hash: 40310C7190239AFFEB119F629D45F9E776BEF00754F004264F900AB2A0DBB4DDA09B94

Function 006C398D Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 112COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006C39F4

Strings

Failed to append property string part., xrefs: 006C3A68
%s%="%s", xrefs: 006C3A27
Failed to escape string., xrefs: 006C3A76
Failed to format property string part., xrefs: 006C3A6F
Failed to format property value., xrefs: 006C3A7D

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Open@16
String ID: %s%="%s"$Failed to append property string part.$Failed to escape string.$Failed to format property string part.$Failed to format property value.
API String ID: 3613110473-515423128
Opcode ID: e9eacbe5e31e77e8594020c29b46ead72871243f505d25f2c354edb798a77cd9
Instruction ID: 866d8ab633ef488cf6fa0d8aa7b9fb4b66a65d9cd513853c7749fa62c36bb338
Opcode Fuzzy Hash: e9eacbe5e31e77e8594020c29b46ead72871243f505d25f2c354edb798a77cd9
Instruction Fuzzy Hash: 9B31913290422AAFCB15AE98CC41FBEB76AEB00710F10816EF91166351E7709F60DB94

Function 006E41E5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

MoveFileExW.KERNEL32(00000003,00000001,00000000,00000000,00000101,?,006E432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,006BA063,00000001), ref: 006E4203
GetLastError.KERNEL32(00000002,?,006E432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,006BA063,00000001,000007D0,00000001,00000001,00000003), ref: 006E4212
MoveFileExW.KERNEL32(00000003,00000001,00000000,00000001,00000000,?,006E432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,006BA063,00000001), ref: 006E42A6
GetLastError.KERNEL32(?,006E432E,00000003,00000001,00000001,000007D0,00000003,00000000,?,006BA063,00000001,000007D0,00000001), ref: 006E42B0

Part of subcall function 006E4440: FindFirstFileW.KERNEL32(006C923A,?,00000100,00000000,00000000), ref: 006E447B
Part of subcall function 006E4440: FindClose.KERNEL32(00000000), ref: 006E4487

Strings

\, xrefs: 006E4265
fileutil.cpp, xrefs: 006E42CF

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: File$ErrorFindLastMove$CloseFirst
String ID: \$fileutil.cpp
API String ID: 3479031965-1689471480
Opcode ID: a5e09b98a4ceb1b9a99e4d5996c2e5ac3a4ee63178435dc4b64745cec366bcc5
Instruction ID: 1440ca86d06eb5413a94c1283a4e50dc153265c7a20d24c6e53181631f70ab92
Opcode Fuzzy Hash: a5e09b98a4ceb1b9a99e4d5996c2e5ac3a4ee63178435dc4b64745cec366bcc5
Instruction Fuzzy Hash: C731A236A033A69FDB215FB78C406AF7667BF51760B218129FE04AB350DB708E4196D0

Function 006A732C Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,?,?,006A5932,00000100,00000100,00000000,00000000,00000001,00000000,00000100), ref: 006A733E
LeaveCriticalSection.KERNEL32(00000000,00000000,00000100,00000000,?,?,?,006A5932,00000100,00000100,00000000,00000000,00000001,00000000,00000100), ref: 006A741D

Strings

Failed to get variable: %ls, xrefs: 006A737F
*****, xrefs: 006A73D9, 006A73E6
Failed to get unformatted string., xrefs: 006A73AE
Failed to get value as string for variable: %ls, xrefs: 006A740C
Failed to format value '%ls' of variable: %ls, xrefs: 006A73E7

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: *****$Failed to format value '%ls' of variable: %ls$Failed to get unformatted string.$Failed to get value as string for variable: %ls$Failed to get variable: %ls
API String ID: 3168844106-2873099529
Opcode ID: 989924aa5a2bb68acb15240b56ae67f6db66eea80ec7fd9511cb6219a22b102c
Instruction ID: ac848f44c4e2eb06d5d78aeccf01ccc7ea26bf02da024b9b5d3a1fb955753623
Opcode Fuzzy Hash: 989924aa5a2bb68acb15240b56ae67f6db66eea80ec7fd9511cb6219a22b102c
Instruction Fuzzy Hash: 4B31AD3290575AFBDF217F40CC05BAE7BA6EF1A321F114129F904AA250D371AE61AFD4

Function 006B8DEC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

InitializeAcl.ADVAPI32(?,00000008,00000002,0000001A,00000000,?,00000000,00000000,?,?,00000000), ref: 006B8E37
GetLastError.KERNEL32 ref: 006B8E41
SetFileAttributesW.KERNEL32(?,00000080,?,00000001,20000004,00000000,00000000,?,00000000,00000003,000007D0,?,00000000,00000000,?,?), ref: 006B8EA1

Strings

Failed to initialize ACL., xrefs: 006B8E6F
cache.cpp, xrefs: 006B8E65
Failed to allocate administrator SID., xrefs: 006B8E1D

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AttributesErrorFileInitializeLast
String ID: Failed to allocate administrator SID.$Failed to initialize ACL.$cache.cpp
API String ID: 669721577-1117388985
Opcode ID: 45ed7795d4a177371738fbff978066ebac12d18acb71059eba279227da3d7482
Instruction ID: 37325a6b2ae1df8e377717f6a0c974c51e7b52849c111d585bacc28e59bbbc45
Opcode Fuzzy Hash: 45ed7795d4a177371738fbff978066ebac12d18acb71059eba279227da3d7482
Instruction Fuzzy Hash: 2221DB72A40325BBDB205AD59C85FDFB76FAB44B20F114029FE04FB280DA749E01C794

Function 006A4212 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000000,00000000,?,00000000,crypt32.dll,?,?,006B4028,00000001,feclient.dll,?,00000000,?,?,?,006A4B12), ref: 006A424D
GetLastError.KERNEL32(?,?,006B4028,00000001,feclient.dll,?,00000000,?,?,?,006A4B12,?,?,006EB488,?,00000001), ref: 006A4259
GetCurrentDirectoryW.KERNEL32(00000000,?,?,00000000,?,?,006B4028,00000001,feclient.dll,?,00000000,?,?,?,006A4B12,?), ref: 006A4294
GetLastError.KERNEL32(?,?,006B4028,00000001,feclient.dll,?,00000000,?,?,?,006A4B12,?,?,006EB488,?,00000001), ref: 006A429E

Strings

dirutil.cpp, xrefs: 006A42C2
crypt32.dll, xrefs: 006A4216

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CurrentDirectoryErrorLast
String ID: crypt32.dll$dirutil.cpp
API String ID: 152501406-1104880720
Opcode ID: ef361c6ff9ec84fc20cfeef6214eac4d91efa1f0b4f8969b25151ec392bac589
Instruction ID: cffcd444afb5ac561f2b69d53597bacd1d8b8c8b206015738ef4ad28cc4a0e1d
Opcode Fuzzy Hash: ef361c6ff9ec84fc20cfeef6214eac4d91efa1f0b4f8969b25151ec392bac589
Instruction Fuzzy Hash: 0D119A77E01737AB97217AD54C8479BBA9AAF877A17110169FD00EB350EF60DE008EE4

Function 006C0B8E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74fileCOMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 006C0BDE
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 006C0BFD
GetLastError.KERNEL32 ref: 006C0C07

Strings

cabextract.cpp, xrefs: 006C0C2B
Failed to write during cabinet extraction., xrefs: 006C0C35
Unexpected call to CabWrite()., xrefs: 006C0BC1

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFileLastWrite_memcpy_s
String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$cabextract.cpp
API String ID: 1970631241-3111339858
Opcode ID: 9b89b8dfe3ca101d6bae4ac6ddb7c3e91ee0b61b03ae73565db02a8928c5a9f3
Instruction ID: 40f0f1157e8bc95664028243d1caa15aeec056b79e56de517d7e2ef415d8ed7c
Opcode Fuzzy Hash: 9b89b8dfe3ca101d6bae4ac6ddb7c3e91ee0b61b03ae73565db02a8928c5a9f3
Instruction Fuzzy Hash: 9721C276500205EBDB10DF9CD985EBA37AAEF89320B21415DFE14C7351D671DD009B60

Function 006A9AE0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 72COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006A9AFB
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,00000000,?,006AA8B4,00000100,000002C0,000002C0,00000100), ref: 006A9B10
GetLastError.KERNEL32(?,006AA8B4,00000100,000002C0,000002C0,00000100), ref: 006A9B1B

Strings

Failed to set variable., xrefs: 006A9B7A
Failed while searching directory search: %ls, for path: %ls, xrefs: 006A9B54
Failed to format variable string., xrefs: 006A9B06

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-402580132
Opcode ID: d8450c97196bce968ed7ad0e284cd2dc639c0894c1181a8ce518575770b35cc4
Instruction ID: 1f9902150f6d827918afc1025f312ca4edf4c415922978b124e53b3be8aeceed
Opcode Fuzzy Hash: d8450c97196bce968ed7ad0e284cd2dc639c0894c1181a8ce518575770b35cc4
Instruction Fuzzy Hash: 1D110A32941676FBDB223698AC42FAFB65BDF02370F310315F9106619087615E50AEF4

Function 006C0C57 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 006C0CC4
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 006C0CD6
SetFileTime.KERNEL32(?,?,?,?), ref: 006C0CE9
CloseHandle.KERNEL32(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,006C08B1,?,?), ref: 006C0CF8

Strings

cabextract.cpp, xrefs: 006C0C93
Invalid operation for this state., xrefs: 006C0C9D

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Time$File$CloseDateHandleLocal
String ID: Invalid operation for this state.$cabextract.cpp
API String ID: 609741386-1751360545
Opcode ID: 46975aaa00076bdc5b980f8e317073f6a9e6428017cd3719e275127f9b12e5c1
Instruction ID: 862fb98d4baf2703ea74a0ceebe6bee3817dcae3f20a3c0fd79f61fc28bbc43f
Opcode Fuzzy Hash: 46975aaa00076bdc5b980f8e317073f6a9e6428017cd3719e275127f9b12e5c1
Instruction Fuzzy Hash: A621F67180121AEF9B109FA8CD49DFA7BAEFF04720710421AF565D6290D374EA11CB90

Function 006B4A77 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,crypt32.dll,00000000,00000000,00000000,?,006B539D), ref: 006B4AC3

Strings

Failed to write message type to pipe., xrefs: 006B4B05
pipe.cpp, xrefs: 006B4AFB
Failed to allocate message to write., xrefs: 006B4AA2
crypt32.dll, xrefs: 006B4A7D

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: FileWrite
String ID: Failed to allocate message to write.$Failed to write message type to pipe.$crypt32.dll$pipe.cpp
API String ID: 3934441357-606776022
Opcode ID: 0f66d73fea9bfa6e812b5562dae66e330e54d0eef0646d6f46bc965fef3d7c7f
Instruction ID: 6f026304cc383073d9a77da24c9a55cf89f5c4cd8144b6079971dab189ea1721
Opcode Fuzzy Hash: 0f66d73fea9bfa6e812b5562dae66e330e54d0eef0646d6f46bc965fef3d7c7f
Instruction Fuzzy Hash: A511A2B2940229BBDB21DF85DD45AEF7BAAEF40750F110065FE00B6251DF309E90D7A5

Function 006B4642 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 006A394F: GetProcessHeap.KERNEL32(?,000001C7,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3960
Part of subcall function 006A394F: RtlAllocateHeap.NTDLL(00000000,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3967

_memcpy_s.LIBCMT ref: 006B4693
_memcpy_s.LIBCMT ref: 006B46A6
_memcpy_s.LIBCMT ref: 006B46C1

Strings

Failed to allocate memory for message., xrefs: 006B467C
pipe.cpp, xrefs: 006B4672
feclient.dll, xrefs: 006B465B, 006B4691

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: _memcpy_s$Heap$AllocateProcess
String ID: Failed to allocate memory for message.$feclient.dll$pipe.cpp
API String ID: 886498622-766083570
Opcode ID: fde601f8641564ce733cd8a698da2b56ecba13ed0694f27a587438c8a36577d0
Instruction ID: f0bb1868ddba64bd31bedd8e3bed0ad62605f4bc1190b67b4a8670c0e0be5bb3
Opcode Fuzzy Hash: fde601f8641564ce733cd8a698da2b56ecba13ed0694f27a587438c8a36577d0
Instruction Fuzzy Hash: EB11A7B210031EABDB01EE94CC82CEB73AEEF16710B00455AFA10DB241EB71DA54CBE4

Function 006E3C72 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 006E3CC0
GetLastError.KERNEL32(?,?,00000000), ref: 006E3CCA
CloseHandle.KERNEL32(?,?,?,00000000), ref: 006E3CFD

Strings

PDGu, xrefs: 006E3CC0
<, xrefs: 006E3CB2
shelutil.cpp, xrefs: 006E3CEB

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseErrorExecuteHandleLastShell
String ID: <$PDGu$shelutil.cpp
API String ID: 3023784893-1811064489
Opcode ID: 5d4afd7351661733a1be2ba765ca629bb8e9db3dd2ffaf70747d5947decbe966
Instruction ID: 1be095e7783e5b4935bc3e6edd433ec1cd988fc4ad28ac02d28e5fabd8df8eab
Opcode Fuzzy Hash: 5d4afd7351661733a1be2ba765ca629bb8e9db3dd2ffaf70747d5947decbe966
Instruction Fuzzy Hash: 5A11C5B5E01369ABCB10DFA9D949A9E7BF9AB08750F104119FD15E7340E6349A108BA4

Function 006E96CD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

Strings

AcquireSRWLockExclusive, xrefs: 006E96FC
KERNEL32.DLL, xrefs: 006E96E7
ReleaseSRWLockExclusive, xrefs: 006E970C

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: a7f91c9289198796a1c6c2cbd2f9f9ba521fbe11afbf013514c454ef168d67d5
Instruction ID: 7c2f9b23fbf251feaa37ba5bed2baa759f400f89d8a2d38b8d0623630828646b
Opcode Fuzzy Hash: a7f91c9289198796a1c6c2cbd2f9f9ba521fbe11afbf013514c454ef168d67d5
Instruction Fuzzy Hash: 3A0149B16533E3CB9F214E671CD45D723C64E013913201277D421C3340EB15D949DAB0

Function 006E0ACC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,006A5EB2,00000000), ref: 006E0AE0
GetProcAddress.KERNEL32(00000000), ref: 006E0AE7
GetLastError.KERNEL32(?,?,?,006A5EB2,00000000), ref: 006E0AFE

Strings

kernel32, xrefs: 006E0AD8
IsWow64Process, xrefs: 006E0AD1
procutil.cpp, xrefs: 006E0B1F

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: IsWow64Process$kernel32$procutil.cpp
API String ID: 4275029093-1586155540
Opcode ID: cf98e16ef24f8006c0b9e7afb3645341f6aba55a66862aa25d878fdb28073477
Instruction ID: 5462b4d319b8ffe5d40a07b73021d93ae36b32cc47d1428338879b255347d7b1
Opcode Fuzzy Hash: cf98e16ef24f8006c0b9e7afb3645341f6aba55a66862aa25d878fdb28073477
Instruction Fuzzy Hash: 84F0A472A01379A797219B968C4999FBAAABB04B50B110154BD14AB380EBB5DD4087D4

Function 006B9287 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 139COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 006B93C9

Part of subcall function 006E56CF: GetLastError.KERNEL32(?,?,006B933A,?,00000003,00000000,?), ref: 006E56EE

Strings

yTj, xrefs: 006B9287
Failed to find expected public key in certificate chain., xrefs: 006B938A
cache.cpp, xrefs: 006B93ED
Failed to get certificate public key identifier., xrefs: 006B93F7
Failed to read certificate thumbprint., xrefs: 006B93BD

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to find expected public key in certificate chain.$Failed to get certificate public key identifier.$Failed to read certificate thumbprint.$cache.cpp$yTj
API String ID: 1452528299-3846268470
Opcode ID: 47ce0212a923ba3f669f00c3e1fdd31e3ba8bd44d0105367b54ea76f34beeca2
Instruction ID: 25e6b5a57a6c5c67e6ebd62a84772ac0e938d66e5fee53b027d8889d7c6d5727
Opcode Fuzzy Hash: 47ce0212a923ba3f669f00c3e1fdd31e3ba8bd44d0105367b54ea76f34beeca2
Instruction Fuzzy Hash: 214130B2E00619ABDB50DBA5C841AEEB7FAAF08710F054169FB05E7291D774ED40CBB4

Function 006B8CAC Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 122sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0,00000000,00000000), ref: 006B8D18

Strings

per-user, xrefs: 006B8D72, 006B8D77, 006B8DB2, 006B8DB7
per-machine, xrefs: 006B8D69, 006B8DA9
Failed to get old %hs package cache root directory., xrefs: 006B8DB8
Failed to get %hs package cache root directory., xrefs: 006B8D78
Failed to calculate cache path., xrefs: 006B8CD5

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Sleep
String ID: Failed to calculate cache path.$Failed to get %hs package cache root directory.$Failed to get old %hs package cache root directory.$per-machine$per-user
API String ID: 3472027048-398165853
Opcode ID: 11b2d92dade0ee4dfe482708e4a676fd080fe553124dbaa7d00ac4fd2fa4594a
Instruction ID: 26ccedcccaa1d9e3723d8fb81d0376893e5b344382d784fef6c123884b74fd47
Opcode Fuzzy Hash: 11b2d92dade0ee4dfe482708e4a676fd080fe553124dbaa7d00ac4fd2fa4594a
Instruction Fuzzy Hash: BF31B6B2940229BFDB12AA54CD46BFE666F9F20710F11402AFD01B7291DA749D80D7A5

Function 006BE956 Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000082,?,?), ref: 006BE985
SetWindowLongW.USER32(?,000000EB,00000000), ref: 006BE994
SetWindowLongW.USER32(?,000000EB,?), ref: 006BE9A8
DefWindowProcW.USER32(?,?,?,?), ref: 006BE9B8
GetWindowLongW.USER32(?,000000EB), ref: 006BE9D2
PostQuitMessage.USER32(00000000), ref: 006BEA31

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Window$Long$Proc$MessagePostQuit
String ID:
API String ID: 3812958022-0
Opcode ID: ae03c48707106ae2119bbbd5eb79c0cb55800912c76da9055a4a307b8398c850
Instruction ID: 6af363ae6f4c635d41b5d65806d687a0a295afa3df2150e870f4061158d93fbf
Opcode Fuzzy Hash: ae03c48707106ae2119bbbd5eb79c0cb55800912c76da9055a4a307b8398c850
Instruction Fuzzy Hash: F52190B1104258BFDB11AF68DC89EEA3B6BFF45310F145618F9069A2A4C732DD50DB50

Function 006BC7C9 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 164synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(?), ref: 006BC811
CloseHandle.KERNEL32(?), ref: 006BC819

Strings

Failed to save state., xrefs: 006BC891
Unexpected elevated message sent to child process, msg: %u, xrefs: 006BC9C4
elevation.cpp, xrefs: 006BC9B8

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseHandleMutexRelease
String ID: Failed to save state.$Unexpected elevated message sent to child process, msg: %u$elevation.cpp
API String ID: 4207627910-1576875097
Opcode ID: 602f60980af3b80f5d0ceeee792138d8b36aec74266dd09dcff1bf682603909d
Instruction ID: c4f4383dd48fa4a0082a2af14f51d174270086e5ce2591996a4edfd9a8e8b781
Opcode Fuzzy Hash: 602f60980af3b80f5d0ceeee792138d8b36aec74266dd09dcff1bf682603909d
Instruction Fuzzy Hash: C561E8BA500514FFDB126F84CD01CA5BBB3FF483247118459FA995A632C732EA61EF45

Function 006E7B16 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 006A394F: GetProcessHeap.KERNEL32(?,000001C7,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3960
Part of subcall function 006A394F: RtlAllocateHeap.NTDLL(00000000,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3967

SysFreeString.OLEAUT32(00000000), ref: 006E7C74
SysFreeString.OLEAUT32(00000000), ref: 006E7C7F
SysFreeString.OLEAUT32(00000000), ref: 006E7C8A

Strings

atomutil.cpp, xrefs: 006E7B49
`)u, xrefs: 006E7C69

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: `)u$atomutil.cpp
API String ID: 2724874077-2257618704
Opcode ID: 1077e27d10ac257826fe7f367b0d5f9ee8352581ed3633746c77a93ab8026789
Instruction ID: 67c2dc9ad2b684cc6782bbe898574eac99cbc4c2afff0ed30be59f3d05d96652
Opcode Fuzzy Hash: 1077e27d10ac257826fe7f367b0d5f9ee8352581ed3633746c77a93ab8026789
Instruction Fuzzy Hash: 3D51627190636AAFDB21DB65C844EAEB7BEAF04B10F254198E915AB250D771ED00CBA0

Function 006E1217 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 150registrystringCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 006E123F
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,006B70E8,00000100,000000B0,00000088,00000410,000002C0), ref: 006E1276
lstrlenW.KERNEL32(?,?,?,00000000,?,-00000001,00000004,00000000), ref: 006E136E

Strings

regutil.cpp, xrefs: 006E12BF
BundleUpgradeCode, xrefs: 006E121E

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: QueryValue$lstrlen
String ID: BundleUpgradeCode$regutil.cpp
API String ID: 3790715954-1648651458
Opcode ID: 49f07b82f404581f3174f5f9675c979be2fd8a8f45a835ec259ed570fa8272d0
Instruction ID: 717422081f3539f9679016915d5f6a3102c0b90e9586a5168c37c077da228b01
Opcode Fuzzy Hash: 49f07b82f404581f3174f5f9675c979be2fd8a8f45a835ec259ed570fa8272d0
Instruction Fuzzy Hash: E541D535A0235AEFCB219F96C8409EE77ABAF46710F154169F901EF740D6309E01EBA4

Function 006E6357 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 130fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006E490D: SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,006B8770,00000000,00000000,00000000,00000000,00000000), ref: 006E4925
Part of subcall function 006E490D: GetLastError.KERNEL32(?,?,?,006B8770,00000000,00000000,00000000,00000000,00000000), ref: 006E492F

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,006E5C09,?,?,?,?,?,?,?,00010000,?), ref: 006E63C0
WriteFile.KERNEL32(000000FF,00000008,00000008,?,00000000,000000FF,00000000,00000000,00000000,00000000,?,006E5C09,?,?,?,?), ref: 006E6412
GetLastError.KERNEL32(?,006E5C09,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 006E6458
GetLastError.KERNEL32(?,006E5C09,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 006E647E

Strings

dlutil.cpp, xrefs: 006E64A2

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFileLast$Write$Pointer
String ID: dlutil.cpp
API String ID: 133221148-2067379296
Opcode ID: 2f2c2ba1bb9d4db8dba77bc43db75d8e0db42f4d734b778dae517415e4a6cda5
Instruction ID: 0a632f0db6427bd104f3b039d7c5aa6c3085b65396f83e02bbcf43fbf3454efa
Opcode Fuzzy Hash: 2f2c2ba1bb9d4db8dba77bc43db75d8e0db42f4d734b778dae517415e4a6cda5
Instruction Fuzzy Hash: 2741A172902359FFDB218E95CD44BEA7BAAEF143A0F118125FD00A6190E771DC10DBA0

Function 006A2428 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000000,006DFFEF,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,006DFFEF,006C12CF,?,00000000), ref: 006A246E
GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,006DFFEF,006C12CF,?,00000000,0000FDE9,?,006C12CF), ref: 006A247A

Part of subcall function 006A3BD3: GetProcessHeap.KERNEL32(00000000,000001C7,?,006A21CC,000001C7,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3BDB
Part of subcall function 006A3BD3: HeapSize.KERNEL32(00000000,?,006A21CC,000001C7,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3BE2

Strings

strutil.cpp, xrefs: 006A249E

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: strutil.cpp
API String ID: 3662877508-3612885251
Opcode ID: 9f19f04bf0169a69470aca783d719a0769acf1651a7e9ad5bd0b229a2c6a488f
Instruction ID: 08d01d460b9462975e31c64d813d0ac78be60aa8e4a65512c0c3a6a289e00eba
Opcode Fuzzy Hash: 9f19f04bf0169a69470aca783d719a0769acf1651a7e9ad5bd0b229a2c6a488f
Instruction Fuzzy Hash: 4B31B731280217AFA710BE6DCCE49A637DBFB5A3647104229FA119B2A0E771DC119F60

Function 006D922B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,ECE85006,006D2444,00000000,00000000,006D3479,?,y4m,?,00000001,006D2444,ECE85006,00000001,006D3479,006D3479), ref: 006D9278
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 006D9301
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 006D9313
__freea.LIBCMT ref: 006D931C

Part of subcall function 006D521A: HeapAlloc.KERNEL32(00000000,?,?,?,006D1F87,?,0000015D,?,?,?,?,006D33E0,000000FF,00000000,?,?), ref: 006D524C

Strings

y4m, xrefs: 006D923E

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__freea
String ID: y4m
API String ID: 573072132-742941919
Opcode ID: 55874b94d19e0bb7d85216a5dfe235a75b7f2457d7f941560ea4eee84d417d4e
Instruction ID: 768b4cae7f73624ff6887c0ee88d6f61c3886fd4019df807c4f6aa8fca024231
Opcode Fuzzy Hash: 55874b94d19e0bb7d85216a5dfe235a75b7f2457d7f941560ea4eee84d417d4e
Instruction Fuzzy Hash: 32319C32E1020AABDB259F64CC81EEE7BA6EB41310F05412AFC04DB394E735CD91CBA0

Function 006CAD44 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 107COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,?,000000FF,?,00000000,?,?,?,00000000,00000000,?,?,00000000), ref: 006CADB3

Strings

Failed to extract payload: %ls from container: %ls, xrefs: 006CAE3E
Failed to open container: %ls., xrefs: 006CAD85
Failed to extract all payloads from container: %ls, xrefs: 006CADF7
Failed to skip the extraction of payload: %ls from container: %ls, xrefs: 006CAE4A

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CompareString
String ID: Failed to extract all payloads from container: %ls$Failed to extract payload: %ls from container: %ls$Failed to open container: %ls.$Failed to skip the extraction of payload: %ls from container: %ls
API String ID: 1825529933-3891707333
Opcode ID: 43a7ceb3fb7441e6567cac55ed3fc13f73a6bb7aecbeb92002669a3ec175d796
Instruction ID: dc7d241cee43c6cfb4586de212919b730f19c2cdb3ed36c2885c76ec2f72945b
Opcode Fuzzy Hash: 43a7ceb3fb7441e6567cac55ed3fc13f73a6bb7aecbeb92002669a3ec175d796
Instruction Fuzzy Hash: 4531E632C0021DABCF21AAE4CC45FEE776BEF08724F114119FA11A6191E731AE55EBE5

Function 006E7A10 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 006A394F: GetProcessHeap.KERNEL32(?,000001C7,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3960
Part of subcall function 006A394F: RtlAllocateHeap.NTDLL(00000000,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3967

SysFreeString.OLEAUT32(00000000), ref: 006E7AF4
SysFreeString.OLEAUT32(?), ref: 006E7AFF
SysFreeString.OLEAUT32(00000000), ref: 006E7B0A

Strings

atomutil.cpp, xrefs: 006E7A3D
`)u, xrefs: 006E7AE9

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: `)u$atomutil.cpp
API String ID: 2724874077-2257618704
Opcode ID: e390d194c652037f63111c9e416d95768fb389691715da742bb48d71e89ce4a1
Instruction ID: 9367930ce29e550ff65254fddcebd9227e6e0d4f41fd665e7c307079ad81ea09
Opcode Fuzzy Hash: e390d194c652037f63111c9e416d95768fb389691715da742bb48d71e89ce4a1
Instruction Fuzzy Hash: 8F318732D0636ABBCB11AB99CC45E9EBBBAEF00754F114165FA00AB250D7709E019BD4

Function 006AF005 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 96registryCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000001,000000FF,?,000000FF,00000001,PackageVersion,00000001,?,006B0654,00000001,00000001,00000001,006B0654,00000000), ref: 006AF07D
RegCloseKey.ADVAPI32(00000000,00000001,PackageVersion,00000001,?,006B0654,00000001,00000001,00000001,006B0654,00000000,00000001,00000000,?,006B0654,00000001), ref: 006AF09A

Strings

Failed to format key for update registration., xrefs: 006AF033
Failed to remove update registration key: %ls, xrefs: 006AF0C7
PackageVersion, xrefs: 006AF05E

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseCompareString
String ID: Failed to format key for update registration.$Failed to remove update registration key: %ls$PackageVersion
API String ID: 446873843-3222553582
Opcode ID: 4527ea28374fa662532ee0d6e2960035482713cb25915a5c018017c78db92b63
Instruction ID: 65e94509dcb82b59e5b2de077755ff88e2a291c5d59dfd5a0952124cf47d4f73
Opcode Fuzzy Hash: 4527ea28374fa662532ee0d6e2960035482713cb25915a5c018017c78db92b63
Instruction Fuzzy Hash: 0621B431901269BBDB21ABA5CC49FAFBEBADF06720F100265FD10E6151E7314E40CA95

Function 006E433D Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 95registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006E4440: FindFirstFileW.KERNEL32(006C923A,?,00000100,00000000,00000000), ref: 006E447B
Part of subcall function 006E4440: FindClose.KERNEL32(00000000), ref: 006E4487

RegCloseKey.ADVAPI32(?,00000000,?,00000000,?,00000000,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 006E4430

Part of subcall function 006E0F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,0070AAA0,00000000,?,006E57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 006E0F80

Part of subcall function 006E1217: RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 006E123F
Part of subcall function 006E1217: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,006B70E8,00000100,000000B0,00000088,00000410,000002C0), ref: 006E1276

Strings

PendingFileRenameOperations, xrefs: 006E439B
\, xrefs: 006E43B9
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 006E436F
crypt32.dll, xrefs: 006E4368

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseFindQueryValue$FileFirstOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager$\$crypt32.dll
API String ID: 3397690329-3978359083
Opcode ID: fa53a828364f62cbd12353a05a3518275c4759103dfa3916be8feec3d1a6d96f
Instruction ID: 41d315c3798a664542248364fe312c92eff82939381888e77699b190bdd6dd1f
Opcode Fuzzy Hash: fa53a828364f62cbd12353a05a3518275c4759103dfa3916be8feec3d1a6d96f
Instruction Fuzzy Hash: E431A431A02359EBDF21AFA7CC41AEEB7B6EF00750F548179E904A6291EB319E54CB50

Function 006E4019 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,006A4DBC,00000000,?,?,00000000,?,006E412D,00000000,006A4DBC,00000000,00000000,?,006B85EE,?,?), ref: 006E4033
GetLastError.KERNEL32(?,006E412D,00000000,006A4DBC,00000000,00000000,?,006B85EE,?,?,00000001,00000003,000007D0,?,?,?), ref: 006E4041
CopyFileW.KERNEL32(00000000,006A4DBC,00000000,006A4DBC,00000000,?,006E412D,00000000,006A4DBC,00000000,00000000,?,006B85EE,?,?,00000001), ref: 006E40AC
GetLastError.KERNEL32(?,006E412D,00000000,006A4DBC,00000000,00000000,?,006B85EE,?,?,00000001,00000003,000007D0,?,?,?), ref: 006E40B6

Strings

fileutil.cpp, xrefs: 006E40D5

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CopyErrorFileLast
String ID: fileutil.cpp
API String ID: 374144340-2967768451
Opcode ID: d8dcaafb5325ee7c79ab50b46aaa5e0eecfc175a76e901b7f87e5cfea0020507
Instruction ID: 38e741e823c9829b533db4ad33640f78453eed2325c0a335565dac209f7921f9
Opcode Fuzzy Hash: d8dcaafb5325ee7c79ab50b46aaa5e0eecfc175a76e901b7f87e5cfea0020507
Instruction Fuzzy Hash: 1821C1266033B297DB301BB74C80BBB669AEF10B60B250135FF04DB251DF548C4082E5

Function 006AEF1B Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006AEF56

Part of subcall function 006E4153: SetFileAttributesW.KERNEL32(006C923A,00000080,00000000,006C923A,000000FF,00000000,?,?,006C923A), ref: 006E4182
Part of subcall function 006E4153: GetLastError.KERNEL32(?,?,006C923A), ref: 006E418C

Part of subcall function 006A3C6B: RemoveDirectoryW.KERNEL32(00000001,00000000,00000000,00000000,?,?,006AEFA1,00000001,00000000,00000095,00000001,006B0663,00000095,00000000,swidtag,00000001), ref: 006A3C88

Strings

Failed to allocate regid file path., xrefs: 006AEFB5
Failed to format tag folder path., xrefs: 006AEFC3
swidtag, xrefs: 006AEF65
Failed to allocate regid folder path., xrefs: 006AEFBC

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AttributesDirectoryErrorFileLastOpen@16Remove
String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to format tag folder path.$swidtag
API String ID: 1428973842-4170906717
Opcode ID: faba7c37f09575f387a4a927b49a52f7c3088b5aea0d14133d2e340f6dd11245
Instruction ID: 22977caf7f87335d3d962870c702d67105ead55ad2301218bded095b0ca37e28
Opcode Fuzzy Hash: faba7c37f09575f387a4a927b49a52f7c3088b5aea0d14133d2e340f6dd11245
Instruction Fuzzy Hash: 25216B31D01618FFCB11AB99CC41AADBBB6EF45310F1180AAF514AA261D7729E41DF54

Function 006C8DB6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006E0F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,0070AAA0,00000000,?,006E57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 006E0F80

CompareStringW.KERNEL32(00000000,00000001,00000000,000000FF,?,000000FF,00000000,00000000,00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4), ref: 006C8E3A
RegCloseKey.ADVAPI32(00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4,?,?,?,006AF7E0,00000001,00000100,000001B4,00000000), ref: 006C8E88

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 006C8DD7
Failed to open uninstall registry key., xrefs: 006C8DFD
Failed to enumerate uninstall key for related bundles., xrefs: 006C8E99

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseCompareOpenString
String ID: Failed to enumerate uninstall key for related bundles.$Failed to open uninstall registry key.$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 2817536665-2531018330
Opcode ID: ee4193d2f99cc47e7740d3cb4bf785583078bcf9acadfcfff88bb59d756eaf7a
Instruction ID: ea2f4982606bee78918e9ff6da06107fee1dd8df1fbd91d2a4563200b6c6d660
Opcode Fuzzy Hash: ee4193d2f99cc47e7740d3cb4bf785583078bcf9acadfcfff88bb59d756eaf7a
Instruction Fuzzy Hash: EF21A63290026CFEDB21AA94CC49FFEBA6BEB04720F15456CF510B7160DB754E90D694

Function 006CD259 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 006A394F: GetProcessHeap.KERNEL32(?,000001C7,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3960
Part of subcall function 006A394F: RtlAllocateHeap.NTDLL(00000000,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3967

WaitForSingleObject.KERNEL32(?,000000FF), ref: 006CD2EE
ReleaseMutex.KERNEL32(?), ref: 006CD31C
SetEvent.KERNEL32(?), ref: 006CD325

Strings

Failed to allocate buffer., xrefs: 006CD29D
NetFxChainer.cpp, xrefs: 006CD293

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Heap$AllocateEventMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate buffer.$NetFxChainer.cpp
API String ID: 944053411-3611226795
Opcode ID: 6337ed093e5a3bfe9329a97e7a3bd9c1ff27d1e8dd9adc2ea97d28e7726b06d0
Instruction ID: 764590d15e523af56dad289648bad3f6e8471f733bb333e6f3ee91cf5906f716
Opcode Fuzzy Hash: 6337ed093e5a3bfe9329a97e7a3bd9c1ff27d1e8dd9adc2ea97d28e7726b06d0
Instruction Fuzzy Hash: AD2194B4600346FFDB10AF68D884AA9B7F6FF49320F108669FA64A7351C775AD508B90

Function 006E5907 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

QueryServiceConfigW.ADVAPI32(00000000,00000000,00000000,?,00000001,00000000,?,?,006C6B11,00000000,?), ref: 006E591D
GetLastError.KERNEL32(?,?,006C6B11,00000000,?,?,?,?,?,?,?,?,?,006C6F28,?,?), ref: 006E592B

Part of subcall function 006A394F: GetProcessHeap.KERNEL32(?,000001C7,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3960
Part of subcall function 006A394F: RtlAllocateHeap.NTDLL(00000000,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3967

QueryServiceConfigW.ADVAPI32(00000000,00000000,?,?,?,00000001,?,?,006C6B11,00000000,?), ref: 006E5965
GetLastError.KERNEL32(?,?,006C6B11,00000000,?,?,?,?,?,?,?,?,?,006C6F28,?,?), ref: 006E596F

Strings

svcutil.cpp, xrefs: 006E594E, 006E5990

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ConfigErrorHeapLastQueryService$AllocateProcess
String ID: svcutil.cpp
API String ID: 355237494-1746323212
Opcode ID: b1b4563daa90b10238bdd20eddbab9d11b39c8555e91f775183cfee4eddce861
Instruction ID: aa467c3a28c786668617620045c0a458863e05281886566dd034bc50db426c2b
Opcode Fuzzy Hash: b1b4563daa90b10238bdd20eddbab9d11b39c8555e91f775183cfee4eddce861
Instruction Fuzzy Hash: 8C210132A42BF5E7D7306A968D04BDFAA6B9B41B74F110015FD06AB302E7208E0096E5

Function 006E3245 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 006E3258
VariantInit.OLEAUT32(?), ref: 006E3264
VariantClear.OLEAUT32(?), ref: 006E32D8
SysFreeString.OLEAUT32(00000000), ref: 006E32E3

Part of subcall function 006E3498: SysAllocString.OLEAUT32(?), ref: 006E34AD

Strings

`)u, xrefs: 006E32E3

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: String$AllocVariant$ClearFreeInit
String ID: `)u
API String ID: 347726874-4279031584
Opcode ID: 67e79b440f6548d0d037fc610e82a177c059c3c7a2b378783a9d188124426ead
Instruction ID: 0e089a5dd331c5b29a40dff0df9e3a09550fab9a3a04ab2a0d1f569fa5ddfc85
Opcode Fuzzy Hash: 67e79b440f6548d0d037fc610e82a177c059c3c7a2b378783a9d188124426ead
Instruction Fuzzy Hash: 6C213931A02369AFCB15DBA5C89CEAFBBBAEF48715F104158E9019B320D7319E05CB90

Function 006A9839 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 006A98C8

Strings

condition.cpp, xrefs: 006A986A, 006A98AB
Failed to read next symbol., xrefs: 006A98E4
Failed to find variable., xrefs: 006A98B5
Failed to parse condition '%ls' at position: %u, xrefs: 006A987A

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: _memcpy_s
String ID: Failed to find variable.$Failed to parse condition '%ls' at position: %u$Failed to read next symbol.$condition.cpp
API String ID: 2001391462-1605196437
Opcode ID: 397d1f54efb121f28a73757f63042ba39911288206a63d34a0d841f5d8c8866b
Instruction ID: 089dd9cda9970067d57ec0d72f735e25ee97966ebf4cf6b08ddc9a5cbbed1228
Opcode Fuzzy Hash: 397d1f54efb121f28a73757f63042ba39911288206a63d34a0d841f5d8c8866b
Instruction Fuzzy Hash: 061127321813207AEF653D6D9C8AD9A3A57EF17720F204855F9006E392CAAACD108BF4

Function 006A9E16 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 68COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 006A9E38

Strings

Failed to format path string., xrefs: 006A9E43
Failed get file version., xrefs: 006A9E78
Failed to set variable., xrefs: 006A9E97
File search: %ls, did not find path: %ls, xrefs: 006A9EA3

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Open@16
String ID: Failed get file version.$Failed to format path string.$Failed to set variable.$File search: %ls, did not find path: %ls
API String ID: 3613110473-2458530209
Opcode ID: 55cdfe70865c6d57118010648f27b6f6b2ca62845fc56ccaffc7d9965bb4f31a
Instruction ID: 3cca8f7f3bb34ffc9332ca2b7b14a3f03cfc0f806801801268ac51c9f33bf4b0
Opcode Fuzzy Hash: 55cdfe70865c6d57118010648f27b6f6b2ca62845fc56ccaffc7d9965bb4f31a
Instruction Fuzzy Hash: BC110332D41269BFDF02BE998C418AEFB7AFF01710F21416AF90066212D2325E109FA0

Function 006B820F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 006A394F: GetProcessHeap.KERNEL32(?,000001C7,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3960
Part of subcall function 006A394F: RtlAllocateHeap.NTDLL(00000000,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3967

CreateWellKnownSid.ADVAPI32(00000000,00000000,00000000,00000000,00000044,00000001,00000000,00000000,?,?,006B8E17,0000001A,00000000,?,00000000,00000000), ref: 006B8258
GetLastError.KERNEL32(?,?,006B8E17,0000001A,00000000,?,00000000,00000000,?,?,00000000), ref: 006B8262

Strings

Failed to allocate memory for well known SID., xrefs: 006B8240
Failed to create well known SID., xrefs: 006B8290
cache.cpp, xrefs: 006B8236, 006B8286

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Heap$AllocateCreateErrorKnownLastProcessWell
String ID: Failed to allocate memory for well known SID.$Failed to create well known SID.$cache.cpp
API String ID: 2186923214-2110050797
Opcode ID: 4252602de972b94bf65a3057c5e5fdd71c9c0455126653dc14d6444d3baa61a1
Instruction ID: 5a4372ef3d6df7334db0f40eb779ad6d28baa169ee367f14cbe8d6ed822d91e0
Opcode Fuzzy Hash: 4252602de972b94bf65a3057c5e5fdd71c9c0455126653dc14d6444d3baa61a1
Instruction Fuzzy Hash: 2C01E973542635BBD63166958D0AEEB6A9F8F41B70B11005AFE14AB240EE749E4086E4

Function 006CDDA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000003E8,000004FF), ref: 006CDDCE
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 006CDDF8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,006CDFC8,00000000,?,?,?,?,00000000), ref: 006CDE00

Strings

bitsengine.cpp, xrefs: 006CDE24
Failed while waiting for download., xrefs: 006CDE2E

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLastMessageMultipleObjectsPeekWait
String ID: Failed while waiting for download.$bitsengine.cpp
API String ID: 435350009-228655868
Opcode ID: ca9d61451d65b66c29b8b8f639cba1b0130ad7534bb5c7e915370d3b9ee3a4ff
Instruction ID: bcd7e1b0e6f3e6b99630f6acee4186b1766c476d487f5dc307be374c5ccec1b1
Opcode Fuzzy Hash: ca9d61451d65b66c29b8b8f639cba1b0130ad7534bb5c7e915370d3b9ee3a4ff
Instruction Fuzzy Hash: 0D11C673A41235B7D7205AA99D49FFBBA9EDF09760F100139FE05FB2C1D664AD0086E4

Function 006A5F2E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 59COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000010), ref: 006A5F5C
GetLastError.KERNEL32 ref: 006A5F66

Strings

variable.cpp, xrefs: 006A5F8A
Failed to set variant value., xrefs: 006A5FAD
Failed to get computer name., xrefs: 006A5F94

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ComputerErrorLastName
String ID: Failed to get computer name.$Failed to set variant value.$variable.cpp
API String ID: 3560734967-484636765
Opcode ID: 9c2a65fa2f76edf7a2c5e32ecf4b3b2d66cf2cbbacda3ba6c0044cee9c2c12ac
Instruction ID: 28781e9ad079be3cd684faf449c0ee07c52000f6cffa2c45adf95afd38532549
Opcode Fuzzy Hash: 9c2a65fa2f76edf7a2c5e32ecf4b3b2d66cf2cbbacda3ba6c0044cee9c2c12ac
Instruction Fuzzy Hash: 7111EC33A42668AFD710EA959C05ADE77E99F09720F110155FD01FB240DA75AE044EE5

Function 006A67AA Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 006A67E3
GetLastError.KERNEL32 ref: 006A67ED

Strings

Failed to get temp path., xrefs: 006A681B
variable.cpp, xrefs: 006A6811
Failed to set variant value., xrefs: 006A6837

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLastPathTemp
String ID: Failed to get temp path.$Failed to set variant value.$variable.cpp
API String ID: 1238063741-2915113195
Opcode ID: ad3c17b9e236c2d6893db92a6fa7390b4cbce87a8f9d73d0b17f6a173f4a10dc
Instruction ID: e4c52f253834961d653e9dcf2ecdbba9d10dabc7b61805f41b12238b92a72a12
Opcode Fuzzy Hash: ad3c17b9e236c2d6893db92a6fa7390b4cbce87a8f9d73d0b17f6a173f4a10dc
Instruction Fuzzy Hash: 4501FE72E42339A7D720B7549C0AFAA77AD9B05B10F110169FE14FB2C1EA659D008AE9

Function 006A5E94 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 56COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 006A5EA6

Part of subcall function 006E0ACC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,006A5EB2,00000000), ref: 006E0AE0
Part of subcall function 006E0ACC: GetProcAddress.KERNEL32(00000000), ref: 006E0AE7
Part of subcall function 006E0ACC: GetLastError.KERNEL32(?,?,?,006A5EB2,00000000), ref: 006E0AFE

Part of subcall function 006E3D1F: SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 006E3D4C

Strings

variable.cpp, xrefs: 006A5ED0
Failed to get 64-bit folder., xrefs: 006A5EF0
Failed to set variant value., xrefs: 006A5F0A
Failed to get shell folder., xrefs: 006A5EDA

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AddressCurrentErrorFolderHandleLastModulePathProcProcess
String ID: Failed to get 64-bit folder.$Failed to get shell folder.$Failed to set variant value.$variable.cpp
API String ID: 2084161155-3906113122
Opcode ID: 701f7bff5d1ab63066dfd8215dc0c5b126630cf6dab32bfa7b77c704c933f1fd
Instruction ID: 80e952a6d630752a3978cdd4ef9e524dad4700338ccb34ec062f664ba5d62c97
Opcode Fuzzy Hash: 701f7bff5d1ab63066dfd8215dc0c5b126630cf6dab32bfa7b77c704c933f1fd
Instruction Fuzzy Hash: 8101A531942768BBDF11F791CC0ABAE7A6AAF01720F214159F801BA140DB749E409F95

Function 006E4153 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006E4440: FindFirstFileW.KERNEL32(006C923A,?,00000100,00000000,00000000), ref: 006E447B
Part of subcall function 006E4440: FindClose.KERNEL32(00000000), ref: 006E4487

SetFileAttributesW.KERNEL32(006C923A,00000080,00000000,006C923A,000000FF,00000000,?,?,006C923A), ref: 006E4182
GetLastError.KERNEL32(?,?,006C923A), ref: 006E418C
DeleteFileW.KERNEL32(006C923A,00000000,006C923A,000000FF,00000000,?,?,006C923A), ref: 006E41AC
GetLastError.KERNEL32(?,?,006C923A), ref: 006E41B6

Strings

fileutil.cpp, xrefs: 006E41D1

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: File$ErrorFindLast$AttributesCloseDeleteFirst
String ID: fileutil.cpp
API String ID: 3967264933-2967768451
Opcode ID: cab9b8ef21e61ebffaf6b65ff9fde9404ab8a65a3dba8f7a60c7617f8d592b5e
Instruction ID: 6c1588cae254055c1c0183c1e553d34c005c6d01dbe7900b00785680414898da
Opcode Fuzzy Hash: cab9b8ef21e61ebffaf6b65ff9fde9404ab8a65a3dba8f7a60c7617f8d592b5e
Instruction Fuzzy Hash: CB012232A423B5A7DB314AB78C04BFB7E9AAF207A1F010210FD04EA2D0DB219D8099D0

Function 006CDA05 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 006CDA1A
LeaveCriticalSection.KERNEL32(?), ref: 006CDA5F
SetEvent.KERNEL32(?,?,?,?), ref: 006CDA73

Strings

Failure while sending progress during BITS job modification., xrefs: 006CDA4E
Failed to get state during job modification., xrefs: 006CDA33

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get state during job modification.$Failure while sending progress during BITS job modification.
API String ID: 3094578987-1258544340
Opcode ID: 9a05c158a9180f24e35c0da3a74a7360286241e320cae7f3bd5eefd94c9a96ed
Instruction ID: 48c838d8098f6c3048bb825c4b3b36005235abf6042de28b9f5083e9b3cfeadc
Opcode Fuzzy Hash: 9a05c158a9180f24e35c0da3a74a7360286241e320cae7f3bd5eefd94c9a96ed
Instruction Fuzzy Hash: C101C072605625BBCB11DB95C888FBAB7A9FF04321B004229E90497240D730AA04CAD0

Function 006CDC7E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000008,?,00000000,00000000,00000000,?,006CDDEE), ref: 006CDC92
LeaveCriticalSection.KERNEL32(00000008,?,006CDDEE), ref: 006CDCD7
SetEvent.KERNEL32(?,?,006CDDEE), ref: 006CDCEB

Strings

Failure while sending progress., xrefs: 006CDCC6
Failed to get BITS job state., xrefs: 006CDCAB

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get BITS job state.$Failure while sending progress.
API String ID: 3094578987-2876445054
Opcode ID: caa503261c5a20b4a39bc9aae292e9f8a90a7ce109b159f14f733e23f4ccb1f0
Instruction ID: cf7a6fa6f70751e6c0301010e8160bb7a74f7481eb3feedf2b432affaf98115f
Opcode Fuzzy Hash: caa503261c5a20b4a39bc9aae292e9f8a90a7ce109b159f14f733e23f4ccb1f0
Instruction Fuzzy Hash: F801F572601715FBCB159B45D889EABB7AEFF04320B004269F90497650DB70AD00C7D4

Function 006CD7E8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000008,00000000,00000000,?,006CDF52,?,?,?,?,?,?,00000000,00000000), ref: 006CD802
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,006CDF52,?,?,?,?,?,?,00000000,00000000), ref: 006CD80D
GetLastError.KERNEL32(?,006CDF52,?,?,?,?,?,?,00000000,00000000), ref: 006CD81A

Strings

Failed to create BITS job complete event., xrefs: 006CD848
bitsengine.cpp, xrefs: 006CD83E

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CreateCriticalErrorEventInitializeLastSection
String ID: Failed to create BITS job complete event.$bitsengine.cpp
API String ID: 3069647169-3441864216
Opcode ID: 361b5399ed29d02c185f59c1d5fd17589457b9945d1703857bb30396738a81f7
Instruction ID: 02588a906944c334bd518f55796127b4cbdcb818c12cc40c4349261cec63b838
Opcode Fuzzy Hash: 361b5399ed29d02c185f59c1d5fd17589457b9945d1703857bb30396738a81f7
Instruction Fuzzy Hash: 5A0152B6942722ABD3109B56D845A9BBBE9FF09770B01412AFE08E7640E7749800CBE4

Function 006AD4A8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,006B7040,000000B8,00000000,?,00000000,75A8B390), ref: 006AD4B7
InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 006AD4C6
LeaveCriticalSection.KERNEL32(000000D0,?,006B7040,000000B8,00000000,?,00000000,75A8B390), ref: 006AD4DB

Strings

userexperience.cpp, xrefs: 006AD4F4
Engine active cannot be changed because it was already in that state., xrefs: 006AD4FE

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalSection$CompareEnterExchangeInterlockedLeave
String ID: Engine active cannot be changed because it was already in that state.$userexperience.cpp
API String ID: 3376869089-1544469594
Opcode ID: 4c63fdf4b39c2fd1ca7e8de2fc7d13321dd15b60c72523b3854bc5caa5627780
Instruction ID: 17086482de7bcec42547ccb725d6eb4308e8f6350ce20678c4afa22dfdd9d70e
Opcode Fuzzy Hash: 4c63fdf4b39c2fd1ca7e8de2fc7d13321dd15b60c72523b3854bc5caa5627780
Instruction Fuzzy Hash: 21F0A4323003486F97206EA69C88C9773EEFB96765300442AF602C7640DA74ED058B60

Function 006E1C88 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(SRSetRestorePointW,srclient.dll), ref: 006E1CB3
GetLastError.KERNEL32(?,006A49DA,00000001,?,?,006A4551,?,?,?,?,006A5466,?,?,?,?), ref: 006E1CC2

Strings

srputil.cpp, xrefs: 006E1CE3
SRSetRestorePointW, xrefs: 006E1CA8
srclient.dll, xrefs: 006E1C91

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: SRSetRestorePointW$srclient.dll$srputil.cpp
API String ID: 199729137-398595594
Opcode ID: e21482bbe40cdfd0f710aea12729c6023f11440257bc05e4a7372dee65981f39
Instruction ID: 63c6f2429f928676a8636934ac3aaf7726bb5ecd13092d1a552a75d58bda412c
Opcode Fuzzy Hash: e21482bbe40cdfd0f710aea12729c6023f11440257bc05e4a7372dee65981f39
Instruction Fuzzy Hash: E101D676BC33B293C72216E75C06B5A24975B06BA1F214226FD01EF3A0DA3DDC40E6D9

Function 006D495D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,006D490E,00000000,?,006D48AE,00000000,00707F08,0000000C,006D4A05,00000000,00000002), ref: 006D497D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 006D4990
FreeLibrary.KERNEL32(00000000,?,?,?,006D490E,00000000,?,006D48AE,00000000,00707F08,0000000C,006D4A05,00000000,00000002), ref: 006D49B3

Strings

mscoree.dll, xrefs: 006D4976
CorExitProcess, xrefs: 006D4988

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 4d4813f2c634a1eeed2d576549f171e2316b46cc709b0973a8bf19ea1aba4a02
Instruction ID: 7a26431d7a474015cab8d80073a9b8ac3917ee26462d370b96fdf73920faa963
Opcode Fuzzy Hash: 4d4813f2c634a1eeed2d576549f171e2316b46cc709b0973a8bf19ea1aba4a02
Instruction Fuzzy Hash: B7F03C30A10308BBCB119FA1DC6ABEEBBBAEF04711F405169B905AA290DB755D40CA95

Function 006A21AC Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(8007139F,00000000,?,?,00000000,00000000,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A21F2
GetLastError.KERNEL32(?,00000000,00000000,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A21FE

Part of subcall function 006A3BD3: GetProcessHeap.KERNEL32(00000000,000001C7,?,006A21CC,000001C7,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3BDB
Part of subcall function 006A3BD3: HeapSize.KERNEL32(00000000,?,006A21CC,000001C7,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3BE2

Strings

strutil.cpp, xrefs: 006A2222

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: strutil.cpp
API String ID: 3662877508-3612885251
Opcode ID: c1731576e0fb216d915b250c3c9fe17d492e0cf9cc7c6748efb937b04e3d8128
Instruction ID: a26e3403f47bf4da8fe3a8111a1eb46d7c9409f4ad7790e67ad29deed77d7b58
Opcode Fuzzy Hash: c1731576e0fb216d915b250c3c9fe17d492e0cf9cc7c6748efb937b04e3d8128
Instruction Fuzzy Hash: C5311B32680227ABD720AEADCC64BAB7A97AF47770B110224FD119F390E671DD008FD0

Function 006E94FD Relevance: 7.6, APIs: 5, Instructions: 119registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006E0F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,0070AAA0,00000000,?,006E57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 006E0F80

RegCloseKey.ADVAPI32(00000001,00000001,?,00000000,00000001,?,00000000,00000001,00000000,00020019,00000001,00000000,00000000,00020019,00000000,00000001), ref: 006E95D5
RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000,00000001,?,00000000,00000001,00000000,00020019), ref: 006E9610
RegCloseKey.ADVAPI32(00000001,00000001,00020019,00000000,00000000,00000000,00000000,00000000,?), ref: 006E962C
RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000,00000000,?), ref: 006E9639
RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000,00000000,?), ref: 006E9646

Part of subcall function 006E0FD5: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,006E95C2,00000001), ref: 006E0FED

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Close$InfoOpenQuery
String ID:
API String ID: 796878624-0
Opcode ID: 1447bf065737faa9eddb3163f8faec05d4a1c633f09b6f807c01327d3f9073e8
Instruction ID: b62a08a93dbfcaafbfca9ac0a28a4047e7fe4380d5b59af11f20906272e86777
Opcode Fuzzy Hash: 1447bf065737faa9eddb3163f8faec05d4a1c633f09b6f807c01327d3f9073e8
Instruction Fuzzy Hash: A4414972C0236DFFEF21AF968C819ADFBBAEF14754F11416AE91077221C7314E509AA4

Function 006A8A07 Relevance: 7.6, APIs: 5, Instructions: 118stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,006A8BC8,006A972D,?,006A972D,?,?,006A972D,?,?), ref: 006A8A27
lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,006A8BC8,006A972D,?,006A972D,?,?,006A972D,?,?), ref: 006A8A2F
CompareStringW.KERNEL32(0000007F,?,?,?,?,00000000,?,00000000,00000000,?,?,006A8BC8,006A972D,?,006A972D,?), ref: 006A8A7E
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,006A8BC8,006A972D,?,006A972D,?), ref: 006A8AE0
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,006A8BC8,006A972D,?,006A972D,?), ref: 006A8B0D

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CompareString$lstrlen
String ID:
API String ID: 1657112622-0
Opcode ID: 4709aaef50579042f133c0f44d8c4b84cdf265025e951869c1b682eb1535b4cc
Instruction ID: 3ecd1767b488a2d4b0a63fe0499a049cae49a09db907674616d078d222a01a32
Opcode Fuzzy Hash: 4709aaef50579042f133c0f44d8c4b84cdf265025e951869c1b682eb1535b4cc
Instruction Fuzzy Hash: D6316272600118BFCB11AF58CC859EE7F6BEB4A350F154416FA098B211CA319D91DFA0

Function 006A74B7 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(006A53BD,WixBundleOriginalSource,?,?,006BA623,840F01E8,WixBundleOriginalSource,?,0070AA90,?,00000000,006A5445,00000001,?,?,ETj), ref: 006A74C3
LeaveCriticalSection.KERNEL32(006A53BD,006A53BD,00000000,00000000,?,?,006BA623,840F01E8,WixBundleOriginalSource,?,0070AA90,?,00000000,006A5445,00000001,?), ref: 006A752A

Strings

Failed to get value as string for variable: %ls, xrefs: 006A7519
Failed to get value of variable: %ls, xrefs: 006A74FD
WixBundleOriginalSource, xrefs: 006A74BF

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as string for variable: %ls$Failed to get value of variable: %ls$WixBundleOriginalSource
API String ID: 3168844106-30613933
Opcode ID: 8771ef73d449edf0da1afec72d36a579e85a7f6b3cfac36a6457ec6ac3243d67
Instruction ID: a96b3ab2ebedfece7150b433c4e252f37d35830d32db4763b46a62d5794fcb69
Opcode Fuzzy Hash: 8771ef73d449edf0da1afec72d36a579e85a7f6b3cfac36a6457ec6ac3243d67
Instruction Fuzzy Hash: C1015A72945269FBCF22AF44CC09A9E3B66EF06375F114165FD04AA220C7369E119BD4

Function 006CD152 Relevance: 7.5, APIs: 5, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,00000000,?,00000000,?,006CD148,00000000), ref: 006CD16D
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,006CD148,00000000), ref: 006CD179
CloseHandle.KERNEL32(006EB518,00000000,?,00000000,?,006CD148,00000000), ref: 006CD186
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,006CD148,00000000), ref: 006CD193
UnmapViewOfFile.KERNEL32(006EB4E8,00000000,?,006CD148,00000000), ref: 006CD1A2

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseHandle$FileUnmapView
String ID:
API String ID: 260491571-0
Opcode ID: 3eac4e8634ae8d7154906e25acc62805e913fff21864d99263587ad4ca75c79b
Instruction ID: 9a16ddebce7b10cedf78d6df40b0765fb1e471c9b755aa1a89ae6cb3a290d4da
Opcode Fuzzy Hash: 3eac4e8634ae8d7154906e25acc62805e913fff21864d99263587ad4ca75c79b
Instruction Fuzzy Hash: 9E01FB72400B15EFCB316F65D880966F7EAEF50711319993EE2AA52A30C371A840CF50

Function 006E36CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(000002C0), ref: 006E36E6
SysAllocString.OLEAUT32(?), ref: 006E36F6
VariantClear.OLEAUT32(?), ref: 006E37D5

Strings

xmlutil.cpp, xrefs: 006E370E

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Variant$AllocClearInitString
String ID: xmlutil.cpp
API String ID: 2213243845-1270936966
Opcode ID: f9d40f00311787d02db08bcaef0293041767d0eb43f17af5a9f4a56234900194
Instruction ID: 78d154850e79ecfd02dafd18178a23a9a1730de77d590fe0a704b5a83b211456
Opcode Fuzzy Hash: f9d40f00311787d02db08bcaef0293041767d0eb43f17af5a9f4a56234900194
Instruction Fuzzy Hash: 594143B5A01375ABCF119FA5C88CEABBBA9AF05710F1541A4FC15EB311D634DE008B95

Function 006E0E4F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,006C8E1B), ref: 006E0EAA
RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,006C8E1B,00000000), ref: 006E0EC8
RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000003,?,?,006C8E1B,00000000,00000000,00000000), ref: 006E0F1E

Strings

regutil.cpp, xrefs: 006E0EEE

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Enum$InfoQuery
String ID: regutil.cpp
API String ID: 73471667-955085611
Opcode ID: bc1965c7a8accb458c7a4d3f8deacba4ac04dc69bb1f3f22b2f3baf5e61fd3d6
Instruction ID: 6181c61291a73aca251a6ec203acc2b9933dffde70a19c9e0c4e7335e96bf9b9
Opcode Fuzzy Hash: bc1965c7a8accb458c7a4d3f8deacba4ac04dc69bb1f3f22b2f3baf5e61fd3d6
Instruction Fuzzy Hash: B731C876902269FFFB218A868D40DAFB76EEF04750F154165FD00AB210D7B18E5096E0

Function 006C8B17 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006E0F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,0070AAA0,00000000,?,006E57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 006E0F80

RegCloseKey.ADVAPI32(00000000,00000000,00000088,00000000,000002C0,00000410,00020019,00000000,000002C0,00000000,?,?,?,006C8E57,00000000,00000000), ref: 006C8BD4

Strings

Failed to open uninstall key for potential related bundle: %ls, xrefs: 006C8B43
Failed to ensure there is space for related bundles., xrefs: 006C8B87
Failed to initialize package from related bundle id: %ls, xrefs: 006C8BBA

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to ensure there is space for related bundles.$Failed to initialize package from related bundle id: %ls$Failed to open uninstall key for potential related bundle: %ls
API String ID: 47109696-1717420724
Opcode ID: 8ec82c6599e35f00fda072421a5a409e6e642e6aad687bed5e2ccc01b9d59d3e
Instruction ID: 07e9a743e2e5b00a1b5056ee92d766d8d1e2e4795ee88a10b328ce5078a140e8
Opcode Fuzzy Hash: 8ec82c6599e35f00fda072421a5a409e6e642e6aad687bed5e2ccc01b9d59d3e
Instruction Fuzzy Hash: 6721607294061AFFDF229E44CC46FBEBB6AEF04711F104159F900A7151DB719E60EB90

Function 006A3B15 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80004005,00000000,00000000,00000100,?,006A1474,00000000,80004005,00000000,80004005,00000000,000001C7,?,006A13B8), ref: 006A3B33
HeapReAlloc.KERNEL32(00000000,?,006A1474,00000000,80004005,00000000,80004005,00000000,000001C7,?,006A13B8,000001C7,00000100,?,80004005,00000000), ref: 006A3B3A

Part of subcall function 006A394F: GetProcessHeap.KERNEL32(?,000001C7,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3960
Part of subcall function 006A394F: RtlAllocateHeap.NTDLL(00000000,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3967

Part of subcall function 006A3BD3: GetProcessHeap.KERNEL32(00000000,000001C7,?,006A21CC,000001C7,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3BDB
Part of subcall function 006A3BD3: HeapSize.KERNEL32(00000000,?,006A21CC,000001C7,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3BE2

_memcpy_s.LIBCMT ref: 006A3B86

Strings

memutil.cpp, xrefs: 006A3BC7

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Heap$Process$AllocAllocateSize_memcpy_s
String ID: memutil.cpp
API String ID: 3406509257-2429405624
Opcode ID: 6b0aa75e03d8f45e9c9b3832d42cb4dc5aa94a2209bf3ac5387ee29cc1dffe59
Instruction ID: 21fa3668b9ba27bd4df870cc53ff6dd22454b796a5d8f9385fcfe213c83eb145
Opcode Fuzzy Hash: 6b0aa75e03d8f45e9c9b3832d42cb4dc5aa94a2209bf3ac5387ee29cc1dffe59
Instruction Fuzzy Hash: 2211E431505239ABCB227E68CC48DAF3A5B9B52760B054219FD149B362D731CF109BF4

Function 006E894D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70timeCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 006E8991
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006E89B9
GetLastError.KERNEL32 ref: 006E89C3

Strings

inetutil.cpp, xrefs: 006E89E4

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLastTime$FileSystem
String ID: inetutil.cpp
API String ID: 1528435940-2900720265
Opcode ID: dc69cc18c97917e00f235595365b560d1755da1760f757490bb4d5221d2db95a
Instruction ID: d2227955f01772b526d2cf3aac0b0730c34203fce82a9933ba1bc6f6f0f9ff07
Opcode Fuzzy Hash: dc69cc18c97917e00f235595365b560d1755da1760f757490bb4d5221d2db95a
Instruction Fuzzy Hash: 8C11E073E01339BBD3209BA9CD45BBFBBA9AF44750F010115AE44FB241DA24DD0087E6

Function 006B3AA6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006E0F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,0070AAA0,00000000,?,006E57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 006E0F80

RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,006B3FB5,feclient.dll,?,00000000,?,?,?,006A4B12), ref: 006B3B42

Part of subcall function 006E10B5: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 006E112B
Part of subcall function 006E10B5: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 006E1163

Strings

SOFTWARE\Policies\Microsoft\Windows\Installer, xrefs: 006B3AB7
feclient.dll, xrefs: 006B3AAB
Logging, xrefs: 006B3AD4

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer$feclient.dll
API String ID: 1586453840-3596319545
Opcode ID: 7455700dde0246f03313a94308ba68427ea8a1734f70e6ec7aad339e03e6235f
Instruction ID: 625ebcb367c6e72f8d1f707d25e12fa0ac5a24c1a4ad820bceee36b34812346f
Opcode Fuzzy Hash: 7455700dde0246f03313a94308ba68427ea8a1734f70e6ec7aad339e03e6235f
Instruction Fuzzy Hash: ED11E6B2B41328BBDB21DB95DD82EFABBBAEB20700F400065E6009B354D6719FC1D710

Function 006E0764 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63filestringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenA.KERNEL32(006C12CF,00000000,00000000,?,?,?,006E0013,006C12CF,006C12CF,?,00000000,0000FDE9,?,006C12CF,8007139F,Invalid operation for this state.), ref: 006E0776
WriteFile.KERNEL32(FFFFFFFF,00000000,00000000,?,00000000,?,?,006E0013,006C12CF,006C12CF,?,00000000,0000FDE9,?,006C12CF,8007139F), ref: 006E07B2
GetLastError.KERNEL32(?,?,006E0013,006C12CF,006C12CF,?,00000000,0000FDE9,?,006C12CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 006E07BC

Strings

logutil.cpp, xrefs: 006E07ED

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFileLastWritelstrlen
String ID: logutil.cpp
API String ID: 606256338-3545173039
Opcode ID: a14097482a184823bd315ca745f6a30491fb89b33f506bfdd77629d53ef4fb1d
Instruction ID: 89311d3bb6533aca81ec80c5dc1e2be98521e6603a947b00383834460a6fdae9
Opcode Fuzzy Hash: a14097482a184823bd315ca745f6a30491fb89b33f506bfdd77629d53ef4fb1d
Instruction Fuzzy Hash: 93118A72942365EBDB10DA6B8D949EFBA6EEB45760F114324FD01DB240EBB4BD40C9E0

Function 006A120A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,006A523F,00000000,?), ref: 006A1248
GetLastError.KERNEL32(?,?,?,006A523F,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 006A1252

Strings

ignored , xrefs: 006A1217
apputil.cpp, xrefs: 006A1273

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ArgvCommandErrorLastLine
String ID: apputil.cpp$ignored
API String ID: 3459693003-568828354
Opcode ID: 2b44f37d700abc71296840c1726685a69e8401fd51f012d2715547ce119d11eb
Instruction ID: 3f6a3a7185e6186f78a930982849520524f5de8cbd1218339865c6b2c94319c4
Opcode Fuzzy Hash: 2b44f37d700abc71296840c1726685a69e8401fd51f012d2715547ce119d11eb
Instruction Fuzzy Hash: AE116D76901229AB8B21EFD9C805E9FBBAAAF47750F110159FD04EB250E630DF409AA4

Function 006CD1B3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000002,00000000,?,?,006CD3EE,00000000,00000000,00000000,?), ref: 006CD1C3
ReleaseMutex.KERNEL32(?,?,006CD3EE,00000000,00000000,00000000,?), ref: 006CD24A

Part of subcall function 006A394F: GetProcessHeap.KERNEL32(?,000001C7,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3960
Part of subcall function 006A394F: RtlAllocateHeap.NTDLL(00000000,?,006A2274,000001C7,00000001,80004005,8007139F,?,?,006E0267,8007139F,?,00000000,00000000,8007139F), ref: 006A3967

Strings

Failed to allocate memory for message data, xrefs: 006CD212
NetFxChainer.cpp, xrefs: 006CD208

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Heap$AllocateMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate memory for message data$NetFxChainer.cpp
API String ID: 2993511968-1624333943
Opcode ID: 7866ff13178b2af2e4332f3d20c9f83a2bb930c00465d3dc0f656a4465fb83dd
Instruction ID: 5e5c5c595532b266d549120e0a695523c88a95622711957df2463cca74fb62fd
Opcode Fuzzy Hash: 7866ff13178b2af2e4332f3d20c9f83a2bb930c00465d3dc0f656a4465fb83dd
Instruction Fuzzy Hash: AD116DB1200215EFCB159F64D885E6AB7E6FF49724B104269FA149B3A1C775AC20CB98

Function 006A1F69 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(006A428F,006A548E,?,00000000,00000000,00000000,?,80070656,?,?,?,006BE75C,00000000,006A548E,00000000,80070656), ref: 006A1F9A
GetLastError.KERNEL32(?,?,?,006BE75C,00000000,006A548E,00000000,80070656,?,?,006B40BF,006A548E,?,80070656,00000001,crypt32.dll), ref: 006A1FA7
LocalFree.KERNEL32(00000000,?,00000000,00000000,?,?,?,006BE75C,00000000,006A548E,00000000,80070656,?,?,006B40BF,006A548E), ref: 006A1FEE

Strings

strutil.cpp, xrefs: 006A1FCB

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: strutil.cpp
API String ID: 1365068426-3612885251
Opcode ID: f22ee63e952478896f7ed61e102314c0a89abeb7ba917709f3d6d2b1681fd921
Instruction ID: 26d59849daf23d6be1dfb5ef93d29456e286d4606880bcab9b3e5598ef0b86b8
Opcode Fuzzy Hash: f22ee63e952478896f7ed61e102314c0a89abeb7ba917709f3d6d2b1681fd921
Instruction Fuzzy Hash: ED01A576901129BFDB209FD4CC05ADF7AEDEF06710F114155BD00EB250E7309E009AE0

Function 006B0721 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006E0F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,0070AAA0,00000000,?,006E57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 006E0F80

RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,00000001,00000000), ref: 006B0791

Strings

Failed to update name and publisher., xrefs: 006B077B
Failed to open registration key., xrefs: 006B0748
Failed to update resume mode., xrefs: 006B0762

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to open registration key.$Failed to update name and publisher.$Failed to update resume mode.
API String ID: 47109696-1865096027
Opcode ID: 68bb27d5da5f005a55b8dea583d5db476502d3c12125d34f52329b71d1c1cee4
Instruction ID: e4abdb4ff356a1d69e6f67cdaad0050f0e843dcb05c84be43ad7394232f600cc
Opcode Fuzzy Hash: 68bb27d5da5f005a55b8dea583d5db476502d3c12125d34f52329b71d1c1cee4
Instruction Fuzzy Hash: BD01D832941328F7DB125A85DC41BEFBA6BAB01B60F100165FA00B6150DB71BE50ABD4

Function 006E4DB3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(006EB500,40000000,00000001,00000000,00000002,00000080,00000000,006B04BF,00000000,?,006AF4F4,?,00000080,006EB500,00000000), ref: 006E4DCB
GetLastError.KERNEL32(?,006AF4F4,?,00000080,006EB500,00000000,?,006B04BF,?,00000094,?,?,?,?,?,00000000), ref: 006E4DD8
CloseHandle.KERNEL32(00000000,00000000,?,006AF4F4,?,006AF4F4,?,00000080,006EB500,00000000,?,006B04BF,?,00000094), ref: 006E4E2C

Strings

fileutil.cpp, xrefs: 006E4DFC

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: fileutil.cpp
API String ID: 2528220319-2967768451
Opcode ID: 85f067ec4192b9fbc2a724c8b234dcbd7e8f58415e475ca4370e369387f4d447
Instruction ID: 9dd25ae540a5a9f76b159bd5e7ed5e09f190de60dd76ccff8789c65a58ae30b2
Opcode Fuzzy Hash: 85f067ec4192b9fbc2a724c8b234dcbd7e8f58415e475ca4370e369387f4d447
Instruction Fuzzy Hash: 5101D433642365A7D7325A7A9C49F9F3A56AB81B70F114314FF20AB2E0EB709C1196E4

Function 006E497A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000080,00000001,00000000,00000003,00000080,00000000,000002C0,00000000,?,006C8C76,00000000,00000088,000002C0,BundleCachePath,00000000), ref: 006E49AE
GetLastError.KERNEL32(?,006C8C76,00000000,00000088,000002C0,BundleCachePath,00000000,000002C0,BundleVersion,000000B8,000002C0,EngineVersion,000002C0,000000B0), ref: 006E49BB

Strings

fileutil.cpp, xrefs: 006E498F, 006E49DF

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: fileutil.cpp
API String ID: 1214770103-2967768451
Opcode ID: 9294c523de292a281640ffbccac95d6f22f9f29613564aff415af2ece449fffb
Instruction ID: d57465122891891f36ed5e0efcecaffc4011eb90cf9972eaee372f3fb3d43e7e
Opcode Fuzzy Hash: 9294c523de292a281640ffbccac95d6f22f9f29613564aff415af2ece449fffb
Instruction Fuzzy Hash: 8F017633282374B7D32022F65C0AFBF269AAB00B70F124215FF40BE2C0CB685C0046E4

Function 006C6BEB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(006C6AFD,00000001,?,00000001,00000000,?,?,?,?,?,?,006C6AFD,00000000), ref: 006C6C13
GetLastError.KERNEL32(?,?,?,?,?,?,006C6AFD,00000000), ref: 006C6C1D

Strings

msuengine.cpp, xrefs: 006C6C41
Failed to stop wusa service., xrefs: 006C6C4B

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ControlErrorLastService
String ID: Failed to stop wusa service.$msuengine.cpp
API String ID: 4114567744-2259829683
Opcode ID: 5d07e1ba98b954f25963ddd036371b116f3fa769473aff9e48b9d349dfdb6f37
Instruction ID: 2f60687f5e87e3023af30a7dca84eb59603e561c613501f9eddb040d6cc76dec
Opcode Fuzzy Hash: 5d07e1ba98b954f25963ddd036371b116f3fa769473aff9e48b9d349dfdb6f37
Instruction Fuzzy Hash: 2501AC33A4123867D7209BA5DC45FFB77A6DB48720F01412DFE00EB280DA65AD0145E8

Function 006E3929 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 006E396E
SysFreeString.OLEAUT32(00000000), ref: 006E39A1

Strings

xmlutil.cpp, xrefs: 006E393F, 006E3985
`)u, xrefs: 006E39A1

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: String$AllocFree
String ID: `)u$xmlutil.cpp
API String ID: 344208780-763603079
Opcode ID: 4cf48847cd834aee1932fa12548de19cb413c8d24704d9427c3822a0650cf9ab
Instruction ID: 48382f8b18686293fbed3a8a760c8db0aac1908c0b023702b10f39296d113f23
Opcode Fuzzy Hash: 4cf48847cd834aee1932fa12548de19cb413c8d24704d9427c3822a0650cf9ab
Instruction Fuzzy Hash: 0D01F7316463A5ABD7201A968C0DEBB36DE9F41B60F100135FD50EB342E7B4CD014691

Function 006E39AF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 006E39F4
SysFreeString.OLEAUT32(00000000), ref: 006E3A27

Strings

xmlutil.cpp, xrefs: 006E39C5, 006E3A0B
`)u, xrefs: 006E3A27

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: String$AllocFree
String ID: `)u$xmlutil.cpp
API String ID: 344208780-763603079
Opcode ID: 5ff52822079c052d6f189f59b80eb6a212512cd1fadaec8d8c708cb5bfa3f332
Instruction ID: f93faa4c43273c11974e9e306a09e1bac685c19e2824c29d7a2d46fd8dd20885
Opcode Fuzzy Hash: 5ff52822079c052d6f189f59b80eb6a212512cd1fadaec8d8c708cb5bfa3f332
Instruction Fuzzy Hash: 9A01A2356463A5B7D7205AAB9C0DEBB36DEEF42760F100139FC54AB351E7B8CE4086A1

Function 006BECC5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009002,00000000,?), ref: 006BECED
GetLastError.KERNEL32 ref: 006BECF7

Strings

EngineForApplication.cpp, xrefs: 006BED1B
Failed to post elevate message., xrefs: 006BED25

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post elevate message.
API String ID: 2609174426-4098423239
Opcode ID: bc68f6c7c7a55d2201e5a67462b519bb688a2d8cf7d4f54fbc7b109b1f1cf6a3
Instruction ID: 2e95f7e6774223f215bc916e3fc47a1c1f5ae418e1d2c206db6f05b49f837a83
Opcode Fuzzy Hash: bc68f6c7c7a55d2201e5a67462b519bb688a2d8cf7d4f54fbc7b109b1f1cf6a3
Instruction Fuzzy Hash: BDF0F673A41335ABC7305A989C09AD77B86AF04B30B214228FF24AF2D1D7A6DC4187D4

Function 006AD8DC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,BootstrapperApplicationDestroy), ref: 006AD903
FreeLibrary.KERNEL32(?,?,006A48D7,00000000,?,?,006A548E,?,?), ref: 006AD912
GetLastError.KERNEL32(?,006A48D7,00000000,?,?,006A548E,?,?), ref: 006AD91C

Strings

BootstrapperApplicationDestroy, xrefs: 006AD8FB

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AddressErrorFreeLastLibraryProc
String ID: BootstrapperApplicationDestroy
API String ID: 1144718084-3186005537
Opcode ID: 5072f86dca023b305a3d7e56e71bf28c9d20b9e64a4c2db6b5e3173d120c36ab
Instruction ID: 6bb7201f7e1612623db8537e612699034509124fb2c753fe68ff6e0acb8887da
Opcode Fuzzy Hash: 5072f86dca023b305a3d7e56e71bf28c9d20b9e64a4c2db6b5e3173d120c36ab
Instruction Fuzzy Hash: F8F06832600726ABC7215F65D804B6BF7A5BF057627018229E815D6A21D771EC108FD4

Function 006E3D80 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36comCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(Microsoft.Update.AutoUpdate,fTj,?,00000000,006A5466,?,?,?), ref: 006E3DA7
CoCreateInstance.OLE32(00000000,00000000,00000001,0070716C,?), ref: 006E3DBF

Strings

Microsoft.Update.AutoUpdate, xrefs: 006E3DA2
fTj, xrefs: 006E3D97, 006E3D9E, 006E3DA1

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID: Microsoft.Update.AutoUpdate$fTj
API String ID: 2151042543-2550393827
Opcode ID: b141bf2597910b7922da899b1134d6ade21988dd116f208ebb1b5dad9310637a
Instruction ID: 448c03a1dda51ffdd2f0b2eae69a895f146481d000e0fe1fea73e28d3d60cd3d
Opcode Fuzzy Hash: b141bf2597910b7922da899b1134d6ade21988dd116f208ebb1b5dad9310637a
Instruction Fuzzy Hash: 0DF0547171021CBBD700DFA9DD46EEFB7BDDB48710F404169EA01EB190D671AE0486B6

Function 006E31EB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 006E3200
SysFreeString.OLEAUT32(00000000), ref: 006E3230

Strings

xmlutil.cpp, xrefs: 006E3214
`)u, xrefs: 006E3230

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: String$AllocFree
String ID: `)u$xmlutil.cpp
API String ID: 344208780-763603079
Opcode ID: 975abbcced2501d9d25b155d94ac8230356dabea46c5ae86ed32f4d24b5397d3
Instruction ID: 6b17ddd29094c45bdabd3fedb40ede73dfadeee122c1fc0b51700306ec9dc472
Opcode Fuzzy Hash: 975abbcced2501d9d25b155d94ac8230356dabea46c5ae86ed32f4d24b5397d3
Instruction Fuzzy Hash: 47F0BE311027E5EBC7311F859C0CFAB77AAAB81B60F254069FD546B310C7758F119AE0

Function 006E3498 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 006E34AD
SysFreeString.OLEAUT32(00000000), ref: 006E34DD

Strings

xmlutil.cpp, xrefs: 006E34C4
`)u, xrefs: 006E34DD

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: String$AllocFree
String ID: `)u$xmlutil.cpp
API String ID: 344208780-763603079
Opcode ID: b728b297f08fcf7b3a7030fa571048dd6a89862bec76c958b2b1e963c98134eb
Instruction ID: ee8a0ddb0f7321daaedca03045cb8aa5c0df22c60da3d02247de1125a6fd5281
Opcode Fuzzy Hash: b728b297f08fcf7b3a7030fa571048dd6a89862bec76c958b2b1e963c98134eb
Instruction Fuzzy Hash: 30F0B4312423A4E7C7335E469C0CEAB77EAAB41B60F10411AFC145F390C775DE109AE0

Function 006BF2D9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009001,00000000,?), ref: 006BF2EE
GetLastError.KERNEL32 ref: 006BF2F8

Strings

EngineForApplication.cpp, xrefs: 006BF31C
Failed to post plan message., xrefs: 006BF326

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post plan message.
API String ID: 2609174426-2952114608
Opcode ID: 47b49e1fff944502536165a85390d0a477c86927f071067047bb02cabd3f9859
Instruction ID: 465413eba52a8a83719a7ad47c340c6a4f71f063d2b3ce9dfc79ff9601241b35
Opcode Fuzzy Hash: 47b49e1fff944502536165a85390d0a477c86927f071067047bb02cabd3f9859
Instruction Fuzzy Hash: DEF0A7336413356BD73027E65C0AECB7FC6EF04B70B024025FE54AF291D6659C4086E4

Function 006BF3E7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009005,?,00000000), ref: 006BF3FC
GetLastError.KERNEL32 ref: 006BF406

Strings

EngineForApplication.cpp, xrefs: 006BF42A
Failed to post shutdown message., xrefs: 006BF434

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post shutdown message.
API String ID: 2609174426-188808143
Opcode ID: 090f74fcfd12160b1a2c266f91ea0b7b664c05a8efb672421d11fd9e25058488
Instruction ID: b067b8261eaf6d7eb3ac04a23d52efcfd3ce85a99a0c464fe7abd59b7de93c6c
Opcode Fuzzy Hash: 090f74fcfd12160b1a2c266f91ea0b7b664c05a8efb672421d11fd9e25058488
Instruction Fuzzy Hash: 81F0A77364133567D7315BD56C0EEC77BD6AF04B60B024025BE14FF2A2E6659C0087E4

Function 006C07B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(006EB478,00000000,?,006C1717,?,00000000,?,006AC287,?,006A5405,?,006B75A5,?,?,006A5405,?), ref: 006C07BF
GetLastError.KERNEL32(?,006C1717,?,00000000,?,006AC287,?,006A5405,?,006B75A5,?,?,006A5405,?,006A5445,00000001), ref: 006C07C9

Strings

cabextract.cpp, xrefs: 006C07ED
Failed to set begin operation event., xrefs: 006C07F7

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorEventLast
String ID: Failed to set begin operation event.$cabextract.cpp
API String ID: 3848097054-4159625223
Opcode ID: ff9565b7bb0eb87ce8db45cceffb8dff95b6fbcc3d8295f47127bcb0d1bfc88e
Instruction ID: 977855008666656551b45ec45642e88a247b627c5dd9bc33ec608ca80481786d
Opcode Fuzzy Hash: ff9565b7bb0eb87ce8db45cceffb8dff95b6fbcc3d8295f47127bcb0d1bfc88e
Instruction Fuzzy Hash: 7DF02733943275ABA72022D54D09FEB768BDE05B70712402DFF04BB240E614AD00C6E9

Function 006BEBCB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009003,00000000,?), ref: 006BEBE0
GetLastError.KERNEL32 ref: 006BEBEA

Strings

EngineForApplication.cpp, xrefs: 006BEC0E
Failed to post apply message., xrefs: 006BEC18

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post apply message.
API String ID: 2609174426-1304321051
Opcode ID: 58273060ce4a8dc1227fc15f4aa82c5a773958532e27223c63057ddf08da3513
Instruction ID: f7b366534e28f3a0fd5088be2edc7ab29f97d7dfd1ac5b72d61f21fc9cf0306c
Opcode Fuzzy Hash: 58273060ce4a8dc1227fc15f4aa82c5a773958532e27223c63057ddf08da3513
Instruction Fuzzy Hash: 48F0A773A4133567D73116955C0DECBBF86AF04B70B024014FE28AE291D7659C4086E4

Function 006BEC5C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009000,00000000,?), ref: 006BEC71
GetLastError.KERNEL32 ref: 006BEC7B

Strings

EngineForApplication.cpp, xrefs: 006BEC9F
Failed to post detect message., xrefs: 006BECA9

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post detect message.
API String ID: 2609174426-598219917
Opcode ID: 7af9f6bac1330d39467a390ce74585e293fc2801cb87827f1b1eaff049e912ec
Instruction ID: 9eea055d5f7becdefeb9d32732ff7372c1263cac5a5b631d4b99e71578202f41
Opcode Fuzzy Hash: 7af9f6bac1330d39467a390ce74585e293fc2801cb87827f1b1eaff049e912ec
Instruction Fuzzy Hash: D9F0A777A4133567D73156D65C09FC7BF96AF04B70B124015BE18AE291D7659C00C6E4

Function 006D6B76 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 006D6C01
__alldvrm.LIBCMT ref: 006D6E02
__alldvrm.LIBCMT ref: 006D6E24

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: a43b07c52b3a46684783b2fbffe6c2b3820df8a855d7f8bf8198392ab5bcf62a
Instruction ID: 97775dfad702f9bdd5ebc811643d0ac0a17b96a22768756c11236062a6fc3351
Opcode Fuzzy Hash: a43b07c52b3a46684783b2fbffe6c2b3820df8a855d7f8bf8198392ab5bcf62a
Instruction Fuzzy Hash: 2DA12376E047869FDB21CF28C881BAEBBA7EF55310F1841AFF5859B382C6389941C751

Function 006E5EC5 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 163stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 006E5F92
lstrlenW.KERNEL32(00000000), ref: 006E5FAA

Strings

dlutil.cpp, xrefs: 006E6033

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: lstrlen
String ID: dlutil.cpp
API String ID: 1659193697-2067379296
Opcode ID: b3b5c99f04b5f2b7fc85c43e8cabd3a7e6b20d06c52bcc9f3e0f0252e7fd177d
Instruction ID: 84fe791108fbf3e29ad2271c239a77c91abf1fd1540ab6d20dd4e8dca0e42d27
Opcode Fuzzy Hash: b3b5c99f04b5f2b7fc85c43e8cabd3a7e6b20d06c52bcc9f3e0f0252e7fd177d
Instruction Fuzzy Hash: BF51E372A02769EBCB219FA6CD84DEFBBBAEF48750F054114F901A7250DB34DC018BA0

Function 006A4FA4 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00000000,?,006A5552,?,?,?,?,?,?), ref: 006A4FFE
DeleteCriticalSection.KERNEL32(?,?,?,00000000,?,006A5552,?,?,?,?,?,?), ref: 006A5012
TlsFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,006A5552,?,?), ref: 006A5101
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,006A5552,?,?), ref: 006A5108

Part of subcall function 006A1161: LocalFree.KERNEL32(?,?,006A4FBB,?,00000000,?,006A5552,?,?,?,?,?,?), ref: 006A116B

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalDeleteFreeSection$CloseHandleLocal
String ID:
API String ID: 3671900028-0
Opcode ID: 2058329656ca879994a1cf766b9b3649a7530ff491e29671db881336530df325
Instruction ID: c16ac0b8b40fdbea7597accc1e0c7a15bdcb312746075bd05bff762171c0b7b0
Opcode Fuzzy Hash: 2058329656ca879994a1cf766b9b3649a7530ff491e29671db881336530df325
Instruction Fuzzy Hash: B141D9B1500B459BDAB0FBB1C889FDB73EE6F05350F44081DB69AD3151EB34E9458B68

Function 006E6067 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,006E5FD0,00000000,00000000,00000001), ref: 006E60DF
GetLastError.KERNEL32(?,?,006E5FD0,00000000,00000000,00000001), ref: 006E6130

Strings

8jp, xrefs: 006E60C3
dlutil.cpp, xrefs: 006E6103, 006E6154

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast
String ID: 8jp$dlutil.cpp
API String ID: 1452528299-4146347658
Opcode ID: 4b359053ec54e6db29b14cf4112a1addf512e709e9396b52a8514666468d57f7
Instruction ID: b776bada2d6d7f90a7ab172703c314f7c41c35b332051a14340c44fe4c363d06
Opcode Fuzzy Hash: 4b359053ec54e6db29b14cf4112a1addf512e709e9396b52a8514666468d57f7
Instruction Fuzzy Hash: 95313936902365F7C7235A9ACD48FDF7ABAAF517A0F124218FD00AB390D674DD0086A4

Function 006A4C86 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 006AF96C: RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,006A4CA5,?,?,00000001), ref: 006AF9BC

CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000001,00000000,?,?,?), ref: 006A4D0C

Strings

Failed to get current process path., xrefs: 006A4CCA
Unable to get resume command line from the registry, xrefs: 006A4CAB
Failed to re-launch bundle process after RunOnce: %ls, xrefs: 006A4CF6

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Close$Handle
String ID: Failed to get current process path.$Failed to re-launch bundle process after RunOnce: %ls$Unable to get resume command line from the registry
API String ID: 187904097-642631345
Opcode ID: 5bbc6c8c18424b14d9302833ea1f3fd7e59a804d8b36d59e04b7fb6a1800e33e
Instruction ID: ca2e7a8eab8f68efb3f25870e0869cae7a38febad58f7a5c9d1ac37628933bad
Opcode Fuzzy Hash: 5bbc6c8c18424b14d9302833ea1f3fd7e59a804d8b36d59e04b7fb6a1800e33e
Instruction Fuzzy Hash: 13115431D02659BB8F12BB96DC058EEBBBAEF85710B10419AF801B6211DB719F519F84

Function 006D88B2 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,006D8A56,00000000,00000000,?,006D8859,006D8A56,00000000,00000000,00000000,?,006D8A56,00000006,FlsSetValue), ref: 006D88E4
GetLastError.KERNEL32(?,006D8859,006D8A56,00000000,00000000,00000000,?,006D8A56,00000006,FlsSetValue,00702404,0070240C,00000000,00000364,?,006D6230), ref: 006D88F0
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,006D8859,006D8A56,00000000,00000000,00000000,?,006D8A56,00000006,FlsSetValue,00702404,0070240C,00000000), ref: 006D88FE

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 58f791c41852933901da29910c0284ffecbe92eb3abb2e096434ba0cb0b091d0
Instruction ID: 6b47f57d79195db31e16bf86de7d5ade6e49c28915bdf225c2b800a33d497235
Opcode Fuzzy Hash: 58f791c41852933901da29910c0284ffecbe92eb3abb2e096434ba0cb0b091d0
Instruction Fuzzy Hash: 6F01D832A41327AFC7314A6D9C58ABB779AEF05BA1B501621F945EF340DF24D90187E0

Function 006D615E Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,006D1AEC,00000000,80004004,?,006D1DF0,00000000,80004004,00000000,00000000), ref: 006D6162
SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 006D61CA
SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 006D61D6
_abort.LIBCMT ref: 006D61DC

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$_abort
String ID:
API String ID: 88804580-0
Opcode ID: 1f057d31c75a52730bd00f6357bf7372b19cc056175b35ae48dd9d34a69f28f3
Instruction ID: 06fc63b9f6fd109025729302cd67bcc4f18e56ad73af8eb91461b61fdc2193e2
Opcode Fuzzy Hash: 1f057d31c75a52730bd00f6357bf7372b19cc056175b35ae48dd9d34a69f28f3
Instruction Fuzzy Hash: 46F0A935D04B01A6C752373DAC09B6F16578FC1771B35011BF91596792FF6489024169

Function 006A7435 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 006A7441
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 006A74A8

Strings

Failed to get value as numeric for variable: %ls, xrefs: 006A7497
Failed to get value of variable: %ls, xrefs: 006A747B

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as numeric for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-4270472870
Opcode ID: 395ce5043e5a000c13935d214fa1b2dc77ab6e353e498581fbb39880c68aeb71
Instruction ID: d4312da0c2026e7ec3c384f6ff3fa993c68f1a0428d4099c5ab1241ec7e3ce5b
Opcode Fuzzy Hash: 395ce5043e5a000c13935d214fa1b2dc77ab6e353e498581fbb39880c68aeb71
Instruction Fuzzy Hash: 34019A32909268FBCF126E54CC09A9E7FA6EF19320F018134FC04AA221C3369E109BD4

Function 006A75AA Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 006A75B6
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 006A761D

Strings

Failed to get value of variable: %ls, xrefs: 006A75F0
Failed to get value as version for variable: %ls, xrefs: 006A760C

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as version for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-1851729331
Opcode ID: 7a6f2da622ab2ff27c2826deb79ecd7553644183934925c38e6561ac61f9d37b
Instruction ID: dc21a3e26a8d8a90e103d4067927c16f7a59d521115cf265506c5af0c0284ce9
Opcode Fuzzy Hash: 7a6f2da622ab2ff27c2826deb79ecd7553644183934925c38e6561ac61f9d37b
Instruction Fuzzy Hash: 38017C32945629FBCF126F44CC09B9E3B66EF12721F015165FD04AB221D7369E119FE8

Function 006A7539 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000006,?,006A9897,00000000,?,00000000,00000000,00000000,?,006A96D6,00000000,?,00000000,00000000), ref: 006A7545
LeaveCriticalSection.KERNEL32(00000000,00000000,00000000,00000000,?,006A9897,00000000,?,00000000,00000000,00000000,?,006A96D6,00000000,?,00000000), ref: 006A759B

Strings

Failed to copy value of variable: %ls, xrefs: 006A758A
Failed to get value of variable: %ls, xrefs: 006A756B

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to copy value of variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-2936390398
Opcode ID: 65cca5dafb114c6156e81ba92a741d86de61226717c9fabe35100d6e06306db1
Instruction ID: 2f5d857ddd9172a20c9d48b7597bf809b8cf38d7c8efff1cf7e57aab3a75d910
Opcode Fuzzy Hash: 65cca5dafb114c6156e81ba92a741d86de61226717c9fabe35100d6e06306db1
Instruction Fuzzy Hash: 6BF03C76945269BBCF126F94CC09D9E7B6AEF15361F008164FD04AA220C7369E21ABD4

Function 006CE776 Relevance: 6.0, APIs: 4, Instructions: 26timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 006CE788
GetCurrentThreadId.KERNEL32 ref: 006CE797
GetCurrentProcessId.KERNEL32 ref: 006CE7A0
QueryPerformanceCounter.KERNEL32(?), ref: 006CE7AD

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: bd40b59e6b1120db53799662bee9de631b131960b813ca9480943c7b83e42871
Instruction ID: 94aabfb6cb4ebe0cdc59b0442522a8a3512d9b5c97a130b35e56b2f05654c395
Opcode Fuzzy Hash: bd40b59e6b1120db53799662bee9de631b131960b813ca9480943c7b83e42871
Instruction Fuzzy Hash: C4F04D71C1024DEBCB00DBB4D989A9EBBF8EF18315F515899A415EB110E734AB049B61

Function 006E0C5D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 145registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 006E0DD7

Strings

regutil.cpp, xrefs: 006E0DC4

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Close
String ID: regutil.cpp
API String ID: 3535843008-955085611
Opcode ID: b190ce944fc70be803c02af4262152195dc6c2262c338037729b33328d8ab7a2
Instruction ID: 7ed0b04aa8f26dad27ace9561f306f3840f726293062a4415b3b25247a37eb4c
Opcode Fuzzy Hash: b190ce944fc70be803c02af4262152195dc6c2262c338037729b33328d8ab7a2
Instruction Fuzzy Hash: 5141D332D033A9EBFB318AD6CC047EE7667AF00720F258264F804AA250D7B59DD19B94

Function 006E8713 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,00000000,00000000,006EB4D0,00000000,006EB4D0,00000000,00000000,00000000), ref: 006E8820
GetLastError.KERNEL32 ref: 006E882A

Strings

timeutil.cpp, xrefs: 006E884E

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Time$ErrorFileLastSystem
String ID: timeutil.cpp
API String ID: 2781989572-3204814302
Opcode ID: ec56076ed6fe5bcf477c39dfbcbb4be457fecf36f7cb089a2629524a2f972a61
Instruction ID: 541799f3ab60ef3238348e425bbc5a32d6782ed31890c7bfd10800b38fcd763c
Opcode Fuzzy Hash: ec56076ed6fe5bcf477c39dfbcbb4be457fecf36f7cb089a2629524a2f972a61
Instruction Fuzzy Hash: 4041E875E023556EDB209BB58C45BBF7767AF40700F64452EF905BB390E935CE0183A5

Function 006E479B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006E0F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,0070AAA0,00000000,?,006E57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 006E0F80

RegCloseKey.ADVAPI32(00000000,80000002,SYSTEM\CurrentControlSet\Control\Session Manager,00000003,?,00000000,00000000,00000101), ref: 006E48FC

Strings

PendingFileRenameOperations, xrefs: 006E47EC, 006E48D4
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 006E47AC

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-3023217399
Opcode ID: 2c724d07f4471ba33d14f77253bec90c0320efc6aba7fa8a310fc33e106e011a
Instruction ID: 720f4675f9644321dcc1d0bab080c5b1e2038ce2ade78eb262ada74cfaa8ca8c
Opcode Fuzzy Hash: 2c724d07f4471ba33d14f77253bec90c0320efc6aba7fa8a310fc33e106e011a
Instruction Fuzzy Hash: 6F417175E01399EFCF20DFAAC8819AEBBBBEB44B10F114069E500A7251DB71DE51DB50

Function 006E10B5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 006E112B
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 006E1163

Strings

regutil.cpp, xrefs: 006E11A9

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: QueryValue
String ID: regutil.cpp
API String ID: 3660427363-955085611
Opcode ID: 062be35e99856867e2502d076991cb38e6b7cfc4e6f3703b98045705a40f6c1e
Instruction ID: cc131f73708252656bf1f42b261d8a3ea6dc96805e6522205cac144c91cc0c8f
Opcode Fuzzy Hash: 062be35e99856867e2502d076991cb38e6b7cfc4e6f3703b98045705a40f6c1e
Instruction Fuzzy Hash: 0E418B72D012AAEBDB109F95CC419EEB7BBFF46350F204169FA11AF250D7319D11AB50

Function 006D66D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(006EB518,00000000,00000006,00000001,comres.dll,?,00000000,?,00000000,?,?,00000000,00000006,?,comres.dll,?), ref: 006D67A3
GetLastError.KERNEL32 ref: 006D67BF

Strings

comres.dll, xrefs: 006D674A, 006D6798, 006D67D4

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID: comres.dll
API String ID: 203985260-246242247
Opcode ID: fe52b7416db73110713ecbc1a6425b69f852231ae76fd949e9cb32ddece5539f
Instruction ID: 72fca62d5adcbb37caec07d772936431c3bd9fe579401e84468799667a908b62
Opcode Fuzzy Hash: fe52b7416db73110713ecbc1a6425b69f852231ae76fd949e9cb32ddece5539f
Instruction Fuzzy Hash: 6831D435E00259ABCB21AF55C885AFB7B6BEF45764F14016BF8148B391EB70CE05C7A1

Function 006E8F7A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006E8E44: lstrlenW.KERNEL32(00000100,?,?,?,006E9217,000002C0,00000100,00000100,00000100,?,?,?,006C7D87,?,?,000001BC), ref: 006E8E69

RegCloseKey.ADVAPI32(00000000,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,006EB500,wininet.dll,?), ref: 006E907A
RegCloseKey.ADVAPI32(?,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,006EB500,wininet.dll,?), ref: 006E9087

Part of subcall function 006E0F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,0070AAA0,00000000,?,006E57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 006E0F80

Part of subcall function 006E0E4F: RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,006C8E1B), ref: 006E0EAA
Part of subcall function 006E0E4F: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,006C8E1B,00000000), ref: 006E0EC8

Strings

wininet.dll, xrefs: 006E8FEF, 006E903C

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Close$EnumInfoOpenQuerylstrlen
String ID: wininet.dll
API String ID: 2680864210-3354682871
Opcode ID: 9d65214f7daed45578b3ad794475caa0e9f27aa5c3d95c270cf02550e59bea8c
Instruction ID: faa07a324a04d6f71c3dcd3f0afde09851b778cd36b65cad233d566087e81ad9
Opcode Fuzzy Hash: 9d65214f7daed45578b3ad794475caa0e9f27aa5c3d95c270cf02550e59bea8c
Instruction Fuzzy Hash: 1C311D32C022A9EFCF21AF96C9408AEBB76EF44710B51417DEA0577221D7314E51DBA0

Function 006E939E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006E8E44: lstrlenW.KERNEL32(00000100,?,?,?,006E9217,000002C0,00000100,00000100,00000100,?,?,?,006C7D87,?,?,000001BC), ref: 006E8E69

RegCloseKey.ADVAPI32(00000000,00000000,?,00000000,00000000,00000000,00000000,?), ref: 006E9483
RegCloseKey.ADVAPI32(00000001,00000000,?,00000000,00000000,00000000,00000000,?), ref: 006E949D

Part of subcall function 006E0BE9: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,006B061A,?,00000000,00020006), ref: 006E0C0E

Part of subcall function 006E14F4: RegSetValueExW.ADVAPI32(00020006,006F0D10,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,006AF335,00000000,?,00020006), ref: 006E1527

Part of subcall function 006E14F4: RegDeleteValueW.ADVAPI32(00020006,006F0D10,00000000,?,?,006AF335,00000000,?,00020006,?,006F0D10,00020006,00000000,?,?,?), ref: 006E1557

Part of subcall function 006E14A6: RegSetValueExW.ADVAPI32(?,00000005,00000000,00000004,?,00000004,00000001,?,006AF28D,006F0D10,Resume,00000005,?,00000000,00000000,00000000), ref: 006E14BB

Strings

%ls\%ls, xrefs: 006E93FF

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Value$Close$CreateDeletelstrlen
String ID: %ls\%ls
API String ID: 3924016894-2125769799
Opcode ID: 5ea51d6549331649baf256e485495d38bf7169852414ff01b4bf0f25ae2a6b34
Instruction ID: b07483bfe406495bbbf29c38e4c051391214b48e3bcc2e244cbe7c180178dd07
Opcode Fuzzy Hash: 5ea51d6549331649baf256e485495d38bf7169852414ff01b4bf0f25ae2a6b34
Instruction Fuzzy Hash: 82311E72C022ADFFCF119F96CC418DEBBBAEF04310B118169F91466261D7358E11EBA0

Function 006A3A4D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 006A3AB0

Strings

wininet.dll, xrefs: 006A3A6E
crypt32.dll, xrefs: 006A3A6D, 006A3AAC, 006A3AAE

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: _memcpy_s
String ID: crypt32.dll$wininet.dll
API String ID: 2001391462-82500532
Opcode ID: 0011009348c22b5e832ea82858c93897483b8e9d66932b506b87b8fd8fea0445
Instruction ID: 53036b842f17ed221f4f6e2792bfd71a2407f930ec12a657b642aa1926933532
Opcode Fuzzy Hash: 0011009348c22b5e832ea82858c93897483b8e9d66932b506b87b8fd8fea0445
Instruction Fuzzy Hash: 3C112171700229ABCB08DF19CD959ABBF6AEF95294B14802AFD454B351D671EE10CAE0

Function 006E14F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(00020006,006F0D10,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,006AF335,00000000,?,00020006), ref: 006E1527
RegDeleteValueW.ADVAPI32(00020006,006F0D10,00000000,?,?,006AF335,00000000,?,00020006,?,006F0D10,00020006,00000000,?,?,?), ref: 006E1557

Strings

regutil.cpp, xrefs: 006E158B

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Value$Delete
String ID: regutil.cpp
API String ID: 1738766685-955085611
Opcode ID: 3934aa740fcac6a5d5cab5cae6d650636e6aa892555c4c282e79b754f0c875ff
Instruction ID: 3655c5751411a35dbdde5a46d9dab56f852c863adbec7fec249bb66356eeffd7
Opcode Fuzzy Hash: 3934aa740fcac6a5d5cab5cae6d650636e6aa892555c4c282e79b754f0c875ff
Instruction Fuzzy Hash: 5B110AF6D133B6F7DB214A964C05BEA7657AB46760F114225FD02AE290DA31CD20B7E0

Function 006ADDB3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,00000000,000000FF,?,000000FF,IGNOREDEPENDENCIES,00000000,?,?,006C7691,00000000,IGNOREDEPENDENCIES,00000000,?,006EB518), ref: 006ADE04

Strings

Failed to copy the property value., xrefs: 006ADE38
IGNOREDEPENDENCIES, xrefs: 006ADDBB

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CompareString
String ID: Failed to copy the property value.$IGNOREDEPENDENCIES
API String ID: 1825529933-1412343224
Opcode ID: cd851ae276e0e263221c859fb5450507924c7935f4e5ed61813557baeb6ba557
Instruction ID: ea005cb6d763381c67fce83fa9aef294d0ad8b9da7af65b8880f68acddcdc858
Opcode Fuzzy Hash: cd851ae276e0e263221c859fb5450507924c7935f4e5ed61813557baeb6ba557
Instruction Fuzzy Hash: 6411A332200215AFDB117F54DC84FAAB7A7BF56320F254169FA1A9F691C7719C50CF90

Function 006E563F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(20000004,00000000,00000000,00000000,00000000,00000000,?,?,006B8E97,?,00000001,20000004,00000000,00000000,?,00000000), ref: 006E566E
SetNamedSecurityInfoW.ADVAPI32(00000000,?,000007D0,00000003,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,006B8E97,?), ref: 006E5689

Strings

aclutil.cpp, xrefs: 006E56AD

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: InfoNamedSecuritySleep
String ID: aclutil.cpp
API String ID: 2352087905-2159165307
Opcode ID: 9150b913b4298fe542df203f7136962dde369cef8bff4f8ea67ceefa88fcae79
Instruction ID: 5cd578490354573281dcc390d1c0fb06ac145351157a5291db749200dc61fc7b
Opcode Fuzzy Hash: 9150b913b4298fe542df203f7136962dde369cef8bff4f8ea67ceefa88fcae79
Instruction Fuzzy Hash: 4F015E37802669BBCF229F8ACD05EDE7B66EF44768F060255FD056A230C6329D209BD4

Function 006A158C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(0000007F,00000000,00000000,?,00000000,?,00000000,00000000,?,00000000,00000000,00000000,?,006A2318,00000000,00000000), ref: 006A15D0
GetLastError.KERNEL32(?,006A2318,00000000,00000000,?,00000200,?,006E52B2,00000000,?,00000000,?,00000000,00000000,00000000), ref: 006A15DA

Strings

strutil.cpp, xrefs: 006A15FE

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLastString
String ID: strutil.cpp
API String ID: 3728238275-3612885251
Opcode ID: 646d3ebb56f480076945b7882a5b082b967b195286ac1c697a9670e718a31fe6
Instruction ID: f2fdb96500e7c5eaf4b45ef488a1291c702712cb4318a441249d413c44d808d0
Opcode Fuzzy Hash: 646d3ebb56f480076945b7882a5b082b967b195286ac1c697a9670e718a31fe6
Instruction Fuzzy Hash: 1701B533D41276778B21AE998C44E9B7A6AEF87B70F094214FE20AF250D620DC108BE0

Function 006B57BD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 006B57D9
CoUninitialize.OLE32(?,00000000,?,?,?,?,?,?,?), ref: 006B5833

Strings

Failed to initialize COM on cache thread., xrefs: 006B57E5

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: InitializeUninitialize
String ID: Failed to initialize COM on cache thread.
API String ID: 3442037557-3629645316
Opcode ID: 9df9be48cb65eb3df43e3babce87f1a778c929a656a4b402752a8a4b7f05718b
Instruction ID: e464e3c89afa16db4365025bf956115efeb74896ac7c11cd381a2472e2cf98ea
Opcode Fuzzy Hash: 9df9be48cb65eb3df43e3babce87f1a778c929a656a4b402752a8a4b7f05718b
Instruction Fuzzy Hash: FD016172601619BFC7059FA5D884ED6FBAEFF08354B108165F609C7111DB31AD548BD4

Function 006E3BF1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006E0F6C: RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,0070AAA0,00000000,?,006E57E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 006E0F80

RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,006E3A8E,?), ref: 006E3C62

Strings

EnableLUA, xrefs: 006E3C34
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 006E3C0C

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseOpen
String ID: EnableLUA$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
API String ID: 47109696-3551287084
Opcode ID: 043e29b949d239cd150d67e8fdd707bf42d62feff1f18c1752dc247dd575281c
Instruction ID: cfe27ad4e673d4087691a66401ea5621c8429d1d90bd614c41a2b9e7d8df5f2d
Opcode Fuzzy Hash: 043e29b949d239cd150d67e8fdd707bf42d62feff1f18c1752dc247dd575281c
Instruction Fuzzy Hash: D401D432812338FFD7109AA5C90ABEEF6AADB00B21F3041A4E800B7241D3759F50D7D4

Function 006A5123 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,006A1104,?,?,00000000), ref: 006A5142
CompareStringW.KERNEL32(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,006A1104,?,?,00000000), ref: 006A5172

Strings

burn.clean.room, xrefs: 006A512F, 006A513C, 006A5169

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: CompareStringlstrlen
String ID: burn.clean.room
API String ID: 1433953587-3055529264
Opcode ID: 515155cc52df40e3c5fe159e28bab2a99d0afe2f1d37cf7f9e6219d563f81857
Instruction ID: 0439c211ec14a2e214ebbe9e8b7c6892fcd33aea1feafa0e2b837c8a9708db2d
Opcode Fuzzy Hash: 515155cc52df40e3c5fe159e28bab2a99d0afe2f1d37cf7f9e6219d563f81857
Instruction Fuzzy Hash: 5301A2B2601720BFC7309B589C84AB3BBAEE716760B10C216F406C7720D7709C41CAA6

Function 006E68B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 006E690F

Part of subcall function 006E8713: SystemTimeToFileTime.KERNEL32(?,00000000,00000000,006EB4D0,00000000,006EB4D0,00000000,00000000,00000000), ref: 006E8820
Part of subcall function 006E8713: GetLastError.KERNEL32 ref: 006E882A

Strings

atomutil.cpp, xrefs: 006E68FD
`)u, xrefs: 006E690F

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Time$ErrorFileFreeLastStringSystem
String ID: `)u$atomutil.cpp
API String ID: 211557998-2257618704
Opcode ID: eefbbf947e029344eb98e3cb291fe243ff7cf4ca0aaa0edfee8f5803bcfa7384
Instruction ID: c6f63a98d30792a1876fbfbb1fb8b7a95b018ac77034adeb3d726c4923add659
Opcode Fuzzy Hash: eefbbf947e029344eb98e3cb291fe243ff7cf4ca0aaa0edfee8f5803bcfa7384
Instruction Fuzzy Hash: 96018BB190236AFF8F205F86C84589AFBA9FF243A4B61417DF51467211D3715E10D7E0

Function 006E6920 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 006E6985

Strings

atomutil.cpp, xrefs: 006E6941
`)u, xrefs: 006E6985

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: FreeString
String ID: `)u$atomutil.cpp
API String ID: 3341692771-2257618704
Opcode ID: 4ca9297b4e4ad30b83ca1a77f1dbc3c8d474ad2d4de0d0f4a9f7949307bf7d84
Instruction ID: f21ce40fc838dd69a54ea4828579e35088937d8821a24d2a685a58ea6d2ca5a7
Opcode Fuzzy Hash: 4ca9297b4e4ad30b83ca1a77f1dbc3c8d474ad2d4de0d0f4a9f7949307bf7d84
Instruction Fuzzy Hash: FE01F932402366F7C7216A96CC05BEEF7BB9F65BA0F240159F90067292C7755E00D6D4

Function 006A6522 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 006A6534

Part of subcall function 006E0ACC: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,006A5EB2,00000000), ref: 006E0AE0
Part of subcall function 006E0ACC: GetProcAddress.KERNEL32(00000000), ref: 006E0AE7
Part of subcall function 006E0ACC: GetLastError.KERNEL32(?,?,?,006A5EB2,00000000), ref: 006E0AFE

Part of subcall function 006A5CE2: RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 006A5D68

Strings

Failed to get 64-bit folder., xrefs: 006A6557
Failed to set variant value., xrefs: 006A6571

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AddressCloseCurrentErrorHandleLastModuleProcProcess
String ID: Failed to get 64-bit folder.$Failed to set variant value.
API String ID: 3109562764-2681622189
Opcode ID: b98b44b506a878969a37d0c56807a1d5e7733d3880c6a0aa5e77ebcba40b1fc8
Instruction ID: 1a91fb5801320e06412536a718c8a1a4642238219acb6c792cd37b532bf1ef6c
Opcode Fuzzy Hash: b98b44b506a878969a37d0c56807a1d5e7733d3880c6a0aa5e77ebcba40b1fc8
Instruction Fuzzy Hash: 3001A232D02328BBCF21BB95CD06ADE7B7AEF01720F144159F8006A155D6719F50DBC0

Function 006A33C7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,006A10DD,?,00000000), ref: 006A33E8
GetLastError.KERNEL32(?,?,?,?,006A10DD,?,00000000), ref: 006A33FF

Strings

pathutil.cpp, xrefs: 006A3423

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: pathutil.cpp
API String ID: 2776309574-741606033
Opcode ID: c774c53bb3bfc53d33812286016963da1e041cfb58c7708ebaad8579119c0f1c
Instruction ID: c1f186b1f9a5532085acf239cccde83c672ac1819d1b812b98f18b4514e9dd37
Opcode Fuzzy Hash: c774c53bb3bfc53d33812286016963da1e041cfb58c7708ebaad8579119c0f1c
Instruction Fuzzy Hash: D4F0C273A4577167873266965C45A8BEA9AEF87B70B160121FE04FF350DA60DD008AF0

Function 006CE30F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 006CEBD2

Part of subcall function 006D1380: RaiseException.KERNEL32(?,?,?,006CEBF4,?,00000000,00000000,?,?,?,?,?,006CEBF4,?,00707EC8), ref: 006D13DF

__CxxThrowException@8.LIBVCRUNTIME ref: 006CEBEF

Strings

Unknown exception, xrefs: 006CEBFC

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 04af7ca38ea6d9dc34eaab570f674e1d393fc0cfe1f8a2e90e434ef43b20d04a
Instruction ID: 5baf0e38f171027fe0c8da6feff2efc7f98be29b6c51ca630272b4681591ef5b
Opcode Fuzzy Hash: 04af7ca38ea6d9dc34eaab570f674e1d393fc0cfe1f8a2e90e434ef43b20d04a
Instruction Fuzzy Hash: A6F0FF74D00208BBCB00BAA4D94AFB8337ECE10310B50426EF829966C1EB72FE16C1C4

Function 006E4A05 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(00000000,00000000,00000000,759234C0,?,?,?,006ABA1D,?,?,?,00000000,00000000), ref: 006E4A1D
GetLastError.KERNEL32(?,?,?,006ABA1D,?,?,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 006E4A27

Strings

fileutil.cpp, xrefs: 006E4A4B

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFileLastSize
String ID: fileutil.cpp
API String ID: 464720113-2967768451
Opcode ID: d6d4f8429c9087e74d304d89c7779ea0da9d6ae93c9da7583a7dc41796fe2601
Instruction ID: 396e8df5ad595867ad7f5170ac9e465b815c17c2d70151834c03404de3efb264
Opcode Fuzzy Hash: d6d4f8429c9087e74d304d89c7779ea0da9d6ae93c9da7583a7dc41796fe2601
Instruction Fuzzy Hash: 76F0A472951236AB97209F99C9059AAFBADFF04760B01416AFD44A7300EB70AD10C7D4

Function 006E0E07 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 006E0E28

Strings

AdvApi32.dll, xrefs: 006E0E0D
RegDeleteKeyExW, xrefs: 006E0E1D

Memory Dump Source

Source File: 00000000.00000002.2399025725.00000000006A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006A0000, based on PE: true

Associated: 00000000.00000002.2399009326.00000000006A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399055048.00000000006EB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399076588.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2399091542.000000000070D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a0000_1wrLmYiC62.jbxd

Similarity

API ID: AddressProc
String ID: AdvApi32.dll$RegDeleteKeyExW
API String ID: 190572456-850864035
Opcode ID: baecf4345ec06be8e845e6e594a555cf6dfceb92411f58267f9b530dcf10de2a
Instruction ID: 591d598e5c0dc99615a3b8e02dffd219f5416f82245ea1f73e239f14acd67d51
Opcode Fuzzy Hash: baecf4345ec06be8e845e6e594a555cf6dfceb92411f58267f9b530dcf10de2a
Instruction Fuzzy Hash: 1AE0ECB0502361EADB119B15FC55B467EE2E715B58F008364E404963B0DFBF5A54CF98

Analysis Process: 1wrLmYiC62.exePID: 5440, Parent PID: 5640COMMON

Executed Functions

Function 000E1070 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 78fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000E33C7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,000E10DD,?,00000000), ref: 000E33E8

CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 000E10F6

Part of subcall function 000E1175: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,000E111A,cabinet.dll,00000009,?,?,00000000), ref: 000E1186
Part of subcall function 000E1175: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,000E111A,cabinet.dll,00000009,?,?,00000000), ref: 000E1191
Part of subcall function 000E1175: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 000E119F
Part of subcall function 000E1175: GetLastError.KERNEL32(?,?,?,?,?,000E111A,cabinet.dll,00000009,?,?,00000000), ref: 000E11BA
Part of subcall function 000E1175: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 000E11C2
Part of subcall function 000E1175: GetLastError.KERNEL32(?,?,?,?,?,000E111A,cabinet.dll,00000009,?,?,00000000), ref: 000E11D7

CloseHandle.KERNEL32(?,?,?,?,0012B4D0,?,cabinet.dll,00000009,?,?,00000000), ref: 000E1131

Strings

feclient.dll, xrefs: 000E10D1
version.dll, xrefs: 000E10A7
msasn1.dll, xrefs: 000E10C3
cabinet.dll, xrefs: 000E1099, 000E1114
msi.dll, xrefs: 000E10A0
wininet.dll, xrefs: 000E10AE
crypt32.dll, xrefs: 000E10CA
comres.dll, xrefs: 000E10B5
clbcatq.dll, xrefs: 000E10BC

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
String ID: cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
API String ID: 3687706282-3151496603
Opcode ID: 5fbddadf772af5bd0eba6538ed3bb563904d37111027607ef25aab8ffea8e48c
Instruction ID: ada34f824b9aa235084f6329ad6ad73c9022e265f46e092f5755411be9bca906
Opcode Fuzzy Hash: 5fbddadf772af5bd0eba6538ed3bb563904d37111027607ef25aab8ffea8e48c
Instruction Fuzzy Hash: 9521A371A0026CAFCB10AFA5ED85BEEBBB8EF09710F504155FA11B7282D7705914CBA0

Function 0011FEC6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132threadtimeCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0014B5FC,00000000,?,?,?,?,001012CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 0011FEF4
GetCurrentProcessId.KERNEL32(00000000,?,001012CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 0011FF04
GetCurrentThreadId.KERNEL32 ref: 0011FF0D
GetLocalTime.KERNEL32(8007139F,?,001012CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 0011FF23
LeaveCriticalSection.KERNEL32(0014B5FC,001012CF,?,00000000,0000FDE9,?,001012CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 0012001A

Strings

%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 0011FFC0

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
String ID: %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls
API String ID: 296830338-59366893
Opcode ID: 9404875be19b7e61260e3daba5ff21136f47ca43b53b6f2e82d4e1f39de96d82
Instruction ID: 67315679eee11974a39a7c87de99cb4b6e8ff6135fc9c20f0f8c2a62d65dd9af
Opcode Fuzzy Hash: 9404875be19b7e61260e3daba5ff21136f47ca43b53b6f2e82d4e1f39de96d82
Instruction Fuzzy Hash: EE419372D0121AABDF259FA4EC44AFFB7B5EB09751F000139F900EA161D7349D92CBA1

Function 000FA0BB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

Strings

Failed create working folder., xrefs: 000FA0EE
Failed to copy working folder., xrefs: 000FA116
Failed to calculate working folder to ensure it exists., xrefs: 000FA0D8

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: CurrentDirectoryErrorLastProcessWindows
String ID: Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
API String ID: 3841436932-2072961686
Opcode ID: f9f8e3c7e42552ab108ed9be5c7d020d345a0e4a2b0cbfcbffef06c5adfcd2aa
Instruction ID: eaabb3b5579f7c4b30ea3eb7d2ddf3b0bd3944464d733b9ac6dd4f5e101dc677
Opcode Fuzzy Hash: f9f8e3c7e42552ab108ed9be5c7d020d345a0e4a2b0cbfcbffef06c5adfcd2aa
Instruction Fuzzy Hash: 62012432A0152CFA8F325B45DC06CAFBBB9EF95B20B124291FA0476611DB319E10B681

Function 000EF9E3 Relevance: 112.4, APIs: 3, Strings: 61, Instructions: 446
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

button, xrefs: 000EFD15
HelpTelephone, xrefs: 000EFC12
Failed to get @Version., xrefs: 000EFAA4
Failed to parse @Version: %ls, xrefs: 000EFAC5
Failed to get @Id., xrefs: 000EFA49
Failed to get @DisableModify., xrefs: 000EFDB8
Classification, xrefs: 000EFEE2
ProviderKey, xrefs: 000EFAD3
Failed to get @UpdateUrl., xrefs: 000EFC73
Manufacturer, xrefs: 000EFE53
Failed to get @HelpTelephone., xrefs: 000EFC29
Invalid modify disabled type: %ls, xrefs: 000EFD94
Failed to get @Comments., xrefs: 000EFCC0
Failed to get @Publisher., xrefs: 000EFBDF
Failed to parse software tag., xrefs: 000EFE10
Failed to get @AboutUrl., xrefs: 000EFC4E
Tag, xrefs: 000EFA57
HelpLink, xrefs: 000EFBED
UpdateUrl, xrefs: 000EFC5C
Failed to get @Name., xrefs: 000EFED4
DisplayVersion, xrefs: 000EFBA3
Arp, xrefs: 000EFB33
DisableModify, xrefs: 000EFCF6
Register, xrefs: 000EFB5D
AboutUrl, xrefs: 000EFC37
PerMachine, xrefs: 000EFB12
Failed to get @Tag., xrefs: 000EFA6A
Failed to get @Register., xrefs: 000EFB70
Failed to get @Contact., xrefs: 000EFCE8
Failed to get @DisableRemove., xrefs: 000EFDE0
Version, xrefs: 000EFA91
Failed to get @ProviderKey., xrefs: 000EFAE6
DisableRemove, xrefs: 000EFDC9
Failed to get @ExecutableName., xrefs: 000EFB07
Department, xrefs: 000EFE77
Failed to set registration paths., xrefs: 000EFF08
Failed to get @DisplayVersion., xrefs: 000EFBBA
Failed to get @ProductFamily., xrefs: 000EFEB3
ExecutableName, xrefs: 000EFAF4
Registration, xrefs: 000EF9FD
Failed to get @PerMachine., xrefs: 000EFB25
Failed to get @Classification., xrefs: 000EFEF5
Failed to select ARP node., xrefs: 000EFB4F
Failed to get @HelpLink., xrefs: 000EFC04
Failed to parse related bundles, xrefs: 000EFA83
Failed to select registration node., xrefs: 000EFA1C
Failed to get @Manufacturer., xrefs: 000EFE66
registration.cpp, xrefs: 000EFD87
Failed to select Update node., xrefs: 000EFE3C
Failed to get @ParentDisplayName., xrefs: 000EFC98
Update, xrefs: 000EFE1E
Failed to get @DisplayName., xrefs: 000EFB95
Publisher, xrefs: 000EFBC8
DisplayName, xrefs: 000EFB7E
Failed to get @Department., xrefs: 000EFE8E
Contact, xrefs: 000EFCD1
ParentDisplayName, xrefs: 000EFC81
yes, xrefs: 000EFD36
ProductFamily, xrefs: 000EFE9C
Comments, xrefs: 000EFCA9
Name, xrefs: 000EFEC1

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$registration.cpp$yes
API String ID: 760788290-2956246334
Opcode ID: 754b85797ef9ed45007288b9d832e43dae07dc59f2fa2363205da986eecba0b3
Instruction ID: 51c54476b33ca247f01ba706e4b1e8c65ee31d5cc005d38fe35a836e7d19db61
Opcode Fuzzy Hash: 754b85797ef9ed45007288b9d832e43dae07dc59f2fa2363205da986eecba0b3
Instruction Fuzzy Hash: 32E1A532E446B7FFCB22AA65CD42EBEB6A4AF15710F110271FD21F7291DB61AD1096C0

Function 000EB48B Relevance: 91.6, APIs: 24, Strings: 28, Instructions: 578
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00000000,76EDC3F0,00000000), ref: 000EB502
SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 000EB550
GetLastError.KERNEL32(?,?,?,00000000,76EDC3F0,00000000), ref: 000EB556
ReadFile.KERNELBASE(00000000,000E4461,00000040,?,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 000EB59E
GetLastError.KERNEL32(?,?,?,00000000,76EDC3F0,00000000), ref: 000EB5A4
SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 000EB601
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 000EB607
ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 000EB650
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 000EB656
SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 000EB6C7
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 000EB6CD
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 000EB716
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 000EB71C
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 000EB765
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 000EB76B
SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 000EB7B7
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 000EB7BD

Part of subcall function 000E394F: GetProcessHeap.KERNEL32(?,000001C7,?,000E2274,000001C7,00000001,80004005,8007139F,?,?,00120267,8007139F,?,00000000,00000000,8007139F), ref: 000E3960
Part of subcall function 000E394F: RtlAllocateHeap.NTDLL(00000000,?,000E2274,000001C7,00000001,80004005,8007139F,?,?,00120267,8007139F,?,00000000,00000000,8007139F), ref: 000E3967

ReadFile.KERNEL32(00000000,?,00000028,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 000EB810
ReadFile.KERNEL32(00000000,?,00000028,00000028,00000000,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 000EB872
SetFilePointerEx.KERNELBASE(00000000,?,00000000,00000000,00000000,00000034,00000001,?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 000EB8FC
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EDC3F0,00000000), ref: 000EB906

Strings

Failed to read section info., xrefs: 000EB999
Failed to get total size of bundle., xrefs: 000EBA23
Failed to seek past optional headers., xrefs: 000EB7EB
.wix, xrefs: 000EB830
PE Header from file didn't match PE Header in memory., xrefs: 000EBB11
Failed to read NT header., xrefs: 000EB681
Failed to seek to NT header., xrefs: 000EB632
burn, xrefs: 000EB838
Failed to allocate memory for container sizes., xrefs: 000EBAD3
Failed to find Burn section., xrefs: 000EBB32
Failed to allocate buffer for section info., xrefs: 000EB8E4
Failed to open handle to engine process path., xrefs: 000EB52D
Failed to find valid DOS image header in buffer., xrefs: 000EBBEB
Failed to read signature offset., xrefs: 000EB747
4, xrefs: 000EB884
Failed to seek to start of file., xrefs: 000EB581
Failed to read complete image section header, index: %u, xrefs: 000EBB75
Failed to read complete section info., xrefs: 000EB9C5
Failed to read section info, unsupported version: %08x, xrefs: 000EB9F5
Failed to find valid NT image header in buffer., xrefs: 000EBBD0
Failed to read image section header, index: %u, xrefs: 000EBBAC
section.cpp, xrefs: 000EB523, 000EB577, 000EB5C5, 000EB628, 000EB677, 000EB6EE, 000EB73D, 000EB78C, 000EB7E1, 000EB898, 000EB8D8, 000EB92A, 000EB98F, 000EB9B9, 000EB9E0, 000EBAC7, 000EBB07, 000EBB26, 000EBB63, 000EBBA1, 000EBBC4, 000EBBDF
Failed to seek to section info., xrefs: 000EB6F8, 000EB934
Failed to read signature size., xrefs: 000EB796
(, xrefs: 000EB81D
PE, xrefs: 000EB698
Failed to read section info, data to short: %u, xrefs: 000EB8AA
Failed to read DOS header., xrefs: 000EB5CF

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: File$ErrorLast$Read$Pointer$Heap$AllocateProcess
String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to engine process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$burn$section.cpp
API String ID: 3411815225-695169583
Opcode ID: f5538f3ec3608e85dbf197df4ee1efc4b0b37177e21d9fb22747c9ba627a0913
Instruction ID: 32bf7bc420d60e702846c8fae6ca68171448e8366c28fda53976fd7bf2e9100e
Opcode Fuzzy Hash: f5538f3ec3608e85dbf197df4ee1efc4b0b37177e21d9fb22747c9ba627a0913
Instruction Fuzzy Hash: 8D12D376A40275AFDB319B56DD4AFEB7AE4AF04710F0101A5FD04BB281EB719D508BE0

Function 00100D16 Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 306
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?,?,?,?,001008BC,?,?), ref: 00100D25
GetLastError.KERNEL32(?,?,?,?,001008BC,?,?), ref: 00100D2F
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,001008BC,?,?), ref: 00100D74
GetLastError.KERNEL32(?,?,?,?,001008BC,?,?), ref: 00100D7F
ResetEvent.KERNEL32(?,?,?,?,?,001008BC,?,?), ref: 00100DB7
GetLastError.KERNEL32(?,?,?,?,001008BC,?,?), ref: 00100DC1

Strings

Failed to set file pointer to end of file., xrefs: 0010104F
Failed to set operation complete event., xrefs: 00100D5D, 00100E9E
Failed to create file: %ls, xrefs: 00101001
Failed to wait for begin operation event., xrefs: 00100DAD, 00100EE6
Failed to copy stream name: %ls, xrefs: 00100E50
Failed to set file pointer to beginning of file., xrefs: 001010D8
Invalid operation for this state., xrefs: 00100E1D
Failed to allocate buffer for stream., xrefs: 00100F93
Failed to reset begin operation event., xrefs: 00100DEF, 00100F2B
Failed to set end of file., xrefs: 00101094
cabextract.cpp, xrefs: 00100D53, 00100DA3, 00100DE5, 00100E11, 00100E94, 00100EDC, 00100F21, 00100F89, 00100FF4, 00101045, 0010108A, 001010CE

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$Event$ObjectResetSingleWait
String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
API String ID: 1865021742-2104912459
Opcode ID: 50244cadfc1b1bd608ba34f6512710df77093c5f18663e5b3bf0a161592251e6
Instruction ID: 86b64b068937a63656fd5dfce20acf00946c8930faf10bb355fc96b39551dfd2
Opcode Fuzzy Hash: 50244cadfc1b1bd608ba34f6512710df77093c5f18663e5b3bf0a161592251e6
Instruction Fuzzy Hash: 6B912937A85732BBD73216A58D49B6A7A50BF08B20F124221BED0BF6D1D7D5DC5082E1

Function 000E5195 Relevance: 38.8, APIs: 5, Strings: 17, Instructions: 315
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 000E5217

Part of subcall function 001204F8: InitializeCriticalSection.KERNEL32(0014B5FC,?,000E5223,00000000,?,?,?,?,?,?), ref: 0012050F

Part of subcall function 000E120A: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,000E523F,00000000,?), ref: 000E1248
Part of subcall function 000E120A: GetLastError.KERNEL32(?,?,?,000E523F,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 000E1252

CoInitializeEx.COMBASE(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 000E5285

Part of subcall function 00120E07: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00120E28

GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 000E5317
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 000E5321
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 000E558E

Strings

Invalid run mode., xrefs: 000E53F9
Failed to initialize COM., xrefs: 000E5291
3.11.1.2318, xrefs: 000E5384
Failed to run per-user mode., xrefs: 000E5494
Failed to initialize Regutil., xrefs: 000E52C9
engine.cpp, xrefs: 000E5345
Failed to initialize Wiutil., xrefs: 000E52E1
Failed to run per-machine mode., xrefs: 000E546C
Failed to run RunOnce mode., xrefs: 000E541C
Failed to run untrusted mode., xrefs: 000E54B6
Failed to initialize engine state., xrefs: 000E526C
Failed to initialize Cryputil., xrefs: 000E52A6
Failed to initialize XML util., xrefs: 000E52F9
Failed to initialize core., xrefs: 000E53C3
Failed to get OS info., xrefs: 000E534F
Failed to run embedded mode., xrefs: 000E5444
Failed to parse command line., xrefs: 000E5245

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
String ID: 3.11.1.2318$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$engine.cpp
API String ID: 3262001429-510904028
Opcode ID: 0095322c67e339d37f540296dbd2eacde6dcc49c2f2604d5fa4a9ea25f4cc0c2
Instruction ID: eaacfe2eb2c6b142a982d387522b65a67b001f218d995a1839cf0fef11fb4cb6
Opcode Fuzzy Hash: 0095322c67e339d37f540296dbd2eacde6dcc49c2f2604d5fa4a9ea25f4cc0c2
Instruction Fuzzy Hash: EAB1F872D40AB89FDB329F629C86BED77B4AF0430AF040595F908B7242DB319E90CB51

Function 000F752A Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 291
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WixBundleSourceProcessFolder, xrefs: 000F7734
Failed to extract bootstrapper application payloads., xrefs: 000F77EF
Failed to initialize variables., xrefs: 000F7571
Failed to load manifest., xrefs: 000F75E8
Failed to set source process path variable., xrefs: 000F7709
Failed to initialize internal cache functionality., xrefs: 000F779F
WixBundleElevated, xrefs: 000F76A5, 000F76B6
Failed to open manifest stream., xrefs: 000F75AB
Failed to load catalog files., xrefs: 000F780F
Failed to open attached UX container., xrefs: 000F758E
WixBundleOriginalSource, xrefs: 000F7759
Failed to get source process folder from path., xrefs: 000F7725
Failed to set source process folder variable., xrefs: 000F7745
Failed to get manifest stream from container., xrefs: 000F75CC
WixBundleUILevel, xrefs: 000F76D6, 000F76E7
WixBundleSourceProcessPath, xrefs: 000F76F8
Failed to overwrite the %ls built-in variable., xrefs: 000F76BB
Failed to parse command line., xrefs: 000F7667
Failed to get unique temporary folder for bootstrapper application., xrefs: 000F77CE
Failed to set original source variable., xrefs: 000F776A

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleUILevel
API String ID: 32694325-1564579409
Opcode ID: 4b761b2e7f2ee71f9e20bb7af30bffc0ed16fcd2adfe522c935562c7551cd995
Instruction ID: 45433ffb958f94667f5c22c5dc53bc0d39a30cedb99e11010b2129471736a6a7
Opcode Fuzzy Hash: 4b761b2e7f2ee71f9e20bb7af30bffc0ed16fcd2adfe522c935562c7551cd995
Instruction Fuzzy Hash: 38A1C472A4462DBBDB229AA4CC85EFEB7ACBB04740F000226F719F7541DB71A911D7E1

Function 000E762C Relevance: 34.9, APIs: 1, Strings: 22, Instructions: 420
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(000F756B,000E53BD,00000000,000E5445), ref: 000E764C

Strings

WixBundleSourceProcessFolder, xrefs: 000E7E9E
', xrefs: 000E78EB
WixBundleTag, xrefs: 000E7EAE
WixBundleVersion, xrefs: 000E7ECE
Date, xrefs: 000E7770
WixBundleExecutePackageCacheFolder, xrefs: 000E7D98
Failed to add built-in variable: %ls., xrefs: 000E7F19
WixBundleInstalled, xrefs: 000E7E2A
WixBundleActiveParent, xrefs: 000E7E62
WixBundleForcedRestartPackage, xrefs: 000E7E14
0, xrefs: 000E7663
WixBundleElevated, xrefs: 000E7E46
WixBundleProviderKey, xrefs: 000E7E7E
$, xrefs: 000E7D49
LogonUser, xrefs: 000E7882
InstallerName, xrefs: 000E7812
#, xrefs: 000E76CB
WixBundleUILevel, xrefs: 000E7EBE
WixBundleAction, xrefs: 000E7D76
WixBundleSourceProcessPath, xrefs: 000E7E8E
InstallerVersion, xrefs: 000E7833
WixBundleExecutePackageAction, xrefs: 000E7DF8

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleUILevel$WixBundleVersion
API String ID: 32694325-3635313340
Opcode ID: 4d444888106651552c2f45f135a2d5b318bfd28c151b45ef2406c0fa78b50fd9
Instruction ID: 11aca1f72c3985a4b044b021d971052712c16472d850437e4cbf4102d91ccdc7
Opcode Fuzzy Hash: 4d444888106651552c2f45f135a2d5b318bfd28c151b45ef2406c0fa78b50fd9
Instruction Fuzzy Hash: F13247B0D116699FDB65CF5AD9887CDFAB4BB48308F5085EED20CB6210C7B50B988F85

Function 000F82BA Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00000000,00000000,000E5489), ref: 000F8310

Part of subcall function 00120879: OpenProcessToken.ADVAPI32(?,00000008,?,000E53BD,00000000,?,?,?,?,?,?,?,000F769D,00000000), ref: 00120897
Part of subcall function 00120879: GetLastError.KERNEL32(?,?,?,?,?,?,?,000F769D,00000000), ref: 001208A1
Part of subcall function 00120879: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,000F769D,00000000), ref: 0012092B

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 000F8336
GetLastError.KERNEL32 ref: 000F8340
GetTempPathW.KERNEL32(00000104,?,00000000), ref: 000F83BD
GetLastError.KERNEL32 ref: 000F83C7
UuidCreate.RPCRT4(?), ref: 000F8406

Strings

%ls%ls\, xrefs: 000F8458
Failed to get temp path for working folder., xrefs: 000F83F5
Failed to create working folder guid., xrefs: 000F8413
Failed to convert working folder guid into string., xrefs: 000F8446
Failed to copy working folder path., xrefs: 000F848B
Failed to get windows path for working folder., xrefs: 000F836E
Failed to concat Temp directory on windows path for working folder., xrefs: 000F83AD
cache.cpp, xrefs: 000F8364, 000F83EB, 000F843C
Failed to append bundle id on to temp path for working folder., xrefs: 000F8470
Failed to ensure windows path for working folder ended in backslash., xrefs: 000F838B
Temp\, xrefs: 000F8395

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$Process$CloseCreateCurrentDirectoryHandleOpenPathTempTokenUuidWindows
String ID: %ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$cache.cpp
API String ID: 266130487-819636856
Opcode ID: 069f6cbdd1ecabfbb42d7539cff576125de86039f39736351e1c0e39ec1aa2b5
Instruction ID: 8242caf8c51fb186d65b691fce52d4f8c531d9a34d4b7f4bcfe8f91a26a22d13
Opcode Fuzzy Hash: 069f6cbdd1ecabfbb42d7539cff576125de86039f39736351e1c0e39ec1aa2b5
Instruction Fuzzy Hash: EA410472A44329B7DB3096A08C4AFEB77ACAB04B10F108161BB04F7550EF74EE4497E1

Function 001010FB Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 0010111D
CoUninitialize.COMBASE ref: 00101398

Strings

Failed to extract all files from container, erf: %d:%X:%d, xrefs: 00101279
Failed to set operation complete event., xrefs: 001012C4
Failed to initialize COM., xrefs: 00101129
Failed to wait for begin operation event., xrefs: 00101311
Invalid operation for this state., xrefs: 0010137C
Failed to initialize cabinet.dll., xrefs: 0010119F
Failed to reset begin operation event., xrefs: 00101350
<the>.cab, xrefs: 001011BD
cabextract.cpp, xrefs: 00101193, 001012BA, 00101307, 00101346, 00101372

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: InitializeUninitialize
String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
API String ID: 3442037557-1168358783
Opcode ID: 6e1d0b8cf57c1637a735eb875b694dd7ef34b4425f68846f8e9a95510d68867c
Instruction ID: eeb5fc011adea7ff2698d23a671d151bf36b2421038b95ba900dfe3bf5c22c57
Opcode Fuzzy Hash: 6e1d0b8cf57c1637a735eb875b694dd7ef34b4425f68846f8e9a95510d68867c
Instruction Fuzzy Hash: BB513536A842A1F7CB2567A48C45EAB3664BB05730B374366BD81FF6D1D7ED8C0082D6

Function 000E42D7 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 158
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,000E5266,?,?,00000000,?,?), ref: 000E4303
InitializeCriticalSection.KERNEL32(000000D0,?,?,000E5266,?,?,00000000,?,?), ref: 000E430C
lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,000E5266,?,?,00000000,?,?), ref: 000E4352
lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,000E5266,?,?,00000000,?,?), ref: 000E435C
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,000E5266,?,?,00000000,?,?), ref: 000E4370
lstrlenW.KERNEL32(burn.filehandle.attached,?,?,000E5266,?,?,00000000,?,?), ref: 000E4380
lstrlenW.KERNEL32(burn.filehandle.self,?,?,000E5266,?,?,00000000,?,?), ref: 000E43D0
lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,000E5266,?,?,00000000,?,?), ref: 000E43DA
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,000E5266,?,?,00000000,?,?), ref: 000E43EE
lstrlenW.KERNEL32(burn.filehandle.self,?,?,000E5266,?,?,00000000,?,?), ref: 000E43FE

Strings

Failed to initialize engine section., xrefs: 000E4467
burn.filehandle.self, xrefs: 000E43CB, 000E43D3, 000E43D8, 000E43D9, 000E43F9, 000E44CB
Missing required parameter for switch: %ls, xrefs: 000E44A4
engine.cpp, xrefs: 000E4495, 000E44C1
Failed to parse file handle: '%ls', xrefs: 000E4482
burn.filehandle.attached, xrefs: 000E434D, 000E4355, 000E435A, 000E435B, 000E437B, 000E449F

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: lstrlen$CompareCriticalInitializeSectionString
String ID: Failed to initialize engine section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$engine.cpp
API String ID: 3039292287-3209860532
Opcode ID: 9e6532f6e42df47ec6fe68a19184c0975d99e5c8b30e1e310cefd47406237af7
Instruction ID: 27cf7d390712a918f05a0c4a5240c55b768b0e8a472ac416ce1feb7906078bed
Opcode Fuzzy Hash: 9e6532f6e42df47ec6fe68a19184c0975d99e5c8b30e1e310cefd47406237af7
Instruction Fuzzy Hash: 8051A5B1B44265BFCB24DF69DC86F9A77ACEF04760F140116FA18E7291D770A960CBA0

Function 000FE7B4 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 137
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsSetValue.KERNEL32(?,?), ref: 000FE7FF
RegisterClassW.USER32(?), ref: 000FE82B
GetLastError.KERNEL32 ref: 000FE836
CreateWindowExW.USER32(00000080,00139E54,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 000FE89D
GetLastError.KERNEL32 ref: 000FE8A7
UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 000FE945

Strings

Failed to create window., xrefs: 000FE8D5
Failed to register window., xrefs: 000FE864
WixBurnMessageWindow, xrefs: 000FE824, 000FE940
Unexpected return value from message pump., xrefs: 000FE930
uithread.cpp, xrefs: 000FE85A, 000FE8CB

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$uithread.cpp
API String ID: 213125376-288575659
Opcode ID: a429aa5ceb91e924796fe3d4509e290118304f774b8d1c946e472aeae4868509
Instruction ID: 2d552a396b95f33683104f2d2654c1e8ab6077343804c5494f53c044addc00b3
Opcode Fuzzy Hash: a429aa5ceb91e924796fe3d4509e290118304f774b8d1c946e472aeae4868509
Instruction Fuzzy Hash: 2D41C672904219FBCB209BA1DC85AEEBFB8FF04760F104125FA09A7550DB70A951DBA0

Function 000EC28F Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 131
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,?,000EC47F,000E5405,?,?,000E5445), ref: 000EC2D6
GetLastError.KERNEL32(?,000EC47F,000E5405,?,?,000E5445,000E5445,00000000,?,00000000), ref: 000EC2E7
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,?,000EC47F,000E5405,?,?,000E5445,000E5445,00000000,?), ref: 000EC336
GetCurrentProcess.KERNEL32(000000FF,00000000,?,000EC47F,000E5405,?,?,000E5445,000E5445,00000000,?,00000000), ref: 000EC33C
DuplicateHandle.KERNELBASE(00000000,?,000EC47F,000E5405,?,?,000E5445,000E5445,00000000,?,00000000), ref: 000EC33F
GetLastError.KERNEL32(?,000EC47F,000E5405,?,?,000E5445,000E5445,00000000,?,00000000), ref: 000EC349
SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,000EC47F,000E5405,?,?,000E5445,000E5445,00000000,?,00000000), ref: 000EC39B
GetLastError.KERNEL32(?,000EC47F,000E5405,?,?,000E5445,000E5445,00000000,?,00000000), ref: 000EC3A5

Strings

feclient.dll, xrefs: 000EC398
Failed to move file pointer to container offset., xrefs: 000EC3D3
Failed to open container., xrefs: 000EC3F1
container.cpp, xrefs: 000EC30B, 000EC36D, 000EC3C9
crypt32.dll, xrefs: 000EC397
Failed to duplicate handle to container: %ls, xrefs: 000EC37A
Failed to open file: %ls, xrefs: 000EC318

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$container.cpp$crypt32.dll$feclient.dll
API String ID: 2619879409-373955632
Opcode ID: 977fb82dc3248dcee5d44eeb58f4820860f1b7368e03987edbef88d99cebacd3
Instruction ID: c8f30c708cd27ceaa791f3510e50b129405a1ee8a3a677679f2f176c867bf5b9
Opcode Fuzzy Hash: 977fb82dc3248dcee5d44eeb58f4820860f1b7368e03987edbef88d99cebacd3
Instruction Fuzzy Hash: 0C410B36240291BFE7219F2A9D49E4B7BB5EBC4720F258129F914BB251DB72C813DB60

Function 00122AF7 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 79
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000E3838: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 000E3877
Part of subcall function 000E3838: GetLastError.KERNEL32 ref: 000E3881

Part of subcall function 00124A6C: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00124A9D

GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 00122B41
GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 00122B61
GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 00122B81
GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 00122BA1
GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 00122BC1
GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 00122BE1
GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 00122C01

Strings

MsiSourceListAddSourceExW, xrefs: 00122BF6
MsiDetermineApplicablePatchesW, xrefs: 00122B56
MsiEnumProductsExW, xrefs: 00122B76
Msi.dll, xrefs: 00122B09
MsiSetExternalUIRecord, xrefs: 00122BD6
MsiDeterminePatchSequenceW, xrefs: 00122B36
MsiGetProductInfoExW, xrefs: 00122BB6
MsiGetPatchInfoExW, xrefs: 00122B96

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: AddressProc$ErrorLast$DirectorySystem
String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
API String ID: 2510051996-1735120554
Opcode ID: 75f97f9dde21cbc5b00e4ee4d8ecd5eaa34e54efe36ac85299d14e212ab84657
Instruction ID: 0fe670b696fe26d660f756161c1d2d88ed9435ee825a52f4dd0967170590644f
Opcode Fuzzy Hash: 75f97f9dde21cbc5b00e4ee4d8ecd5eaa34e54efe36ac85299d14e212ab84657
Instruction Fuzzy Hash: 473126B8949218EFDB119F71FD82B697BA0F717708F03012AE80456970E7B188E5DF54

Function 0012304F Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 153
libraryloadercomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00123609,00000000,?,00000000), ref: 00123069
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,0010C025,?,000E5405,?,00000000,?), ref: 00123075
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 001230B5
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 001230C1
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 001230CC
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 001230D6
CoCreateInstance.OLE32(0014B6B8,00000000,00000001,0012B818,?,?,?,?,?,?,?,?,?,?,?,0010C025), ref: 00123111
ExitProcess.KERNEL32 ref: 001231C0

Strings

xmlutil.cpp, xrefs: 00123099
Wow64EnableWow64FsRedirection, xrefs: 001230C3
Wow64DisableWow64FsRedirection, xrefs: 001230BB
Wow64RevertWow64FsRedirection, xrefs: 001230CE
IsWow64Process, xrefs: 001230AF
kernel32.dll, xrefs: 00123059

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$xmlutil.cpp
API String ID: 2124981135-499589564
Opcode ID: 43187c529df7a821434223dea96a375e502d48991241bc04ceefd643a4ed34ef
Instruction ID: 3b90fe6616b4a553d3201bdc07ce1a2793dabfc04168974f00cae1597f7a511f
Opcode Fuzzy Hash: 43187c529df7a821434223dea96a375e502d48991241bc04ceefd643a4ed34ef
Instruction Fuzzy Hash: 3F41F131B04335ABCB24DBA8D885BAEB7B4EF04710F124068F911EB250DB79DE618B94

Function 00101741 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,000EC3EB,?,00000000,?,000EC47F), ref: 00101778
GetLastError.KERNEL32(?,000EC3EB,?,00000000,?,000EC47F,000E5405,?,?,000E5445,000E5445,00000000,?,00000000), ref: 00101781

Strings

Failed to create extraction thread., xrefs: 00101841
Failed to copy file name., xrefs: 00101763
Failed to create begin operation event., xrefs: 001017AF
Failed to wait for operation complete., xrefs: 00101854
Failed to create operation complete event., xrefs: 001017F5
wininet.dll, xrefs: 00101757
cabextract.cpp, xrefs: 001017A5, 001017EB, 00101837

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$cabextract.cpp$wininet.dll
API String ID: 545576003-938279966
Opcode ID: 54b6b393593a1ee2a302cf0f7db218c60d5a2dd99405dc8729cc8eda82d7a038
Instruction ID: 3ccb2f443c05a47217194263f2a90e160776429d7f581f9991dddbc5d26951f3
Opcode Fuzzy Hash: 54b6b393593a1ee2a302cf0f7db218c60d5a2dd99405dc8729cc8eda82d7a038
Instruction Fuzzy Hash: E021D877D4173677D33116954C45F577A9CAF04764B024226FDC0BB5C1EB98DC0086E1

Function 0011FCAE Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 0011FCD6
GetProcAddress.KERNEL32(SystemFunction041), ref: 0011FCE8
GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 0011FD2B
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0011FD3F
GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 0011FD77
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0011FD8B

Strings

cryputil.cpp, xrefs: 0011FD60
SystemFunction040, xrefs: 0011FCCB
CryptUnprotectMemory, xrefs: 0011FD6C
SystemFunction041, xrefs: 0011FCD8
CryptProtectMemory, xrefs: 0011FD20
AdvApi32.dll, xrefs: 0011FCB5
Crypt32.dll, xrefs: 0011FD0C

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$cryputil.cpp
API String ID: 4214558900-3191127217
Opcode ID: 27c7832af8217bb3c6c17838f4724dc5f9a1cc7e5b0170e46707227a5ab1df31
Instruction ID: 83bb661e2f0f34c91022553496212b84022466951808030c0af5b444b05cf328
Opcode Fuzzy Hash: 27c7832af8217bb3c6c17838f4724dc5f9a1cc7e5b0170e46707227a5ab1df31
Instruction Fuzzy Hash: AD21DA3A9443319BCB355BA5BD497E6A9A4BB02B64F064139FC00AF570EB60CCC3DAD1

Function 001008C2 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 001008F2
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 0010090A
GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 0010090F
DuplicateHandle.KERNELBASE(00000000,?,?), ref: 00100912
GetLastError.KERNEL32(?,?), ref: 0010091C
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 0010098B
GetLastError.KERNEL32(?,?), ref: 00100998

Strings

Failed to add virtual file pointer for cab container., xrefs: 00100971
Failed to open cabinet file: %hs, xrefs: 001009C9
<the>.cab, xrefs: 001008EB
cabextract.cpp, xrefs: 00100940, 001009BC
Failed to duplicate handle to cab container., xrefs: 0010094A

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$cabextract.cpp
API String ID: 3030546534-3446344238
Opcode ID: daf5d2aaa4f190a74f1c9f1f6b8eed0a23216277142c1002e479375de74b2472
Instruction ID: a6febe0c77f95ac7bc44de756c25d6541b4a4383b8d3713decea50093b8222c3
Opcode Fuzzy Hash: daf5d2aaa4f190a74f1c9f1f6b8eed0a23216277142c1002e479375de74b2472
Instruction Fuzzy Hash: F331E432941235FBEB225B959C49F9FBF68EF08764F110112FE88B7691D7A0AD1086E1

Function 000F3F9B Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 220sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 000F3AA6: RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,000F3FB5,feclient.dll,?,00000000,?,?,?,000E4B12), ref: 000F3B42

Sleep.KERNEL32(000007D0,00000001,feclient.dll,?,00000000,?,?,?,000E4B12,?,?,0012B488,?,00000001,00000000,00000000), ref: 000F404C

Strings

Failed to get current directory., xrefs: 000F402E
Failed to copy log path to prefix., xrefs: 000F416E
feclient.dll, xrefs: 000F3FAF, 000F405C
log, xrefs: 000F3FF3
Failed to get non-session specific TEMP folder., xrefs: 000F40F6
Failed to copy full log path to prefix., xrefs: 000F41AF
msasn1.dll, xrefs: 000F4162, 000F41A3
Failed to copy log extension to extension., xrefs: 000F4191
Setup, xrefs: 000F3FF9
crypt32.dll, xrefs: 000F3FF2, 000F4057, 000F405F, 000F40C6, 000F4100, 000F4141, 000F4160, 000F419E, 000F41C8
Failed to open log: %ls, xrefs: 000F40C8
clbcatq.dll, xrefs: 000F4185

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseSleep
String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$clbcatq.dll$crypt32.dll$feclient.dll$log$msasn1.dll
API String ID: 2834455192-2673269691
Opcode ID: 37e9b2cca419a72f8ded83a4589c04a571f9dbb29487dd3d2d0eaa9cee7e4d45
Instruction ID: 94b96bb1545d03041ed94219ef2802b8d5da17d5e1b4679baf53f9b074bf8f52
Opcode Fuzzy Hash: 37e9b2cca419a72f8ded83a4589c04a571f9dbb29487dd3d2d0eaa9cee7e4d45
Instruction Fuzzy Hash: D561B171A00219AEDB269F64CC42B7B7BE8FF14350F044265FE00DB951EB71EE90A7A0

Function 000E6DB9 Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 166COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000001,?,00000000,000E5445,00000006,?,000E82B9,?,?,?,00000000,00000000,00000001), ref: 000E6DC8

Part of subcall function 000E56A9: CompareStringW.KERNEL32(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,000E6595,000E6595,?,000E563D,?,?,00000000), ref: 000E56E5
Part of subcall function 000E56A9: GetLastError.KERNEL32(?,000E563D,?,?,00000000,?,?,000E6595,?,000E7F02,?,?,?,?,?), ref: 000E5714

LeaveCriticalSection.KERNEL32(00000001,?,00000000,00000001,00000000,00000000,?,000E82B9), ref: 000E6F59

Strings

Failed to insert variable '%ls'., xrefs: 000E6E0D
Setting string variable '%ls' to value '%ls', xrefs: 000E6EED
Attempt to set built-in variable value: %ls, xrefs: 000E6E56
variable.cpp, xrefs: 000E6E4B
Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 000E6ED0
Setting numeric variable '%ls' to value %lld, xrefs: 000E6EFA
Setting hidden variable '%ls', xrefs: 000E6E86
Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 000E6F6B
Failed to set value of variable: %ls, xrefs: 000E6F41
Unsetting variable '%ls', xrefs: 000E6F15
Failed to find variable value '%ls'., xrefs: 000E6DE3

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalSection$CompareEnterErrorLastLeaveString
String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$variable.cpp
API String ID: 2716280545-445000439
Opcode ID: 210a03ab282a3c71ac867ef0ac37fd86734a76e160f557e63c2a2ecb6acc3f00
Instruction ID: 8e49563e27e23ab068e9df5e7eb58cf16f46370abd31e3f82fd40ca823bab07b
Opcode Fuzzy Hash: 210a03ab282a3c71ac867ef0ac37fd86734a76e160f557e63c2a2ecb6acc3f00
Instruction Fuzzy Hash: 5551B571A402A5EFDB309E16FC4AF6B3BA8EB75794F100129F84576282C372DD61CAD1

Function 000E4AE5 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 144windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 000E4C64
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 000E4C75

Strings

Failed to check global conditions, xrefs: 000E4B49
Failed to create the message window., xrefs: 000E4B98
Failed to set layout directory variable to value provided from command-line., xrefs: 000E4C06
Failed to open log., xrefs: 000E4B18
Failed to set registration variables., xrefs: 000E4BDE
Failed while running , xrefs: 000E4C2A
Failed to set action variables., xrefs: 000E4BC4
Failed to query registration., xrefs: 000E4BAE
WixBundleLayoutDirectory, xrefs: 000E4BF5

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: MessagePostWindow
String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
API String ID: 3618638489-3051724725
Opcode ID: e332e435399a4d5fcca0e81c47b59cf30f2bae90be7a3cdede8fcc4b6c430c72
Instruction ID: 07a0d462a20bd0c04e08780b4d33a9d08ad97a599059582b63e78e6bae4534a2
Opcode Fuzzy Hash: e332e435399a4d5fcca0e81c47b59cf30f2bae90be7a3cdede8fcc4b6c430c72
Instruction Fuzzy Hash: 6C412131A05AAEBFCB665A61CC85FFAB76CFB04754F104211F904B3161EBA1EC20A7D0

Function 000FEA7D Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 101threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,000E548E,?,?), ref: 000FEA9D
GetLastError.KERNEL32(?,000E548E,?,?), ref: 000FEAAA
CreateThread.KERNELBASE(00000000,00000000,Function_0001E7B4,?,00000000,00000000), ref: 000FEB03
GetLastError.KERNEL32(?,000E548E,?,?), ref: 000FEB10
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,000E548E,?,?), ref: 000FEB4B
CloseHandle.KERNEL32(00000000,?,000E548E,?,?), ref: 000FEB6A
CloseHandle.KERNELBASE(?,?,000E548E,?,?), ref: 000FEB77

Strings

Failed to create the UI thread., xrefs: 000FEB3B
Failed to create initialization event., xrefs: 000FEAD5
uithread.cpp, xrefs: 000FEACB, 000FEB31

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create initialization event.$Failed to create the UI thread.$uithread.cpp
API String ID: 2351989216-3599963359
Opcode ID: b31c3f2db2577b77a0a395b6912dd01c2a4abd9b02bb13bfd4053e13cc152d92
Instruction ID: 05b0bae3a91792a3960e9783e28072a4be98851ec7d42031ce7bd357d775e7e5
Opcode Fuzzy Hash: b31c3f2db2577b77a0a395b6912dd01c2a4abd9b02bb13bfd4053e13cc152d92
Instruction Fuzzy Hash: 1131A476D01229BBD721DF99CD85AAFBBF8FF04350F110165BA05F7650E7709E0096A1

Function 001014E1 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 91threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,75922F60,?,?,000E5405,000E53BD,00000000,000E5445), ref: 00101506
GetLastError.KERNEL32 ref: 00101519
GetExitCodeThread.KERNELBASE(0012B488,?), ref: 0010155B
GetLastError.KERNEL32 ref: 00101569
ResetEvent.KERNEL32(0012B460), ref: 001015A4
GetLastError.KERNEL32 ref: 001015AE

Strings

Failed to wait for operation complete event., xrefs: 0010154A
Failed to reset operation complete event., xrefs: 001015DF
cabextract.cpp, xrefs: 00101540, 00101590, 001015D5
Failed to get extraction thread exit code., xrefs: 0010159A

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$cabextract.cpp
API String ID: 2979751695-3400260300
Opcode ID: 50b4ceee644e7abba2f6b95a707a0ff5977b0f9ae6f7baf4cdf64bbb3d1bb1ac
Instruction ID: b168f5b7c2a01fb0b202e01e99b801782afc884a559ef1036fc672f61f38ade5
Opcode Fuzzy Hash: 50b4ceee644e7abba2f6b95a707a0ff5977b0f9ae6f7baf4cdf64bbb3d1bb1ac
Instruction Fuzzy Hash: 3031B471A00305FFEB109F668D45AAF7BF8FF45700F10415AF986EA1A0EBB4DA409B61

Function 000E2DBF Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 203sleepfiletimeCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000000,00000000,00000000), ref: 000E2E5F
GetLastError.KERNEL32 ref: 000E2E69
GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 000E2F09
CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 000E2F96
GetLastError.KERNEL32 ref: 000E2FA3
Sleep.KERNEL32(00000064), ref: 000E2FB7
CloseHandle.KERNEL32(?), ref: 000E301F

Strings

pathutil.cpp, xrefs: 000E2E8D
%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls, xrefs: 000E2F66

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
String ID: %ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$pathutil.cpp
API String ID: 3480017824-1101990113
Opcode ID: d48b06b9dc6ada6a3a16d1779f043c49a998b53ba7070d5b3ca8595b7a8a5326
Instruction ID: 1535c5494654a2d0216a07521cebf144294e2143577773d079be5c0b75716a28
Opcode Fuzzy Hash: d48b06b9dc6ada6a3a16d1779f043c49a998b53ba7070d5b3ca8595b7a8a5326
Instruction Fuzzy Hash: 75717272D41279AFDB719FA5DC8DBAEB7B8AB08710F0001A5F904B7291D7349E918F90

Function 000ECBC5 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 144COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,00000001,000000FF,?,00000001,000E53BD,00000000,000E5489,000E5445,WixBundleUILevel,840F01E8,?,00000001), ref: 000ECC1C

Strings

Failed to get next stream., xrefs: 000ECD03
Failed to get directory portion of local file path, xrefs: 000ECCF5
Failed to find embedded payload: %ls, xrefs: 000ECC48
Failed to extract file., xrefs: 000ECCE7
Payload was not found in container: %ls, xrefs: 000ECD29
Failed to concat file paths., xrefs: 000ECCFC
Failed to ensure directory exists, xrefs: 000ECCEE
payload.cpp, xrefs: 000ECD1D

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: CompareString
String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$payload.cpp
API String ID: 1825529933-1711239286
Opcode ID: 5ae5208c46798a5e37322fc9f6a0c9d5388d7d57d7670a139edd2651f66fc330
Instruction ID: f12fa0ccc86ddfa59221aea1a41710b833ba156332a160124fde94d9a50bc645
Opcode Fuzzy Hash: 5ae5208c46798a5e37322fc9f6a0c9d5388d7d57d7670a139edd2651f66fc330
Instruction Fuzzy Hash: E341D1319052A8EFDF259F4ACC81DAEBBB5BF00710F218179E815BB252D3729D52DB90

Function 000E4796 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 128windowthreadCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 000E47BB
GetCurrentThreadId.KERNEL32 ref: 000E47C1
GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 000E484F

Strings

Failed to load UX., xrefs: 000E4804
Failed to create engine for UX., xrefs: 000E47DB
wininet.dll, xrefs: 000E47EE
engine.cpp, xrefs: 000E489B
Unexpected return value from message pump., xrefs: 000E48A5
Failed to start bootstrapper application., xrefs: 000E481D

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: Message$CurrentPeekThread
String ID: Failed to create engine for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$engine.cpp$wininet.dll
API String ID: 673430819-2573580774
Opcode ID: e114ee7fab3c0fd10e5f267eba24c9a37d49094ab62302773eab28ec8e4571c1
Instruction ID: 852d642d6f31df672a10a8aa05cb04392d9b461cf4ce3231f102adfbd65ecf15
Opcode Fuzzy Hash: e114ee7fab3c0fd10e5f267eba24c9a37d49094ab62302773eab28ec8e4571c1
Instruction Fuzzy Hash: 5F41C271A00695BFEB249BA5DC85EFEB7ACEF08314F10022AF904F7191DB31AD5587A0

Function 000ED6C9 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000008,00000000,?,000E47FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,000E548E,?), ref: 000ED6DA
GetLastError.KERNEL32(?,000E47FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,000E548E,?,?), ref: 000ED6E7
GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 000ED71F
GetLastError.KERNEL32(?,000E47FE,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,000E548E,?,?), ref: 000ED72B

Strings

Failed to load UX DLL., xrefs: 000ED712
BootstrapperApplicationCreate, xrefs: 000ED719
userexperience.cpp, xrefs: 000ED708, 000ED74C
Failed to get BootstrapperApplicationCreate entry-point, xrefs: 000ED756
Failed to create UX., xrefs: 000ED76F

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$userexperience.cpp
API String ID: 1866314245-2276003667
Opcode ID: d2e4ff45f1f92187411a0ac18fbc30b372154bcc843ab10910aa6a0d3769cdf2
Instruction ID: ff35ccd2e315b5252027cdc77c952204714bcd9f8ec322e1fee18208e26037a7
Opcode Fuzzy Hash: d2e4ff45f1f92187411a0ac18fbc30b372154bcc843ab10910aa6a0d3769cdf2
Instruction Fuzzy Hash: 0511B237A88772AFC73257966D05F5B7BA4AB04B21F01053ABE90FB280EB20DC1186D4

Function 000EF812 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 117registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 000EF942
RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 000EF94F

Strings

Failed to open registration key., xrefs: 000EF8AB
Failed to format pending restart registry key to read., xrefs: 000EF846
Failed to read Resume value., xrefs: 000EF8D8
%ls.RebootRequired, xrefs: 000EF82F
Resume, xrefs: 000EF8B6

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: Close
String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
API String ID: 3535843008-3890505273
Opcode ID: 2c43745af48130de17d2c27bd4e12c0648395c38e3ae9d1b6b516a49c7ed3f8c
Instruction ID: 937f5a72b854d23a2aebed9eeaef4feea88762a1f15fc467d7611cd5bb513caf
Opcode Fuzzy Hash: 2c43745af48130de17d2c27bd4e12c0648395c38e3ae9d1b6b516a49c7ed3f8c
Instruction Fuzzy Hash: 5441807190119AFFDB229F9AD981BBDBBB4FB04310F558176E850BB212C3719E51DB80

Function 6E0F0948 Relevance: 12.1, APIs: 8, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6E0F098F
___scrt_uninitialize_crt.LIBCMT ref: 6E0F09A9

Memory Dump Source

Source File: 00000002.00000002.2398326675.000000006E0E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E0E0000, based on PE: true

Associated: 00000002.00000002.2398311786.000000006E0E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398352677.000000006E10A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398370970.000000006E11B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398386480.000000006E11D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0e0000_1wrLmYiC62.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: e8fa9eb6b43aebda57cea2b432fd90755d4f1c5d29e90fdf0063b95807231f69
Instruction ID: c93063435ef3cc338970d9b751a62c4cf891b0629e3fe39d47fe7501a8ac8aa7
Opcode Fuzzy Hash: e8fa9eb6b43aebda57cea2b432fd90755d4f1c5d29e90fdf0063b95807231f69
Instruction Fuzzy Hash: EC41B172D0D619EFDB608FD5C900BEE7AB9EF44798F014525EC1467280F77049639BA0

Function 00120523 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0014B5FC,00000000,?,?,?,000F4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,000E54FA,?), ref: 00120533
CreateFileW.KERNEL32(40000000,00000001,00000000,00000000,00000080,00000000,?,00000000,?,?,?,0014B5F4,?,000F4207,00000000,Setup), ref: 001205D7
GetLastError.KERNEL32(?,000F4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,000E54FA,?,?,?), ref: 001205E7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,000F4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,000E54FA,?), ref: 00120621

Part of subcall function 000E2DBF: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 000E2F09

LeaveCriticalSection.KERNEL32(0014B5FC,?,?,0014B5F4,?,000F4207,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,000E54FA,?), ref: 0012067A

Strings

logutil.cpp, xrefs: 00120606

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
String ID: logutil.cpp
API String ID: 4111229724-3545173039
Opcode ID: ba4a97f4612c615cfe6c3d6d3ab6d9fc4472e2aadc39bf93cc314147a3bfe2af
Instruction ID: 7aa7384d7bd20ea7807f2a2b432c421463edb54fc77c1c7869d4682894afae0b
Opcode Fuzzy Hash: ba4a97f4612c615cfe6c3d6d3ab6d9fc4472e2aadc39bf93cc314147a3bfe2af
Instruction Fuzzy Hash: E931C671904239FFDB229F65AD95E9ABB68EF08754F010225F900AB172D771CD70DB90

Function 00100B8E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74fileCOMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00100BDE
WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00100BFD
GetLastError.KERNEL32 ref: 00100C07

Strings

Failed to write during cabinet extraction., xrefs: 00100C35
Unexpected call to CabWrite()., xrefs: 00100BC1
cabextract.cpp, xrefs: 00100C2B

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFileLastWrite_memcpy_s
String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$cabextract.cpp
API String ID: 1970631241-3111339858
Opcode ID: 07db73f4d9458b85a04c38927daec80b47612f2b3c6da036936aa67edfe8d5de
Instruction ID: d585eccd2ca3caa92513df10da9ccef93f658d7a4b44c79f0f2c8520b591cf30
Opcode Fuzzy Hash: 07db73f4d9458b85a04c38927daec80b47612f2b3c6da036936aa67edfe8d5de
Instruction Fuzzy Hash: 0821D476504205ABDB16CF5DDA85E9A37B8FF88320F214199FE04D7292DB71DD10C760

Function 00120879 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008,?,000E53BD,00000000,?,?,?,?,?,?,?,000F769D,00000000), ref: 00120897
GetLastError.KERNEL32(?,?,?,?,?,?,?,000F769D,00000000), ref: 001208A1
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,000F769D,00000000), ref: 001208D3
GetLastError.KERNEL32(?,?,?,?,?,?,?,000F769D,00000000), ref: 001208EC
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,000F769D,00000000), ref: 0012092B

Strings

procutil.cpp, xrefs: 00120919

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLastToken$CloseHandleInformationOpenProcess
String ID: procutil.cpp
API String ID: 4040495316-1178289305
Opcode ID: af32d575ef9eb24c72a3574ca5d8c4d4bc67b1275263bb3217e47c826f6edc93
Instruction ID: f47b37a9f62b22e0d73f8bdad91edd1902248012efdb8d8f78068498a1da5205
Opcode Fuzzy Hash: af32d575ef9eb24c72a3574ca5d8c4d4bc67b1275263bb3217e47c826f6edc93
Instruction Fuzzy Hash: E621D732D00239FFDB229B959844A9EBBB8EF04710F014255BD19EB252D7708E60DAD0

Function 00100C57 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00100CC4
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00100CD6
SetFileTime.KERNELBASE(?,?,?,?), ref: 00100CE9
CloseHandle.KERNELBASE(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,001008B1,?,?), ref: 00100CF8

Strings

Invalid operation for this state., xrefs: 00100C9D
cabextract.cpp, xrefs: 00100C93

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: Time$File$CloseDateHandleLocal
String ID: Invalid operation for this state.$cabextract.cpp
API String ID: 609741386-1751360545
Opcode ID: 4c4cf71970548183d1be81af3aeb6cdeb55a31dbfbd744ced501a93dcec78ef2
Instruction ID: 8e84c5d1280ca2b93940d79864cd1f2d4b420e3224ccf7af7969f2df86ca0aca
Opcode Fuzzy Hash: 4c4cf71970548183d1be81af3aeb6cdeb55a31dbfbd744ced501a93dcec78ef2
Instruction Fuzzy Hash: 68210871800219BBC725DFA8DD49AFA7BBCFF08320B504256F895D65D0D3B0E951CB90

Function 00123565 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00123574
InterlockedIncrement.KERNEL32(0014B6C8), ref: 00123591
CLSIDFromProgID.COMBASE(Msxml2.DOMDocument,0014B6B8,?,?,?,?,?,?), ref: 001235AC
CLSIDFromProgID.OLE32(MSXML.DOMDocument,0014B6B8,?,?,?,?,?,?), ref: 001235B8

Strings

Msxml2.DOMDocument, xrefs: 001235A7
MSXML.DOMDocument, xrefs: 001235B3

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: FromProg$IncrementInitializeInterlocked
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 2109125048-2356320334
Opcode ID: b8a338954e66d658862b2efdf36a50344e44019595283b4fe5b4ab6386119288
Instruction ID: 0247c9219f294b84bcfa43a93f8c4ca47c87bc239c84e0adba229904ce7a5f36
Opcode Fuzzy Hash: b8a338954e66d658862b2efdf36a50344e44019595283b4fe5b4ab6386119288
Instruction Fuzzy Hash: D8F0E53074823567D3304B627D48B472E79EB82F69F050529E818D2474D368D9E28BB0

Function 00124A6C Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00124A9D
GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 00124ACA
GetLastError.KERNEL32(?,00000000,?,00000000), ref: 00124AF6
GetLastError.KERNEL32(00000000,0012B7A0,?,00000000,?,00000000,?,00000000), ref: 00124B34
GlobalFree.KERNEL32(00000000), ref: 00124B65

Strings

fileutil.cpp, xrefs: 00124AB8, 00124B11

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$Global$AllocFree
String ID: fileutil.cpp
API String ID: 1145190524-2967768451
Opcode ID: 22be046dfe10f56bee9d87071e5f6cad8fa67eaf27ee5fc6fd8485adc6b241fa
Instruction ID: 2dd4bc70541a23128e3e0eda5c80371783f6926b6cb647139b83f83a28456c74
Opcode Fuzzy Hash: 22be046dfe10f56bee9d87071e5f6cad8fa67eaf27ee5fc6fd8485adc6b241fa
Instruction Fuzzy Hash: 8F31B436E44239ABC7229A99AC41FAFBBB8EF44750F114165FD14E7241EB30DD2086E4

Function 000FE956 Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000082,?,?), ref: 000FE985
SetWindowLongW.USER32(?,000000EB,00000000), ref: 000FE994
SetWindowLongW.USER32(?,000000EB,?), ref: 000FE9A8
DefWindowProcW.USER32(?,?,?,?), ref: 000FE9B8
GetWindowLongW.USER32(?,000000EB), ref: 000FE9D2
PostQuitMessage.USER32(00000000), ref: 000FEA31

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: Window$Long$Proc$MessagePostQuit
String ID:
API String ID: 3812958022-0
Opcode ID: b1c02545af8dd0815ac752acbc559b06128a23b02c73ab126db6251613d617a6
Instruction ID: 6f6b6492f926ae69c8868d39910cef5f101d48b637c688bf26c82c7abb72c997
Opcode Fuzzy Hash: b1c02545af8dd0815ac752acbc559b06128a23b02c73ab126db6251613d617a6
Instruction Fuzzy Hash: 14219031108148BFDB219F68DC49EBA3B65FF44321F144618FA06AA5B5C731ED60EB61

Function 00100A81 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 00100B27
GetLastError.KERNEL32(?,?,?), ref: 00100B31

Strings

Invalid seek type., xrefs: 00100ABD
cabextract.cpp, xrefs: 00100B55
Failed to move file pointer 0x%x bytes., xrefs: 00100B62

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$cabextract.cpp
API String ID: 2976181284-417918914
Opcode ID: 70712c0af8b8e253fe1d17b388e0871b03ec147f77d7b25338677dd37dbd03a8
Instruction ID: 239db4b9cb35a5087f6256d0cb97be6423dc5eb8fada7e75116f7ac0982b3df4
Opcode Fuzzy Hash: 70712c0af8b8e253fe1d17b388e0871b03ec147f77d7b25338677dd37dbd03a8
Instruction Fuzzy Hash: E731A035A4021AEFCB16CFA8D884EAEB769FF08724F158225F954A7691D770ED108B90

Function 000E4115 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,000FA0E8,00000000,00000000,?,00000000,000E53BD,00000000,?,?,000ED5B5,?), ref: 000E4123
GetLastError.KERNEL32(?,000FA0E8,00000000,00000000,?,00000000,000E53BD,00000000,?,?,000ED5B5,?,00000000,00000000), ref: 000E4131
CreateDirectoryW.KERNEL32(?,840F01E8,000E5489,?,000FA0E8,00000000,00000000,?,00000000,000E53BD,00000000,?,?,000ED5B5,?,00000000), ref: 000E419A
GetLastError.KERNEL32(?,000FA0E8,00000000,00000000,?,00000000,000E53BD,00000000,?,?,000ED5B5,?,00000000,00000000), ref: 000E41A4

Strings

dirutil.cpp, xrefs: 000E41D4

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: dirutil.cpp
API String ID: 1375471231-2193988115
Opcode ID: 402f1c98601a44c56507a5c4d529856d151b1c8fad2717b9ea32a83f83e24e1f
Instruction ID: 43f2714fa7690ec3c4d3a593f1fb2cd4b0621d05250a72a7dc38edc1b57aa625
Opcode Fuzzy Hash: 402f1c98601a44c56507a5c4d529856d151b1c8fad2717b9ea32a83f83e24e1f
Instruction Fuzzy Hash: BF110536A043B5AFDF711AA35C80B7BA6A4EF71B62F1600A1FD04FB150E3608CD18290

Function 6E0F09F8 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6E0F0A35
dllmain_crt_dispatch.LIBCMT ref: 6E0F0A4C
dllmain_raw.LIBCMT ref: 6E0F0A94
dllmain_crt_dispatch.LIBCMT ref: 6E0F0AA7
dllmain_raw.LIBCMT ref: 6E0F0ABA

Memory Dump Source

Source File: 00000002.00000002.2398326675.000000006E0E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E0E0000, based on PE: true

Associated: 00000002.00000002.2398311786.000000006E0E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398352677.000000006E10A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398370970.000000006E11B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398386480.000000006E11D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0e0000_1wrLmYiC62.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: e5694d0dd23f0377dc7f1ddb31c336368c25db39db1eb93641eebc4b954f6fbe
Instruction ID: 482b70012c9f04725a705382be5405ad7f6af6feef73689296c279ab56d70b1a
Opcode Fuzzy Hash: e5694d0dd23f0377dc7f1ddb31c336368c25db39db1eb93641eebc4b954f6fbe
Instruction Fuzzy Hash: D4217172D09619EFDB618ED5C950BAF7AADEF80B94F014425FC146B294F3308D638BA0

Function 6E0E6EF9 Relevance: 7.6, APIs: 5, Instructions: 68sleepprocessCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 6E0E6F0A
GetModuleFileNameW.KERNEL32(?,00000104), ref: 6E0E6F22
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 6E0E6FB7
Sleep.KERNELBASE ref: 6E0E6FC3
ExitProcess.KERNEL32 ref: 6E0E6FCA

Memory Dump Source

Source File: 00000002.00000002.2398326675.000000006E0E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E0E0000, based on PE: true

Associated: 00000002.00000002.2398311786.000000006E0E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398352677.000000006E10A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398370970.000000006E11B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398386480.000000006E11D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0e0000_1wrLmYiC62.jbxd

Similarity

API ID: ModuleProcess$CreateExitFileHandleNameSleep
String ID:
API String ID: 1732164044-0
Opcode ID: c6558d146f6bae4d3f2bef927928d6321d58d0a823c17ed642599a977de6c987
Instruction ID: 801b2cadc450403bdf5a3130584724efd5e4b5e6edff08d20d2edf13503a1fd8
Opcode Fuzzy Hash: c6558d146f6bae4d3f2bef927928d6321d58d0a823c17ed642599a977de6c987
Instruction Fuzzy Hash: FE21AF72420528DACB15AFD8ED44FEF73B8FB49740F00846AE756E35A4DB7049609B54

Function 000F3AA6 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00120F6C: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0014AAA0,00000000,?,001257E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00120F80

RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,000F3FB5,feclient.dll,?,00000000,?,?,?,000E4B12), ref: 000F3B42

Part of subcall function 001210B5: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0012112B
Part of subcall function 001210B5: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00121163

Strings

feclient.dll, xrefs: 000F3AAB
Logging, xrefs: 000F3AD4
SOFTWARE\Policies\Microsoft\Windows\Installer, xrefs: 000F3AB7

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer$feclient.dll
API String ID: 1586453840-3596319545
Opcode ID: 0cc4e3289ff5a40267636d7268186c296b638e5073adae4253ddb20eb98dae55
Instruction ID: 69de5bc09fd31e94dfff4cd38a4045b22d3479a154726693956d64a00cea8cd7
Opcode Fuzzy Hash: 0cc4e3289ff5a40267636d7268186c296b638e5073adae4253ddb20eb98dae55
Instruction Fuzzy Hash: 38119332A4020CBBDB22EB95DC96EBFB7B8EB14721F500065E700AB551D7719F81E750

Function 00120764 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63filestringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenA.KERNEL32(001012CF,00000000,00000000,?,?,?,00120013,001012CF,001012CF,?,00000000,0000FDE9,?,001012CF,8007139F,Invalid operation for this state.), ref: 00120776
WriteFile.KERNELBASE(000002C8,00000000,00000000,?,00000000,?,?,00120013,001012CF,001012CF,?,00000000,0000FDE9,?,001012CF,8007139F), ref: 001207B2
GetLastError.KERNEL32(?,?,00120013,001012CF,001012CF,?,00000000,0000FDE9,?,001012CF,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 001207BC

Strings

logutil.cpp, xrefs: 001207ED

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFileLastWritelstrlen
String ID: logutil.cpp
API String ID: 606256338-3545173039
Opcode ID: 35f7fd96f51d21e92eddcf9d3c051d7efcf6cd68d5c125726d6f7dd1b519a93c
Instruction ID: e0406ca71b21147b252497618d5183375cbfb2539ee15069240bf99de7396cd4
Opcode Fuzzy Hash: 35f7fd96f51d21e92eddcf9d3c051d7efcf6cd68d5c125726d6f7dd1b519a93c
Instruction Fuzzy Hash: 0811CA76A41134ABC3218A65AD989ABBB6CEB49761B110324FD40E7551DB30BD50C9E0

Function 0011FE21 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNELBASE(00000900,?,?,00000000,00000000,00000000,?,00000000,?,?,001204F4,?,?,?,?,00000001), ref: 0011FE40
GetLastError.KERNEL32(?,001204F4,?,?,?,?,00000001,?,000E5616,?,?,00000000,?,?,000E5395,00000002), ref: 0011FE4C
LocalFree.KERNEL32(00000000,?,?,00000000,?,?,001204F4,?,?,?,?,00000001,?,000E5616,?,?), ref: 0011FEB5

Strings

logutil.cpp, xrefs: 0011FE6B

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: logutil.cpp
API String ID: 1365068426-3545173039
Opcode ID: b0b57231d60ef48a9d7a0e4f4a02466a62e21de031d82c8f4ff9b641b3518573
Instruction ID: a08278ad500664d5e24b9040cb00c691c6d8d2514fd4cce83ea3915c8aea262c
Opcode Fuzzy Hash: b0b57231d60ef48a9d7a0e4f4a02466a62e21de031d82c8f4ff9b641b3518573
Instruction Fuzzy Hash: 13115B32A02129EBDB399F958D05EEF7B69EF54710F024039FD0496171E7318EA2D6A0

Function 001009EA Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0010140C: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00100A19,?,?,?), ref: 00101434
Part of subcall function 0010140C: GetLastError.KERNEL32(?,00100A19,?,?,?), ref: 0010143E

ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 00100A27
GetLastError.KERNEL32 ref: 00100A31

Strings

cabextract.cpp, xrefs: 00100A55
Failed to read during cabinet extraction., xrefs: 00100A5F

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read during cabinet extraction.$cabextract.cpp
API String ID: 2170121939-2426083571
Opcode ID: 991511d3b170ce24db6f2d87600fbf10cfddbdd17a78f85f6fbdbedc246569e9
Instruction ID: 1c667e40cc8a573b46acd0abd41871417782c9af1e8916dd0af0d0812ff0a84b
Opcode Fuzzy Hash: 991511d3b170ce24db6f2d87600fbf10cfddbdd17a78f85f6fbdbedc246569e9
Instruction Fuzzy Hash: E311E136A00229FBCB229F95DC04E9E7F68FF48760F124255FD48A7291CB309910C7D0

Function 0010140C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00100A19,?,?,?), ref: 00101434
GetLastError.KERNEL32(?,00100A19,?,?,?), ref: 0010143E

Strings

cabextract.cpp, xrefs: 00101462
Failed to move to virtual file pointer., xrefs: 0010146C

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$cabextract.cpp
API String ID: 2976181284-3005670968
Opcode ID: 0fd56347ca5b04a6ecf529a948248fa1e8ec6105eaf523046cb3b95e4c78ac60
Instruction ID: 8f630e272d1f7f1b0dcca80cadf0b1dbcad8d0068d03e35311d2a8589238f50b
Opcode Fuzzy Hash: 0fd56347ca5b04a6ecf529a948248fa1e8ec6105eaf523046cb3b95e4c78ac60
Instruction Fuzzy Hash: E801A237940636B7CB215A969C08A8BBF25FF00770B118125FD58AA5A1DB759C20C6D4

Function 001007B5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(0012B478,00000000,?,00101717,?,00000000,?,000EC287,?,000E5405,?,000F75A5,?,?,000E5405,?), ref: 001007BF
GetLastError.KERNEL32(?,00101717,?,00000000,?,000EC287,?,000E5405,?,000F75A5,?,?,000E5405,?,000E5445,00000001), ref: 001007C9

Strings

Failed to set begin operation event., xrefs: 001007F7
cabextract.cpp, xrefs: 001007ED

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorEventLast
String ID: Failed to set begin operation event.$cabextract.cpp
API String ID: 3848097054-4159625223
Opcode ID: 30229e7dcc3d08e80cb4d7a8204f948ca7955b59c99929fe86f46e70412c5590
Instruction ID: 1645dc9af1f65f39b973d8056b4fa03de782cb30c1ed32c008993f5878861c76
Opcode Fuzzy Hash: 30229e7dcc3d08e80cb4d7a8204f948ca7955b59c99929fe86f46e70412c5590
Instruction Fuzzy Hash: 00F0273394623067C22253955D05B8B7B88AF08B60F020122FE80B7180EB94AC10C2D5

Function 6E0F73FC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe, xrefs: 6E0F743F, 6E0F7446, 6E0F747C

Memory Dump Source

Source File: 00000002.00000002.2398326675.000000006E0E1000.00000020.00000001.01000000.00000007.sdmp, Offset: 6E0E0000, based on PE: true

Associated: 00000002.00000002.2398311786.000000006E0E0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398352677.000000006E10A000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398370970.000000006E11B000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2398386480.000000006E11D000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e0e0000_1wrLmYiC62.jbxd

Similarity

API ID:
String ID: C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe
API String ID: 0-3310044055
Opcode ID: e5f211620ec65d6852958e46d47188962db5fd400b6643699ac2c477dc0b2aee
Instruction ID: 2c5aba86992c2a173c73069ddd8e3d05c488344638e9a7c160179f39364aa7ba
Opcode Fuzzy Hash: e5f211620ec65d6852958e46d47188962db5fd400b6643699ac2c477dc0b2aee
Instruction Fuzzy Hash: 14419E71A14619EFCB158FDD8980FDEBBFCEB85750B1445AAE800D7280D7B09A52CB92

Function 000E5123 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,000E1104,?,?,00000000), ref: 000E5142
CompareStringW.KERNELBASE(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,000E1104,?,?,00000000), ref: 000E5172

Strings

burn.clean.room, xrefs: 000E512F, 000E513C, 000E5169

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: CompareStringlstrlen
String ID: burn.clean.room
API String ID: 1433953587-3055529264
Opcode ID: e57e630dbee17c04b47946451cfe9e7b35c60e05437df2398b41636401a5aa49
Instruction ID: fbaf4f9bd758aba5a687333de55dd872a3d90d48a8950fe296e462679d0166f2
Opcode Fuzzy Hash: e57e630dbee17c04b47946451cfe9e7b35c60e05437df2398b41636401a5aa49
Instruction Fuzzy Hash: 9B01D6766005607F83344F4AADC4E33B7ECEB15766B614616F909E3A20D3709C91C7A1

Function 000E3838 Relevance: 4.6, APIs: 3, Instructions: 80libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 000E3877
GetLastError.KERNEL32 ref: 000E3881
LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 000E38EA

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem
String ID:
API String ID: 1230559179-0
Opcode ID: 6f4950504b14529edf8fe3cd79fefb33da063e71bdaaee4316c41ea58a903ffa
Instruction ID: a8015908bf603b21cb81b5ffd2c15b22ccc416e2b966789b3d21ddc51d47869e
Opcode Fuzzy Hash: 6f4950504b14529edf8fe3cd79fefb33da063e71bdaaee4316c41ea58a903ffa
Instruction Fuzzy Hash: 2921F8B2D0133D6BDB209B669C49F9A7BA89B44710F1105A5BD14F7242DB70DE408BD0

Function 000E3A16 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,000E3BB6,00000000,?,000E1474,00000000,80004005,00000000,80004005,00000000,000001C7,?,000E13B8), ref: 000E3A20
RtlFreeHeap.NTDLL(00000000,?,000E3BB6,00000000,?,000E1474,00000000,80004005,00000000,80004005,00000000,000001C7,?,000E13B8,000001C7,00000100), ref: 000E3A27
GetLastError.KERNEL32(?,000E3BB6,00000000,?,000E1474,00000000,80004005,00000000,80004005,00000000,000001C7,?,000E13B8,000001C7,00000100,?), ref: 000E3A31

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: Heap$ErrorFreeLastProcess
String ID:
API String ID: 406640338-0
Opcode ID: 9006023fb413c99053f24d833e13e83825a633ca3f977b41a82eb2e83234f034
Instruction ID: 21ceee47e214d793c8b3e6328ea162d4caf657aae73e6ae27e5dcc4c3615ccfc
Opcode Fuzzy Hash: 9006023fb413c99053f24d833e13e83825a633ca3f977b41a82eb2e83234f034
Instruction Fuzzy Hash: 44D0C233A081396B833117E66C8C95B7FA8EF00BA170A0020FD44E7620D721CCA082E5

Function 000EF755 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00120F6C: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0014AAA0,00000000,?,001257E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00120F80

RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,?,000F7D59,?,?,?), ref: 000EF7B9

Part of subcall function 00121026: RegQueryValueExW.ADVAPI32(00000004,?,00000000,00000000,?,00000000,?,00000000,?,?,?,000EF78E,00000000,Installed,00000000,?), ref: 0012104B

Strings

Installed, xrefs: 000EF781

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Installed
API String ID: 3677997916-3662710971
Opcode ID: 9ef25ef4d473efd4820f3d7abcc0de1e60ba821dd6c7296a8fba9acda4dc02c6
Instruction ID: 7d817e4752d70f8f1862590742e9ef33971d6e7cfef2e132f6eb84e0f481bf51
Opcode Fuzzy Hash: 9ef25ef4d473efd4820f3d7abcc0de1e60ba821dd6c7296a8fba9acda4dc02c6
Instruction Fuzzy Hash: 0A014F36920129FFCB11DBA4C946BEEBBB8EF04711F1141A5F800A7110D7765E50D794

Function 00120F6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0014AAA0,00000000,?,001257E1,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00120F80

Strings

regutil.cpp, xrefs: 00120FC3

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: Open
String ID: regutil.cpp
API String ID: 71445658-955085611
Opcode ID: 054c0cbe39641c2701d2b3b4783ed76103c9ead04d3a8a80e11d97a2a29a5b85
Instruction ID: 640b342a8e8735e4c213968223b137943de84d8e9b5e38da4afedb8947d534bb
Opcode Fuzzy Hash: 054c0cbe39641c2701d2b3b4783ed76103c9ead04d3a8a80e11d97a2a29a5b85
Instruction Fuzzy Hash: E9F08133681235778B3145566D05BABBE45DB4C7B0F1643217D469F152E7208C3092F0

Function 0011F479 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0011F491

Part of subcall function 0012998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00129A09
Part of subcall function 0012998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00129A1A

Strings

PAct, xrefs: 0011F479, 0011F48B

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PAct
API String ID: 1269201914-2192161288
Opcode ID: 2bee8b73fbc861e4d13786d2ae620dc53c727fa729286c808e46aa690b4d4582
Instruction ID: a18c01040e66a568abc21e47f86e9579007b0e8b18b6333e28ed623781b1bb82
Opcode Fuzzy Hash: 2bee8b73fbc861e4d13786d2ae620dc53c727fa729286c808e46aa690b4d4582
Instruction Fuzzy Hash: 4EB012A92AE801BC760C11A46D02C3B010CC7D1F35772C37EB401D4060EB800C81C032

Function 0011F49A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0011F491

Part of subcall function 0012998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00129A09
Part of subcall function 0012998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00129A1A

Strings

PAct, xrefs: 0011F48B

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PAct
API String ID: 1269201914-2192161288
Opcode ID: 2ca99464e6b97eef53eb9183a985404facae38340bafe8e33f66a497586f1782
Instruction ID: c7964dfdaf96947ae6965c84d593c47ba7f0e61faeb88c981a851a6ccd3ab11a
Opcode Fuzzy Hash: 2ca99464e6b97eef53eb9183a985404facae38340bafe8e33f66a497586f1782
Instruction Fuzzy Hash: 6EB012A52AE801AD764C51A86E03C3B010CC7D5F39772417EB001C5060EB800C82C032

Function 0011F4AA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0011F491

Part of subcall function 0012998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00129A09
Part of subcall function 0012998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00129A1A

Strings

PAct, xrefs: 0011F48B

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PAct
API String ID: 1269201914-2192161288
Opcode ID: d3c0ddf6a50ca31f581da0e7d2c0d8f2e33b281147346341f9ad52822c9a0952
Instruction ID: 36ad0b01fd9df319a385a511b1c89b60b75a0bd9775340d471f9242c98f71f0c
Opcode Fuzzy Hash: d3c0ddf6a50ca31f581da0e7d2c0d8f2e33b281147346341f9ad52822c9a0952
Instruction Fuzzy Hash: 6EB012A52AE901AC764C51A86D02C3B010CC7D5F35772827EF001C5060EB900CC1C032

Function 000E3AF0 Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,000001C7,?,?,000E226D,?,000001C7,00000001,80004005,8007139F,?,?,00120267,8007139F,?,00000000), ref: 000E3B04
RtlReAllocateHeap.NTDLL(00000000,?,000E226D,?,000001C7,00000001,80004005,8007139F,?,?,00120267,8007139F,?,00000000,00000000,8007139F), ref: 000E3B0B

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 2983574f6243e5ef7f2cdf73122c6a90813818a55aeba684c0feaca728022011
Instruction ID: 56c25d2a57978eb90b77fd9915ffe1463b1889ff976400a5b6f3f13fc0b861ed
Opcode Fuzzy Hash: 2983574f6243e5ef7f2cdf73122c6a90813818a55aeba684c0feaca728022011
Instruction Fuzzy Hash: D0D0C93215820DBB8F005FE8EC4EDAA3BACEB587027088405B915C2520C739E4709B60

Function 000E394F Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,000001C7,?,000E2274,000001C7,00000001,80004005,8007139F,?,?,00120267,8007139F,?,00000000,00000000,8007139F), ref: 000E3960
RtlAllocateHeap.NTDLL(00000000,?,000E2274,000001C7,00000001,80004005,8007139F,?,?,00120267,8007139F,?,00000000,00000000,8007139F), ref: 000E3967

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 6e8eec2a7907c0d49dd1e4a200db4079554f46742e3371975dd00d9dc6839f3c
Instruction ID: 6df00d66cdc756bc58b82053e66f4eaabf128cece3ca42c3ae3ebef2342c1b66
Opcode Fuzzy Hash: 6e8eec2a7907c0d49dd1e4a200db4079554f46742e3371975dd00d9dc6839f3c
Instruction Fuzzy Hash: F1C0123219820CBB8B005FF4FC4DC56379CB7147027048400B505C2510C738E0708760

Function 001235C3 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 001235F8

Part of subcall function 0012304F: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00123609,00000000,?,00000000), ref: 00123069
Part of subcall function 0012304F: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,0010C025,?,000E5405,?,00000000,?), ref: 00123075

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorHandleInitLastModuleVariant
String ID:
API String ID: 52713655-0
Opcode ID: 258f99d6b89c3aaa0868ba7d4435bab3293fb5cb2e3125bb9562efe70c6097ba
Instruction ID: fc09bb29f72fe8378d4d5918d6c1b4a0cb9866ce8c29952c7222b3fd5960b364
Opcode Fuzzy Hash: 258f99d6b89c3aaa0868ba7d4435bab3293fb5cb2e3125bb9562efe70c6097ba
Instruction Fuzzy Hash: 01314D76E00229ABCB11DFA9D884ADEB7F8EF08710F01456AED15AB311D7759E108BA4

Function 0011521A Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00111F87,?,0000015D,?,?,?,?,001133E0,000000FF,00000000,?,?), ref: 0011524C

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6e6b9eff281efbd4b6bc33c0a4295874551c87d9b7b04acb22efd48900bf64cb
Instruction ID: 139fd807ad111d4e2e36de4365f989820fc12acedb83291de59598d83c68b0df
Opcode Fuzzy Hash: 6e6b9eff281efbd4b6bc33c0a4295874551c87d9b7b04acb22efd48900bf64cb
Instruction Fuzzy Hash: ECE02B33605A60EBDB3D26655C05BDB7B4E9FE27A1F250130AC1196090CBF0CCC041E5

Function 000E34B5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,000F8BD3,0000001C,80070490,00000000,00000000,80070490), ref: 000E34D5

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: acedb2c0363b0adaa96c909ceb05a94d42c1fdf870f08350ffbb3246af85c2fd
Instruction ID: d984f2fc4eebac09ac3dc17b23c03ad8ba1d254f538fc483a2e3376e00760cf9
Opcode Fuzzy Hash: acedb2c0363b0adaa96c909ceb05a94d42c1fdf870f08350ffbb3246af85c2fd
Instruction Fuzzy Hash: 8CE012B22011647FE6126E636C09DEB7B5CAF053547008051BE41E7151D772E55087B0

Function 00129653 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0012966B

Part of subcall function 0012998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00129A09
Part of subcall function 0012998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00129A1A

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 510e75afce5a5fa99fd32ab6486edd63f37bc40865e501aec574e7ac4d661637
Instruction ID: d9c2f1e4602e572a2cf47f395b49b03f51fcf0be1e001e788a43f24ad58f7565
Opcode Fuzzy Hash: 510e75afce5a5fa99fd32ab6486edd63f37bc40865e501aec574e7ac4d661637
Instruction Fuzzy Hash: E2B012912A9511BC7E081108BD82C3B014CDBC0B25772811EB000F4060EB800C51C233

Function 00129674 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0012966B

Part of subcall function 0012998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00129A09
Part of subcall function 0012998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00129A1A

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d6435bbba1ececb8be1737b7786a65d5517736683bfc54de06327631b4c62bbb
Instruction ID: a4e9e30ab5248c86a299a80dfbd843c886e3185f00f7d8320c0e14a4a97896cb
Opcode Fuzzy Hash: d6435bbba1ececb8be1737b7786a65d5517736683bfc54de06327631b4c62bbb
Instruction Fuzzy Hash: A6B012922A9412AC7A48510C7D03C3B01CCC7C0B25772C11EB400D5060EB800C558132

Function 00129684 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0012966B

Part of subcall function 0012998C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00129A09
Part of subcall function 0012998C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00129A1A

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cd7cd3b32f666b57358d8246182d7b74d31f4e01b3a1eef846b8a8926605db98
Instruction ID: 38210b7ad0d2b1a81b6065d5d0e8420bf67dfa5ccd7f00b8de78ac8b8e3ea83d
Opcode Fuzzy Hash: cd7cd3b32f666b57358d8246182d7b74d31f4e01b3a1eef846b8a8926605db98
Instruction Fuzzy Hash: 7EB012912A9611AC7E48514C7F43C3B018CCBC0B25772411EB004E5060EB840C52C132

Non-executed Functions

Function 0012710D Relevance: 47.5, APIs: 11, Strings: 16, Instructions: 298COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,00143E78,000000FF,?,?,?), ref: 001271D4
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,summary,000000FF), ref: 001271F9
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 00127219
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,published,000000FF), ref: 00127235
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,updated,000000FF), ref: 0012725D
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,author,000000FF), ref: 00127279
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,category,000000FF), ref: 001272B2
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,content,000000FF), ref: 001272EB

Part of subcall function 00126D50: SysFreeString.OLEAUT32(00000000), ref: 00126E89
Part of subcall function 00126D50: SysFreeString.OLEAUT32(00000000), ref: 00126EC8

SysFreeString.OLEAUT32(00000000), ref: 0012736F
SysFreeString.OLEAUT32(00000000), ref: 0012741F

Strings

`)u, xrefs: 0012736F, 0012741F
cabinet.dll, xrefs: 00127150
author, xrefs: 00127138, 0012726B
msi.dll, xrefs: 00127137
link, xrefs: 00127172, 0012731D
content, xrefs: 001272DD
title, xrefs: 0012720B
clbcatq.dll, xrefs: 00127242
feclient.dll, xrefs: 00127206
version.dll, xrefs: 00127133
(, xrefs: 0012734A
category, xrefs: 00127155, 001272A4
updated, xrefs: 0012724F
summary, xrefs: 001271EB
atomutil.cpp, xrefs: 0012740C
published, xrefs: 00127227

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: String$Compare$Free
String ID: ($`)u$atomutil.cpp$author$cabinet.dll$category$clbcatq.dll$content$feclient.dll$link$msi.dll$published$summary$title$updated$version.dll
API String ID: 318886736-4094838844
Opcode ID: 7f9e266dc0c0034e3c0493f5441ceceb3c395a50e1d49fb155da99549426c151
Instruction ID: e315b8699ec790ef646c0221d64021890b308240041313ba45bdb5c772190fa7
Opcode Fuzzy Hash: 7f9e266dc0c0034e3c0493f5441ceceb3c395a50e1d49fb155da99549426c151
Instruction Fuzzy Hash: A1A17F31A48236FBDB21AB94EC41FAE7A64FF05720F204355F921A61D1DB70EA60DB91

Function 00128134 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 309COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,00000410), ref: 00128161
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF), ref: 0012817C
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,upgrade,000000FF), ref: 0012821F
CompareStringW.KERNEL32(0000007F,00000000,00700079,000000FF,version,000000FF,000002D8,0012B518,00000000), ref: 0012825E
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exclusive,000000FF), ref: 001282B1
CompareStringW.KERNEL32(0000007F,00000000,0012B518,000000FF,true,000000FF), ref: 001282CF
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 00128307
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,enclosure,000000FF), ref: 0012844B

Strings

exclusive, xrefs: 001282A3
upgrade, xrefs: 00128211
http://appsyndication.org/2006/appsyn, xrefs: 00128154
application, xrefs: 0012816E
version, xrefs: 00128250, 001282F9
type, xrefs: 001281A7
enclosure, xrefs: 00128439
apuputil.cpp, xrefs: 0012836E
true, xrefs: 001282C1

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: CompareString
String ID: application$apuputil.cpp$enclosure$exclusive$http://appsyndication.org/2006/appsyn$true$type$upgrade$version
API String ID: 1825529933-3037633208
Opcode ID: 439c706d91d535167a8809b525e6a8d94feef7ff5f5c7b4f0ea4cdcfc4c2c86b
Instruction ID: eece36de156d88bfe877e9db6cc46d8959c079b39a36d29e0d90ad817229c5c0
Opcode Fuzzy Hash: 439c706d91d535167a8809b525e6a8d94feef7ff5f5c7b4f0ea4cdcfc4c2c86b
Instruction Fuzzy Hash: 42B1AC31A05266AFCB20DF54DC81F9A7BB6BB44730F254658F965EB2E1DB70E861CB00

Function 000EA03E Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 215COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 000EA0B6

Strings

VersionString, xrefs: 000EA0A6, 000EA131, 000EA147, 000EA15B, 000EA174, 000EA188
Language, xrefs: 000EA09F
Trying per-machine extended info for property '%ls' for product: %ls, xrefs: 000EA148
AssignmentType, xrefs: 000EA091
State, xrefs: 000EA098
Product or related product not found: %ls, xrefs: 000EA1A1
Failed to enumerate related products for upgrade code., xrefs: 000EA0F1
Failed to get product info., xrefs: 000EA1E3
Failed to copy upgrade code., xrefs: 000EA116
MsiProductSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 000EA24F
Failed to format GUID string., xrefs: 000EA0C1
Unsupported product search type: %u, xrefs: 000EA07E
Trying per-user extended info for property '%ls' for product: %ls, xrefs: 000EA175
Failed to set variable., xrefs: 000EA23C
Failed to change value type., xrefs: 000EA21D

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: Open@16
String ID: AssignmentType$Failed to change value type.$Failed to copy upgrade code.$Failed to enumerate related products for upgrade code.$Failed to format GUID string.$Failed to get product info.$Failed to set variable.$Language$MsiProductSearch failed: ID '%ls', HRESULT 0x%x$Product or related product not found: %ls$State$Trying per-machine extended info for property '%ls' for product: %ls$Trying per-user extended info for property '%ls' for product: %ls$Unsupported product search type: %u$VersionString
API String ID: 3613110473-2134270738
Opcode ID: d994256beadf44dafe8a14bb4a8a0d2bde4b6460cd80be6cd02a0e381769230f
Instruction ID: 5194e0a8693354cf073d77fb23bc63a10f53be4bd985d7560929b936619e9b10
Opcode Fuzzy Hash: d994256beadf44dafe8a14bb4a8a0d2bde4b6460cd80be6cd02a0e381769230f
Instruction Fuzzy Hash: 9661B532E40168BFCB219ADADD45EDE7BB8AB5E710F104199F904BB251D332EE109752

Function 000FF051 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 125COMMON

Download Yara Rule

APIs

Part of subcall function 000E394F: GetProcessHeap.KERNEL32(?,000001C7,?,000E2274,000001C7,00000001,80004005,8007139F,?,?,00120267,8007139F,?,00000000,00000000,8007139F), ref: 000E3960
Part of subcall function 000E394F: RtlAllocateHeap.NTDLL(00000000,?,000E2274,000001C7,00000001,80004005,8007139F,?,?,00120267,8007139F,?,00000000,00000000,8007139F), ref: 000E3967

EnterCriticalSection.KERNEL32(?,00000014,00000001), ref: 000FF06E
LeaveCriticalSection.KERNEL32(?), ref: 000FF19B

Strings

Engine is active, cannot change engine state., xrefs: 000FF089
Failed to copy the arguments., xrefs: 000FF12D
Failed to copy the id., xrefs: 000FF100
UX requested unknown approved exe with id: %ls, xrefs: 000FF0CE
Failed to post launch approved exe message., xrefs: 000FF186
EngineForApplication.cpp, xrefs: 000FF17C

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: CriticalHeapSection$AllocateEnterLeaveProcess
String ID: Engine is active, cannot change engine state.$EngineForApplication.cpp$Failed to copy the arguments.$Failed to copy the id.$Failed to post launch approved exe message.$UX requested unknown approved exe with id: %ls
API String ID: 1367039788-528931743
Opcode ID: d82357127c3f32e2c4f1923f993474f49afa49cacc3b4810e656e6af95cdc021
Instruction ID: 63a3c0922b7d7d7d3d5d3f6b68478d8cb01df52fa7af5295591e0c7d392612cc
Opcode Fuzzy Hash: d82357127c3f32e2c4f1923f993474f49afa49cacc3b4810e656e6af95cdc021
Instruction Fuzzy Hash: 1431C232A4122AEFDB219F64DC45EBA7BA8BF04720B018561FE04EB652EB71DD109790

Function 000E3076 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 210COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000040,00000000,00000000), ref: 000E30C1
GetLastError.KERNEL32 ref: 000E30C7
ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000000), ref: 000E3121
GetLastError.KERNEL32 ref: 000E3127
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 000E31DB
GetLastError.KERNEL32 ref: 000E31E5
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 000E323B
GetLastError.KERNEL32 ref: 000E3245

Strings

pathutil.cpp, xrefs: 000E30EB
@, xrefs: 000E309B

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: ErrorLast$EnvironmentExpandFullNamePathStrings
String ID: @$pathutil.cpp
API String ID: 1547313835-3022285739
Opcode ID: 57a2a49fbbeb14c9a66c30f9897e3856482f31b95e80e115a606c27e048847ac
Instruction ID: 2faa3256e7e49b89804a79676314f2495015699d26c98c87b1ae0c623b5b130e
Opcode Fuzzy Hash: 57a2a49fbbeb14c9a66c30f9897e3856482f31b95e80e115a606c27e048847ac
Instruction Fuzzy Hash: 6A619373D04269BFDB319AE6888DBDEBFA8AB04750F114169EE50BB250E7359F4087D0

Function 000E6037 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 107timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 000E6062
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,00000000,00000000), ref: 000E6076
GetLastError.KERNEL32 ref: 000E6088
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,00000000,?,00000000), ref: 000E60DC
GetLastError.KERNEL32 ref: 000E60E6

Strings

variable.cpp, xrefs: 000E60A3, 000E6101
Failed to allocate the buffer for the Date., xrefs: 000E60C4
Failed to get the Date., xrefs: 000E610B
Failed to set variant value., xrefs: 000E6124
Failed to get the required buffer length for the Date., xrefs: 000E60AD

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: DateErrorFormatLast$SystemTime
String ID: Failed to allocate the buffer for the Date.$Failed to get the Date.$Failed to get the required buffer length for the Date.$Failed to set variant value.$variable.cpp
API String ID: 2700948981-3682088697
Opcode ID: 1f27f7f55e687f7946b6e34acaa720c3075a6bf940e8a45208eb9f37dbccf227
Instruction ID: bb517b6dfcd8528617eace57dc6b2a4f63375dfc8390d61e0d6a558e5efe0b0c
Opcode Fuzzy Hash: 1f27f7f55e687f7946b6e34acaa720c3075a6bf940e8a45208eb9f37dbccf227
Instruction Fuzzy Hash: 2131EB32A402757FDB229BEAEC86EAF7BA4AB14750F110425FF00F7191D7729D5046E1

Function 000FA13A Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 222COMMON

Download Yara Rule

Strings

Failed to combine layout source with source., xrefs: 000FA2A4
WixBundleOriginalSource, xrefs: 000FA1B7
Failed to get current process directory., xrefs: 000FA1F3
WixBundleLastUsedSource, xrefs: 000FA1A1
Failed to get bundle layout directory property., xrefs: 000FA287
Failed to copy source path., xrefs: 000FA31A
WixBundleLayoutDirectory, xrefs: 000FA26C
Failed to combine last source with source., xrefs: 000FA210

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: Find$CloseFileFirstlstrlen
String ID: Failed to combine last source with source.$Failed to combine layout source with source.$Failed to copy source path.$Failed to get bundle layout directory property.$Failed to get current process directory.$WixBundleLastUsedSource$WixBundleLayoutDirectory$WixBundleOriginalSource
API String ID: 2767606509-3003062821
Opcode ID: 5d17a3814bd192bc75dd38a2137d82fcf9af17268ba0a48ae3518b6d8ef928b2
Instruction ID: 7b577428edd0ec4ceb3c02cbd7ef6256196b84bacb371be51593d26f916c8de0
Opcode Fuzzy Hash: 5d17a3814bd192bc75dd38a2137d82fcf9af17268ba0a48ae3518b6d8ef928b2
Instruction Fuzzy Hash: FE717BB1E0422DAFCF129FA8D841AFEB7F9AF09310F110125FA04B7651D731AE409B62

Function 000F50CA Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,?,?,0012B500), ref: 000F50D3
GetProcessId.KERNEL32(000000FF,?,?,open,00000000,00000000,?,000000FF,?,?), ref: 000F5171
CloseHandle.KERNEL32(00000000), ref: 000F518A

Strings

burn.elevated, xrefs: 000F50F3
-q -%ls %ls %ls %u, xrefs: 000F50F8
runas, xrefs: 000F5131
Failed to launch elevated child process: %ls, xrefs: 000F515E
open, xrefs: 000F513B, 000F5149
Failed to allocate parameters for elevated process., xrefs: 000F510C

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: Process$CloseCurrentHandle
String ID: -q -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to launch elevated child process: %ls$burn.elevated$open$runas
API String ID: 2815245435-1352204306
Opcode ID: b3785e68daf163b1d174f98b86d265a0c1c803f1c6c9fb9168bd888081508105
Instruction ID: bcf2e73b94613af78d1e04e4e73d5e3a4c59c90960c22b569068e89dbdc16559
Opcode Fuzzy Hash: b3785e68daf163b1d174f98b86d265a0c1c803f1c6c9fb9168bd888081508105
Instruction Fuzzy Hash: 56217C75D0161DFFCF119F94DC819AEBBB8FF08351F50816AFA14A2611D731AE60AB90

Function 000F9098 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 89fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000101,?,000F9F04,00000003,000007D0,00000003,?,000007D0), ref: 000F90B2
GetLastError.KERNEL32(?,000F9F04,00000003,000007D0,00000003,?,000007D0,00000000,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001,?), ref: 000F90BF
CloseHandle.KERNEL32(00000000,?,000F9F04,00000003,000007D0,00000003,?,000007D0,00000000,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001), ref: 000F9187

Strings

cache.cpp, xrefs: 000F90F6
Failed to open payload at path: %ls, xrefs: 000F9103
Failed to verify signature of payload: %ls, xrefs: 000F912F
Failed to verify catalog signature of payload: %ls, xrefs: 000F914E
Failed to verify hash of payload: %ls, xrefs: 000F9172

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: Failed to open payload at path: %ls$Failed to verify catalog signature of payload: %ls$Failed to verify hash of payload: %ls$Failed to verify signature of payload: %ls$cache.cpp
API String ID: 2528220319-2757871984
Opcode ID: 979eb3a85ae9f6de381cbf35ca95f2235bccb08d581297d507827faa79e3bc5d
Instruction ID: 3aebe89afeed9697e42a6a42a284b822c3139f0a1ae1fa6831618e8e5c53f0a2
Opcode Fuzzy Hash: 979eb3a85ae9f6de381cbf35ca95f2235bccb08d581297d507827faa79e3bc5d
Instruction Fuzzy Hash: CD21D33654062EB7CB331A648C4DFBA7B68BF44760F104321FE14669E197229C61FAD1

Function 000EF005 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 96registryCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000001,000000FF,?,000000FF,00000001,PackageVersion,00000001,?,000F0654,00000001,00000001,00000001,000F0654,00000000), ref: 000EF07D
RegCloseKey.ADVAPI32(00000000,00000001,PackageVersion,00000001,?,000F0654,00000001,00000001,00000001,000F0654,00000000,00000001,00000000,?,000F0654,00000001), ref: 000EF09A

Strings

PackageVersion, xrefs: 000EF05E
Failed to format key for update registration., xrefs: 000EF033
Failed to remove update registration key: %ls, xrefs: 000EF0C7

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: CloseCompareString
String ID: Failed to format key for update registration.$Failed to remove update registration key: %ls$PackageVersion
API String ID: 446873843-3222553582
Opcode ID: 439a58f67932765f9e9daba0671063d6a5d8e76a109638b5f5283d421dd20082
Instruction ID: 3aae65d05aa8887a3daaa7b3298afcf856f8cafe1c7544ce6268ccde10451816
Opcode Fuzzy Hash: 439a58f67932765f9e9daba0671063d6a5d8e76a109638b5f5283d421dd20082
Instruction Fuzzy Hash: 3121813190126ABFCB21ABA6DD49FBEBFB8EF14720F104265F914B2152E7318A50D690

Function 00124019 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,000E4DBC,00000000,?,?,00000000,?,0012412D,00000000,000E4DBC,00000000,00000000,?,000F85EE,?,?), ref: 00124033
GetLastError.KERNEL32(?,0012412D,00000000,000E4DBC,00000000,00000000,?,000F85EE,?,?,00000001,00000003,000007D0,?,?,?), ref: 00124041
CopyFileW.KERNEL32(00000000,000E4DBC,00000000,000E4DBC,00000000,?,0012412D,00000000,000E4DBC,00000000,00000000,?,000F85EE,?,?,00000001), ref: 001240AC
GetLastError.KERNEL32(?,0012412D,00000000,000E4DBC,00000000,00000000,?,000F85EE,?,?,00000001,00000003,000007D0,?,?,?), ref: 001240B6

Strings

fileutil.cpp, xrefs: 001240D5

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: CopyErrorFileLast
String ID: fileutil.cpp
API String ID: 374144340-2967768451
Opcode ID: 81ad88e8d75ef386d9bb28f2814b694fde8b8308f67bd507de357a9d130b4094
Instruction ID: 8369ec34bc97cb4cad4c0b0d9864971d5dcebb428dea80a51984792df2ac7fb9
Opcode Fuzzy Hash: 81ad88e8d75ef386d9bb28f2814b694fde8b8308f67bd507de357a9d130b4094
Instruction Fuzzy Hash: A021D736A01376ABDB310A967C80BFB7698EF14B60B160135FF05DB151EB519CF092E9

Function 001210B5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0012112B
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00121163

Strings

regutil.cpp, xrefs: 001211A9

Memory Dump Source

Source File: 00000002.00000002.2397577670.00000000000E1000.00000020.00000001.01000000.00000005.sdmp, Offset: 000E0000, based on PE: true

Associated: 00000002.00000002.2397535331.00000000000E0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397635672.000000000012B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397675444.000000000014A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2397690229.000000000014D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_e0000_1wrLmYiC62.jbxd

Similarity

API ID: QueryValue
String ID: regutil.cpp
API String ID: 3660427363-955085611
Opcode ID: a6d3c7028d3dc8991a2cb58759c4c6ec791db29046c8bc2df90845d23a0c9b50
Instruction ID: 556ad44acb12a6031cd87c6e4d66efd5696ccf1e78d2e9940aaee6e07c4a4991
Opcode Fuzzy Hash: a6d3c7028d3dc8991a2cb58759c4c6ec791db29046c8bc2df90845d23a0c9b50
Instruction Fuzzy Hash: 8F417032D0023ABBDB20DFA59C419EEBBB9FF24350F214569FA10A7251D7319E719B90

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1wrLmYiC62.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\LocalCtrl_alpha_v3.exe

C:\Users\user\AppData\Local\Temp\Scabbard_20250109085418.log

C:\Users\user\AppData\Local\Temp\b2747b23

C:\Users\user\AppData\Local\Temp\c83ee8cc

C:\Users\user\AppData\Local\Temp\lrx

C:\Users\user\AppData\Local\Temp\tgiwin

C:\Users\user\AppData\Local\Temp\ykvbphfmiswk

C:\Users\user\AppData\Roaming\PatchReaderWCF\AXE8SharedExpat.dll

C:\Users\user\AppData\Roaming\PatchReaderWCF\AdobeSync.exe

C:\Users\user\AppData\Roaming\PatchReaderWCF\BIB.dll

C:\Users\user\AppData\Roaming\PatchReaderWCF\choirgirl.pdf

C:\Users\user\AppData\Roaming\PatchReaderWCF\intermixture.zip

C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcp90.dll

C:\Users\user\AppData\Roaming\PatchReaderWCF\msvcr90.dll

C:\Users\user\AppData\Roaming\PatchReaderWCF\sqlite.dll

C:\Windows\Temp\{24838F2D-E61B-4F26-8FE2-D9BADED07C2D}\.cr\1wrLmYiC62.exe

C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AXE8SharedExpat.dll

C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\AdobeSync.exe

C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\BIB.dll

C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\BootstrapperApplicationData.xml

C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\Quadruple.dll

C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\choirgirl.pdf

C:\Windows\Temp\{36C50972-238F-4D65-B4AC-8D70275570F8}\.ba\intermixture.zip

Windows Analysis Report
1wrLmYiC62.exe

Function 006A3CC4 Relevance: 45.8, APIs: 23, Strings: 3, Instructions: 320
fileCOMMON

Function 006A5195 Relevance: 38.8, APIs: 5, Strings: 17, Instructions: 315
COMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre