Play interactive tour

Edit tour

Analysis Report anchorAsjuster_x64.exe

Overview

General Information

Sample Name:	anchorAsjuster_x64.exe
Analysis ID:	381815
MD5:	9fbc3d560d075f33a15aa67ae74ac6ef
SHA1:	a298c6f5f8902fb581a1b5b922f95b362747f9a7
SHA256:	3ab8a1ee10bd1b720e1c8a8795e78cdc09fec73a6bb91526c0ccd2dc2cfbc28d
Infos:
Most interesting Screenshot:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found large amount of non-executed APIs

PE file contains sections with non-standard names

Program does not show much activity (idle)

Classification

Startup

System is w10x64

anchorAsjuster_x64.exe (PID: 6848 cmdline: 'C:\Users\user\Desktop\anchorAsjuster_x64.exe' MD5: 9FBC3D560D075F33A15AA67AE74AC6EF)

conhost.exe (PID: 6860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: anchorAsjuster_x64.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe

Code function: 0_2_00007FF7FE6FBCE8 FindFirstFileExA,

0_2_00007FF7FE6FBCE8

Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE6F3694	0_2_00007FF7FE6F3694
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE6F9F6C	0_2_00007FF7FE6F9F6C
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE6F410C	0_2_00007FF7FE6F410C
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE6FD8E8	0_2_00007FF7FE6FD8E8
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE6EF8C0	0_2_00007FF7FE6EF8C0
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE6FED70	0_2_00007FF7FE6FED70
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE6EFDDA	0_2_00007FF7FE6EFDDA
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE70062C	0_2_00007FF7FE70062C
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE6EEE9C	0_2_00007FF7FE6EEE9C
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE6E2378	0_2_00007FF7FE6E2378
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE6ED414	0_2_00007FF7FE6ED414
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE6E5BF0	0_2_00007FF7FE6E5BF0
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE6F43F0	0_2_00007FF7FE6F43F0
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE6EF478	0_2_00007FF7FE6EF478
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE6FB184	0_2_00007FF7FE6FB184
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE7011C0	0_2_00007FF7FE7011C0
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE6ED198	0_2_00007FF7FE6ED198
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE6FBADC	0_2_00007FF7FE6FBADC

Source: classification engine

Classification label: clean4.winEXE@2/1@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6860:120:WilError_01

Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\anchorAsjuster_x64.exe 'C:\Users\user\Desktop\anchorAsjuster_x64.exe'
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: anchorAsjuster_x64.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: anchorAsjuster_x64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: anchorAsjuster_x64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: anchorAsjuster_x64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: anchorAsjuster_x64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: anchorAsjuster_x64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: anchorAsjuster_x64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: anchorAsjuster_x64.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source: anchorAsjuster_x64.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: anchorAsjuster_x64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: anchorAsjuster_x64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: anchorAsjuster_x64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: anchorAsjuster_x64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: anchorAsjuster_x64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: anchorAsjuster_x64.exe

Static PE information: section name: .table

Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe

Code function: 0_2_00007FF7FE6E5BF0 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF7FE6E5BF0

Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe

API coverage: 8.2 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe

Code function: 0_2_00007FF7FE6FBCE8 FindFirstFileExA,

0_2_00007FF7FE6FBCE8

Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe

Code function: 0_2_00007FF7FE6E6F90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7FE6E6F90

Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe

Code function: 0_2_00007FF7FE6F9DA4 GetProcessHeap,

0_2_00007FF7FE6F9DA4

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE6E6B1C SetUnhandledExceptionFilter,_invalid_parameter_noinfo,	0_2_00007FF7FE6E6B1C
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE6E6F90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7FE6E6F90
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE6EA524 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7FE6EA524
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE6E7174 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7FE6E7174
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: 0_2_00007FF7FE6E712C SetUnhandledExceptionFilter,	0_2_00007FF7FE6E712C

Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe

Code function: 0_2_00007FF7FE6FB5C0 cpuid

0_2_00007FF7FE6FB5C0

Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: EnumSystemLocalesW,	0_2_00007FF7FE6FF7A4
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF7FE6FF83C
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: EnumSystemLocalesW,	0_2_00007FF7FE6F589C
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF7FE6FFDB4
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: GetLocaleInfoW,	0_2_00007FF7FE6F5E28
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: EnumSystemLocalesW,	0_2_00007FF7FE6FF6D4
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF7FE6FFBCC
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: TranslateName,TranslateName,IsValidCodePage,wcschr,wcschr,GetLocaleInfoW,	0_2_00007FF7FE6FF3C8
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: GetLocaleInfoW,	0_2_00007FF7FE6FFC7C
Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe	Code function: GetLocaleInfoW,	0_2_00007FF7FE6FFA80

Source: C:\Users\user\Desktop\anchorAsjuster_x64.exe

Code function: 0_2_00007FF7FE6E7410 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7FE6E7410

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Application Shimming1	Process Injection1	Process Injection1	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Application Shimming1	Rootkit	LSASS Memory	Security Software Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	File and Directory Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery22	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
anchorAsjuster_x64.exe	0%	Virustotal	Browse
anchorAsjuster_x64.exe	0%	Metadefender	Browse
anchorAsjuster_x64.exe	0%	ReversingLabs

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	381815
Start date:	05.04.2021
Start time:	07:43:06
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	anchorAsjuster_x64.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean4.winEXE@2/1@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.8% (good quality ratio 89.1%) Quality average: 66.7% Quality standard deviation: 32.4%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, MusNotifyIcon.exe, backgroundTaskHost.exe, svchost.exe, UsoClient.exe, wuapihost.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

\Device\ConDrv Download File
Process:	C:\Users\user\Desktop\anchorAsjuster_x64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	187
Entropy (8bit):	4.545348375410866
Encrypted:	false
SSDEEP:	3:DKRiarkqIW6ASHXKmNFdQIRWE9bG7B0QnVfLNs2FpEfagI7K3Zd1iLGzu:UiavIf2mNF4PnVfLNNqaN7K3HgLGC
MD5:	BAED04BFD3B79BC98853D251DBA62A67
SHA1:	5498DCB595F174BB218818DCB52ABCDA3708C4C0
SHA-256:	8C0065330440AED0572ACE8B2280C3AD791BDAECBB7365500BD920D4DA76E67E
SHA-512:	2852D4B7C28FAF760D649B2656D6BAE801F2DFD31A92FF746700223945BA68DE43A89CB6EB74C39F1F6ADDC53E459EF46D305A0E27EFA396891A39C918B5A986
Malicious:	false
Reputation:	low
Preview:	using:..anchorAdjuster* --source=<source file> --target=<target file> --domain=<domain name> --period=<recurrence interval, minutes, default value 15> -guid --count=<count of instances>..

Static File Info

General
File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.213531483690189
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	anchorAsjuster_x64.exe
File size:	251904
MD5:	9fbc3d560d075f33a15aa67ae74ac6ef
SHA1:	a298c6f5f8902fb581a1b5b922f95b362747f9a7
SHA256:	3ab8a1ee10bd1b720e1c8a8795e78cdc09fec73a6bb91526c0ccd2dc2cfbc28d
SHA512:	9a931c1097f1dab9c9cdad72d4e6bfee5de0fceb42ba2abf8e0465e14a9f70398859ac04fe6f95da29f12b9141064e3bf266466c88fb5d124a3c9712f0f8226b
SSDEEP:	6144:Hd4lhu6GoFmaVZtN2TsiLgTU/vvst+/VbuohslJ89:4h/xxVLgTs0Eo1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......gLt.#-..#-..#-......)-.......-......:-...s..+-......&-..#-..F-...s...-...s...-...s.."-...s.."-...s.."-..Rich#-..........PE..d..

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x140006cb0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x5FB663CB [Thu Nov 19 12:23:39 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	9859b7a32d1227be2ca925c81ae9265e

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F02D8B15D4Ch
dec eax
add esp, 28h
jmp 00007F02D8B1546Bh
int3
int3
dec eax
jmp dword ptr [000205EDh]
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
sub esp, 10h
dec esp
mov dword ptr [esp], edx
dec esp
mov dword ptr [esp+08h], ebx
dec ebp
xor ebx, ebx
dec esp
lea edx, dword ptr [esp+18h]
dec esp
sub edx, eax
dec ebp
cmovb edx, ebx
dec esp
mov ebx, dword ptr [00000010h]
dec ebp
cmp edx, ebx
jnc 00007F02D8B1560Ah
inc cx
and edx, 8D4DF000h
wait
add al, dh

Rich Headers

Programming Language:

[C++] VS2015 UPD3.1 build 24215
[LNK] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3aa54	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x44000	0x288	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x3f000	0x201c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x45000	0xc9c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x37130	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x371e8	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x37150	0x94	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x27000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x241e4	0x24200	False	0.565541198097	data	6.49668233417	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.table	0x26000	0x10	0x200	False	0.056640625	ASCII text, with no line terminators	0.325622324313	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x27000	0x1437a	0x14400	False	0.454005111883	data	5.10892339018	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3c000	0x2a44	0x1200	False	0.183376736111	DOS executable (block device driver)	2.91992785428	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0x3f000	0x201c	0x2200	False	0.465303308824	data	5.15876908171	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gfids	0x42000	0x25c	0x400	False	0.3408203125	data	2.58710213479	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x43000	0x9	0x200	False	0.033203125	data	0.0203931352361	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x44000	0x288	0x400	False	0.33203125	data	3.84963157688	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x45000	0xc9c	0xe00	False	0.394810267857	data	5.25273619363	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_MANIFEST	0x44060	0x224	XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	English	United States

Imports

DLL

Import

ole32.dll

CoInitialize, CoCreateGuid, CoUninitialize

KERNEL32.dll

GetLastError, HeapSize, WriteConsoleW, CreateFileW, GetTickCount, WideCharToMultiByte, EncodePointer, DecodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, MultiByteToWideChar, SetLastError, InitializeCriticalSectionAndSpinCount, CreateEventW, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, CompareStringW, LCMapStringW, GetLocaleInfoW, GetStringTypeW, GetCPInfo, CloseHandle, SetEvent, ResetEvent, WaitForSingleObjectEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, InitializeSListHead, RtlPcToFileHeader, RaiseException, RtlUnwindEx, SetEndOfFile, FreeLibrary, LoadLibraryExW, HeapAlloc, HeapFree, HeapReAlloc, ExitProcess, GetModuleHandleExW, GetModuleFileNameA, GetStdHandle, WriteFile, GetCommandLineA, GetCommandLineW, GetACP, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, ReadFile, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleCP, FlushFileBuffers, GetProcessHeap, FindClose, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetStdHandle

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: anchorAsjuster_x64.exe PID: 6848 Parent PID: 5916

General

Start time:	07:43:50
Start date:	05/04/2021
Path:	C:\Users\user\Desktop\anchorAsjuster_x64.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\anchorAsjuster_x64.exe'
Imagebase:	0x7ff7fe6e0000
File size:	251904 bytes
MD5 hash:	9FBC3D560D075F33A15AA67AE74AC6EF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 6860 Parent PID: 6848

General

Start time:	07:43:51
Start date:	05/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: anchorAsjuster_x64.exe PID: 6848 Parent PID: 5916 anchorAsjuster_x64.exeCOMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.5%
Total number of Nodes:	1809
Total number of Limit Nodes:	44

Executed Functions

Function 00007FF7FE6E6B1C, Relevance: 3.0, APIs: 2, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNELBASE ref: 00007FF7FE6E6B25
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6F50BC

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: ExceptionFilterUnhandled_invalid_parameter_noinfo
String ID:
API String ID: 59578552-0
Opcode ID: 159eb25e2cbf39c461c3f6ecaf588293ec2cf8291aefdc939d2844f42b6c6860
Instruction ID: bdb6f5e04cbe581a6710ff05079da9c339702b03afacaa2e21573d7742b15651
Opcode Fuzzy Hash: 159eb25e2cbf39c461c3f6ecaf588293ec2cf8291aefdc939d2844f42b6c6860
Instruction Fuzzy Hash: 68E0B620E1E24A81EB1937658C460BCB5925FC6320FE14235E139422C2DD5E28965AF6

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F3694, Relevance: 1.4, Strings: 1, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

Strings

@, xrefs: 00007FF7FE6F36D0

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 495459152d8e14109708215dc7ee05e4bbcec53fa4a59622d9b0a4d49fceb096
Instruction ID: b2ff16f71c5381f551923a2031094ccdc548436592766d293f7c62e41364bd29
Opcode Fuzzy Hash: 495459152d8e14109708215dc7ee05e4bbcec53fa4a59622d9b0a4d49fceb096
Instruction Fuzzy Hash: 2341C772714B4885EF04DF29E9152A9B7A2F788FD4B999036DE2D8B794EE3CD045C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6E29BC, Relevance: 21.2, APIs: 2, Strings: 10, Instructions: 193
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00007FF7FE6E2B60
strchr.LIBVCRUNTIME ref: 00007FF7FE6E2BB6

Strings

--lasthope=, xrefs: 00007FF7FE6E2ACB
--source=, xrefs: 00007FF7FE6E2A27
using:, xrefs: 00007FF7FE6E2C77
--target=, xrefs: 00007FF7FE6E2A75
d, xrefs: 00007FF7FE6E29F5
--count=, xrefs: 00007FF7FE6E2AF5
-guid, xrefs: 00007FF7FE6E2B25
--period=, xrefs: 00007FF7FE6E2A9C
--domain=, xrefs: 00007FF7FE6E2A4E
anchorAdjuster* --source=<source file> --target=<target file> --domain=<domain name> --period=<recurrence interval, minutes, default value 15> -guid --count=<count of instances>, xrefs: 00007FF7FE6E2C8A

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: CountTickstrchr
String ID: --count=$--domain=$--lasthope=$--period=$--source=$--target=$-guid$anchorAdjuster* --source=<source file> --target=<target file> --domain=<domain name> --period=<recurrence interval, minutes, default value 15> -guid --count=<count of instances>$d$using:
API String ID: 1893270519-3487731759
Opcode ID: fade20d14169afba7397ea3c7ac73c2f98e331ecb78b4ec49484030b262b6cfc
Instruction ID: c45fb070c15f73f17a357a70a458144931de838f4bffc2710720c4c570c2a34a
Opcode Fuzzy Hash: fade20d14169afba7397ea3c7ac73c2f98e331ecb78b4ec49484030b262b6cfc
Instruction Fuzzy Hash: 5581C461B2864A81E720BF16E8402BAB253FFC4788F800435EE6E476D5EE3DE50487B5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6E6B38, Relevance: 13.6, APIs: 9, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7FE6E6B4C

Part of subcall function 00007FF7FE6E6384: __vcrt_initialize.LIBVCRUNTIME ref: 00007FF7FE6E63A6

__scrt_fastfail.LIBCMT ref: 00007FF7FE6E6B5A

Part of subcall function 00007FF7FE6E6F90: IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7FE6E6FAC
Part of subcall function 00007FF7FE6E6F90: RtlCaptureContext.KERNEL32 ref: 00007FF7FE6E6FD5
Part of subcall function 00007FF7FE6E6F90: RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7FE6E6FEF
Part of subcall function 00007FF7FE6E6F90: RtlVirtualUnwind.KERNEL32 ref: 00007FF7FE6E7030
Part of subcall function 00007FF7FE6E6F90: IsDebuggerPresent.KERNEL32 ref: 00007FF7FE6E7084
Part of subcall function 00007FF7FE6E6F90: SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7FE6E70A5
Part of subcall function 00007FF7FE6E6F90: UnhandledExceptionFilter.KERNEL32 ref: 00007FF7FE6E70B0

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7FE6E6B68
__scrt_fastfail.LIBCMT ref: 00007FF7FE6E6B7F
__scrt_release_startup_lock.LIBCMT ref: 00007FF7FE6E6BDC
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF7FE6E6BF2
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF7FE6E6C22
__scrt_is_managed_app.LIBCMT ref: 00007FF7FE6E6C57
__scrt_uninitialize_crt.LIBCMT ref: 00007FF7FE6E6C75

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled__scrt_fastfail__scrt_is_nonwritable_in_current_image$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual__scrt_acquire_startup_lock__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__vcrt_initialize
String ID:
API String ID: 18626834-0
Opcode ID: c727223c7c0e2d7c3fb50e86c9fc76fd75c7e5b2ca5edfc4096e583f0baa3e2d
Instruction ID: 6e4ae06a5cd8f37d0bd53e86d3a73d6dc907467447283f85d92c51d0ca9016e0
Opcode Fuzzy Hash: c727223c7c0e2d7c3fb50e86c9fc76fd75c7e5b2ca5edfc4096e583f0baa3e2d
Instruction Fuzzy Hash: 28311B21A0C24B41FB14BB21D4163BDB252AFD5B88FC44034DA6D0B6D7DE2EE40587FA

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F8698, Relevance: 7.7, APIs: 5, Instructions: 203
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6F86DD

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: fd95fa4c40e317e7e346000eb48cd411282434af6e6a88d47c0d43e9e537f49e
Instruction ID: 30c1a290ba6ba5546f2f65ab8f87fb4a639ced0e3c3ef27de21e326d489f2d1d
Opcode Fuzzy Hash: fd95fa4c40e317e7e346000eb48cd411282434af6e6a88d47c0d43e9e537f49e
Instruction Fuzzy Hash: DC81A322E1869A85F750BB65D8406BDB6A2BBC47A8F804175DE3E136D5EF3CD402D3B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F5934, Relevance: 7.6, APIs: 5, Instructions: 114
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00007FF7FE6F5A56

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: f63fca2c52a6ce74f8536f3d751d68a3d372941bc66a1312dadced8dd29aafa6
Instruction ID: d8318df177b747456a74192b3b7dd1a788a1600e375cc1d732e640e9031f3093
Opcode Fuzzy Hash: f63fca2c52a6ce74f8536f3d751d68a3d372941bc66a1312dadced8dd29aafa6
Instruction Fuzzy Hash: 08410821B0A68651FB15BB51E844675B396BFD8BA0F994535DD3D4B7C4FE3CEC0082A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F650C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF7FE6F657E
GetFileType.KERNELBASE ref: 00007FF7FE6F6594

Strings

@, xrefs: 00007FF7FE6F65BF

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 7e99853ccf123c9b3ef95bf79d6f646c56918e65f57f940ccd8c991fbe2184da
Instruction ID: 412e6f20f82ccc2046ea5beeaf6b2184dba0f9e416badb99093baeeddbd98045
Opcode Fuzzy Hash: 7e99853ccf123c9b3ef95bf79d6f646c56918e65f57f940ccd8c991fbe2184da
Instruction Fuzzy Hash: DF21A232A0878641EB609B28949013CB66AEBD5775F681335D67F167DDDE3CD881C3E0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F2C78, Relevance: 4.5, APIs: 3, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7FE6F2C5C), ref: 00007FF7FE6F2CA0
TerminateProcess.KERNEL32(?,?,?,00007FF7FE6F2C5C), ref: 00007FF7FE6F2CAB
ExitProcess.KERNEL32 ref: 00007FF7FE6F2CBA

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 257d08f874acdffc154caf510c442649b6ec70d0579bcd948740e2a49a55064e
Instruction ID: 7676c1a6c3492e22438750242d35d7a00830e7d6607768f4aeb430d88e6d4cf2
Opcode Fuzzy Hash: 257d08f874acdffc154caf510c442649b6ec70d0579bcd948740e2a49a55064e
Instruction Fuzzy Hash: 02E09A30A0978942EB54BB219D8527972536FCCB45F405478DD2A063D6EE7DA44986F0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6EE640, Relevance: 3.1, APIs: 2, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6EE670
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6EE70C

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a71be569c3a767861cc1254fb292b1edeb05b760f8d20c45b091ef51da319c00
Instruction ID: b86df3169d1c31aada48eae52daf79ec73eb936cfbf38a135e44b6df8450757f
Opcode Fuzzy Hash: a71be569c3a767861cc1254fb292b1edeb05b760f8d20c45b091ef51da319c00
Instruction Fuzzy Hash: 0631F372A0864A82EF18BB20D850179B763AFD47D4FD84131EA3E472C1DF6EE401C2A7

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F8214, Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE ref: 00007FF7FE6F82CA
GetLastError.KERNEL32 ref: 00007FF7FE6F82E6

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: a725ebd09deba37474db4c153e3535457a2e46ad4c509344615a2649c9ccd658
Instruction ID: 5ba97e2eb928e701f52eee97b53ccb1d4c27498568a029e2ca46bc1b8a1f5f16
Opcode Fuzzy Hash: a725ebd09deba37474db4c153e3535457a2e46ad4c509344615a2649c9ccd658
Instruction Fuzzy Hash: E331D732A18A8586E710AF25E4443A9B761F788784F848031EF6D87795EF3CD505DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6E42F4, Relevance: 1.7, APIs: 1, Instructions: 163
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a96bd36c65253213ad1d07e261f8b18e410cffb1edd54ff0e3da5cf0f683fdb8
Instruction ID: a5c7c302e347aef3db8a7dd9b8be4a15c973880a5d77e3f4f8ebcac5c999a23d
Opcode Fuzzy Hash: a96bd36c65253213ad1d07e261f8b18e410cffb1edd54ff0e3da5cf0f683fdb8
Instruction Fuzzy Hash: 0C61CF62B04A8AD9EB50EF65C0502ADB3A6FB88788F808432DE1D537C9DF39C945C395

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F2B0C, Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7FE6F2B34

Part of subcall function 00007FF7FE6F2CC4: GetModuleHandleExW.KERNEL32 ref: 00007FF7FE6F2CE4
Part of subcall function 00007FF7FE6F2CC4: GetProcAddress.KERNEL32 ref: 00007FF7FE6F2CFA
Part of subcall function 00007FF7FE6F2CC4: FreeLibrary.KERNEL32 ref: 00007FF7FE6F2D1F

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 9feacc6298cae4d7de8ea306e0f3647fcb7a771910baedead047ab25fcac7573
Instruction ID: 81da37883283e007602d26e53352cd8361d98b112f605dbc7e3cae7d6e84db00
Opcode Fuzzy Hash: 9feacc6298cae4d7de8ea306e0f3647fcb7a771910baedead047ab25fcac7573
Instruction Fuzzy Hash: D241A221E0968682FB64BB14D850179F266BFD8B48F804439DA3D476E5EF7DE84087F0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F85AC, Relevance: 1.6, APIs: 1, Instructions: 68
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d82b6fecb4a822c338aa247da3441fec8b235b63d4424682bb0735f9d224ef51
Instruction ID: 6b7c008c64bb7301c4b9ed2715414152a3ca4503c1d4dc7ee6a06cb4d911b837
Opcode Fuzzy Hash: d82b6fecb4a822c338aa247da3441fec8b235b63d4424682bb0735f9d224ef51
Instruction Fuzzy Hash: 13219F22E1828A46E7457F26AC45269B662ABC07A4F864534E93D073C2DE7CE44187E5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6FD3B8, Relevance: 1.6, APIs: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6FD3EC

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2f696ebc7c3673e3f6253bd44d1b20d5d9b33c7624da8f7b7f76de14cd177dcf
Instruction ID: 2f84a42a204bcf366772ecb211439b89c4969b561d31a952ed438595dc2a710e
Opcode Fuzzy Hash: 2f696ebc7c3673e3f6253bd44d1b20d5d9b33c7624da8f7b7f76de14cd177dcf
Instruction Fuzzy Hash: BB113A2291C6C682E710BB14E840279B2A6FBD4390FC50535EABD476D6EF3CF44187E2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6EEBB0, Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL ref: 00007FF7FE6EEC05

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 03571549b0c6561bd0dc7d176b1fce8719eacd9a75a5e42c512c10ed516a919a
Instruction ID: 50422c3ec45140e878b65d881844e65d2eec0ae30e3a27ac8e69df1c5145b8c2
Opcode Fuzzy Hash: 03571549b0c6561bd0dc7d176b1fce8719eacd9a75a5e42c512c10ed516a919a
Instruction Fuzzy Hash: FBF06214B0A20F40FF5877A19D113B5A2925FC8B50FCC0431D93E463D1ED5DE48552FA

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6EF7DC, Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL ref: 00007FF7FE6EF81A

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a238cd8cb2d1ae0599397dce83b864478c7c9058b4e4a55bea63dfeb286417c1
Instruction ID: d3ba6e32b622f3b7690f4edc8c5da67746c187e0dc5bcdc63411962e987b2ca3
Opcode Fuzzy Hash: a238cd8cb2d1ae0599397dce83b864478c7c9058b4e4a55bea63dfeb286417c1
Instruction Fuzzy Hash: DFF0FE11F0A24B46FB547662A85167AB3A25FC8770FC85630D93E462C1EE2EA44181F6

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE705184, Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

RtlDecodePointer.NTDLL ref: 00007FF7FE7051AA

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: DecodePointer
String ID:
API String ID: 3527080286-0
Opcode ID: e3709c2417da4e9d55945c5d4d2b7fe6f3bad68f4440f6c8e6a1f80209b50f9b
Instruction ID: 258c47244b415de836608852270c7c1eb66272c29cbe5e1eb69b91de1e00266a
Opcode Fuzzy Hash: e3709c2417da4e9d55945c5d4d2b7fe6f3bad68f4440f6c8e6a1f80209b50f9b
Instruction Fuzzy Hash: 34E0A524A1AB0681EB25A755E804038A252AF9D774B940B34CABE063E0EF2DA15682B5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6E65D8, Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00007FF7FE6E65DC

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: 912773467d3b3c5d449051a259f23f146562a37bc44ecb42320ce9d65bd6821d
Instruction ID: 484cbe64c7800d0a59fb25e90339e3cca23bb1fbc65a0ba4e7cea1ef60fbba27
Opcode Fuzzy Hash: 912773467d3b3c5d449051a259f23f146562a37bc44ecb42320ce9d65bd6821d
Instruction Fuzzy Hash: 9EA01214FB100F40560432754846078004047E4310FC01631C008C06D2CC0C00E60511

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6EF83C, Relevance: 1.3, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f13d37a55545c32cedde36c89744dd33cdc27e4eff961be9276492c0e6bdb340
Instruction ID: f3f250842c227dc1ac12f03dd5e4511573efbc082da5f97149a8e8d53d5cf4c7
Opcode Fuzzy Hash: f13d37a55545c32cedde36c89744dd33cdc27e4eff961be9276492c0e6bdb340
Instruction Fuzzy Hash: 14017544E1D64B43FF547661990057AF3A25FD47F4FC84530D93D462C5ED2DA40042FA

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF7FE6E2378, Relevance: 94.8, APIs: 13, Strings: 41, Instructions: 273stringCOMMON

Download Yara Rule

APIs

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7FE6E23C1

Part of subcall function 00007FF7FE6EB6B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6EB6D8

fgetpos.LIBCMT ref: 00007FF7FE6E24FB

Part of subcall function 00007FF7FE6EB854: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6EB873

wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7FE6E252B
_fread_nolock.LIBCMT ref: 00007FF7FE6E2551

Part of subcall function 00007FF7FE6EBB20: fread_s.LIBCMT ref: 00007FF7FE6EBB33

CoInitialize.OLE32 ref: 00007FF7FE6E25D3
CoCreateGuid.OLE32 ref: 00007FF7FE6E25DD
CoUninitialize.OLE32 ref: 00007FF7FE6E25EC
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7FE6E2632
strchr.LIBVCRUNTIME ref: 00007FF7FE6E26C6
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7FE6E2711
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7FE6E2768
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7FE6E2784
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7FE6E27A7

Strings

BBBB, xrefs: 00007FF7FE6E249A
BBBB, xrefs: 00007FF7FE6E2485
BBBB, xrefs: 00007FF7FE6E23F0
BBBB, xrefs: 00007FF7FE6E2423
domain: shift 0x%08X(%i), xrefs: 00007FF7FE6E2707
BBBB, xrefs: 00007FF7FE6E2493
BBBB, xrefs: 00007FF7FE6E2477
error create file "%s", code %i, xrefs: 00007FF7FE6E279D
BBBB, xrefs: 00007FF7FE6E24BD
BBBB, xrefs: 00007FF7FE6E24AF
BBBB, xrefs: 00007FF7FE6E2438
BBBB, xrefs: 00007FF7FE6E248C
source file size %i, xrefs: 00007FF7FE6E2524
BBBB, xrefs: 00007FF7FE6E265D
BBBB, xrefs: 00007FF7FE6E23F8
BBBB, xrefs: 00007FF7FE6E24B6
BBBB, xrefs: 00007FF7FE6E2462
BBBB, xrefs: 00007FF7FE6E24A1
wrong source file ", xrefs: 00007FF7FE6E27AE
BBBB, xrefs: 00007FF7FE6E241C
BBBB, xrefs: 00007FF7FE6E240E
BBBB, xrefs: 00007FF7FE6E2415
BBBB, xrefs: 00007FF7FE6E2470
BBBB, xrefs: 00007FF7FE6E2469
BBBB, xrefs: 00007FF7FE6E2431
BBBB, xrefs: 00007FF7FE6E247E
error write file, written %i bytes, need write %i bytes, error code %i, xrefs: 00007FF7FE6E2777
BBBB, xrefs: 00007FF7FE6E2400
guid: %s, shift 0x%08X(%i), xrefs: 00007FF7FE6E2628
target file "%s", xrefs: 00007FF7FE6E23B2
BBBB, xrefs: 00007FF7FE6E244D
BBBB, xrefs: 00007FF7FE6E24C4
BBBB, xrefs: 00007FF7FE6E2454
BBBB, xrefs: 00007FF7FE6E2407
OK, xrefs: 00007FF7FE6E2761
BBBB, xrefs: 00007FF7FE6E242A
BBBB, xrefs: 00007FF7FE6E24A8
" ?, xrefs: 00007FF7FE6E27D1
BBBB, xrefs: 00007FF7FE6E245B
BBBB, xrefs: 00007FF7FE6E243F
BBBB, xrefs: 00007FF7FE6E2446

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: wprintf$_invalid_parameter_noinfo$CreateGuidInitializeUninitialize_fread_nolockfgetposfread_sstrchr
String ID: " ?$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$BBBB$OK$domain: shift 0x%08X(%i)$error create file "%s", code %i$error write file, written %i bytes, need write %i bytes, error code %i$guid: %s, shift 0x%08X(%i)$source file size %i$target file "%s"$wrong source file "
API String ID: 3927150608-2147001208
Opcode ID: 0eaabf706547943d22fa53fe9489f85c24fbdede133bdb6a47aa138fba1b5a1d
Instruction ID: d03d1a46556e12bde59e2ef82bbc6c49eb6f86e985de483ba802583e50c4a5e3
Opcode Fuzzy Hash: 0eaabf706547943d22fa53fe9489f85c24fbdede133bdb6a47aa138fba1b5a1d
Instruction Fuzzy Hash: 84C1BF72A0864686EB10AF62D5012AEB762FBC47C8F804035DF6D1BAD9DF3DD44187B9

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE7011C0, Relevance: 24.1, APIs: 9, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7FE701209
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE701882
memcpy_s.LIBCMT ref: 00007FF7FE70222F
memcpy_s.LIBCMT ref: 00007FF7FE7022D6

Part of subcall function 00007FF7FE70252C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE70255E

memcpy_s.LIBCMT ref: 00007FF7FE70239F

Part of subcall function 00007FF7FE6F5104: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6F5129

Strings

1#IND, xrefs: 00007FF7FE70241A
1#INF, xrefs: 00007FF7FE702477
1#QNAN, xrefs: 00007FF7FE702458
1#SNAN, xrefs: 00007FF7FE702439

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 281475176-2761157908
Opcode ID: 24ac0e55ccb3c70edea2f2b109bb6c74940edac041908d0fcfa2b5c05d47bc3b
Instruction ID: b74bfc0891e2f7e42778b81279646653002f63ef787cea60720e9e575a7e1d0e
Opcode Fuzzy Hash: 24ac0e55ccb3c70edea2f2b109bb6c74940edac041908d0fcfa2b5c05d47bc3b
Instruction Fuzzy Hash: B2B20772A081828AE765EE65DC406FDB7A1FBC8388F905135DB2957BC5DF38E504CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6FFDB4, Relevance: 10.7, APIs: 7, Instructions: 174COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7FE6F54DC: GetLastError.KERNEL32(?,?,?,00007FF7FE6EB344,?,?,?,00007FF7FE6EC6D1), ref: 00007FF7FE6F54E6
Part of subcall function 00007FF7FE6F54DC: SetLastError.KERNEL32(?,?,?,00007FF7FE6EB344,?,?,?,00007FF7FE6EC6D1), ref: 00007FF7FE6F5564
Part of subcall function 00007FF7FE6F54DC: abort.LIBCMT ref: 00007FF7FE6F556A

Part of subcall function 00007FF7FE6F54DC: SetLastError.KERNEL32(?,?,?,00007FF7FE6EB344,?,?,?,00007FF7FE6EC6D1), ref: 00007FF7FE6F554E

EnumSystemLocalesW.KERNEL32(?,?,?,00000000,00000001,00000000,?,00007FF7FE6F4595), ref: 00007FF7FE6FFF0B
GetUserDefaultLCID.KERNEL32(?,?,?,00000000), ref: 00007FF7FE6FFF24
ProcessCodePage.LIBCMT ref: 00007FF7FE6FFF4E
IsValidCodePage.KERNEL32 ref: 00007FF7FE6FFF6F
IsValidLocale.KERNEL32 ref: 00007FF7FE6FFF85
GetLocaleInfoW.KERNEL32 ref: 00007FF7FE6FFFE1
GetLocaleInfoW.KERNEL32 ref: 00007FF7FE6FFFFD

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: ErrorLastLocale$CodeInfoPageValid$DefaultEnumLocalesProcessSystemUserabort
String ID:
API String ID: 3941709727-0
Opcode ID: 5d05a7679e14fa28f14d2d93893ecbc405274aae1529ff2a09b83f8aeccd37a7
Instruction ID: 8208532dc93412b85651145bd6581e25dbba5ae154b311069cde5c17dfece24b
Opcode Fuzzy Hash: 5d05a7679e14fa28f14d2d93893ecbc405274aae1529ff2a09b83f8aeccd37a7
Instruction Fuzzy Hash: 08715B22F1568699FB10AB60D8506BCB3A2BF88748F844436CA3D537D5EF3DA945C3B1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6FF3C8, Relevance: 9.2, APIs: 6, Instructions: 208COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7FE6F54DC: GetLastError.KERNEL32(?,?,?,00007FF7FE6EB344,?,?,?,00007FF7FE6EC6D1), ref: 00007FF7FE6F54E6
Part of subcall function 00007FF7FE6F54DC: SetLastError.KERNEL32(?,?,?,00007FF7FE6EB344,?,?,?,00007FF7FE6EC6D1), ref: 00007FF7FE6F5564
Part of subcall function 00007FF7FE6F54DC: abort.LIBCMT ref: 00007FF7FE6F556A

TranslateName.LIBCMT ref: 00007FF7FE6FF432
TranslateName.LIBCMT ref: 00007FF7FE6FF46D
IsValidCodePage.KERNEL32(?,?,?,?,?,00007FF7FE6F459C), ref: 00007FF7FE6FF4CA
wcschr.LIBVCRUNTIME ref: 00007FF7FE6FF55D
wcschr.LIBVCRUNTIME ref: 00007FF7FE6FF56D

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: ErrorLastNameTranslatewcschr$CodePageValidabort
String ID:
API String ID: 4237316620-0
Opcode ID: 4a6e07ca00f5c181f52c63925a49e96984c4b320c75d473365034e83502df7b2
Instruction ID: 5d5b1dee0962a594f2b61df5025a75810320d69cff5e9732e51bd605a78c4f6e
Opcode Fuzzy Hash: 4a6e07ca00f5c181f52c63925a49e96984c4b320c75d473365034e83502df7b2
Instruction Fuzzy Hash: 3C817332A0878A85EB20BF21D5112A9B396FBC4B84F844135DA7D477C6EF3CE552C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6EA524, Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7FE6EA59D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7FE6EA5B5
RtlVirtualUnwind.KERNEL32 ref: 00007FF7FE6EA5F0
IsDebuggerPresent.KERNEL32 ref: 00007FF7FE6EA629
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7FE6EA633
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7FE6EA63E

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 76662f45ab0d999c1615af95dbd631d0d7018e156f7da61ec783956ef3c2a8ee
Instruction ID: 51194282c2f62d445af3c3f5aea0a538a803e085b6163521e13710b0c064d940
Opcode Fuzzy Hash: 76662f45ab0d999c1615af95dbd631d0d7018e156f7da61ec783956ef3c2a8ee
Instruction Fuzzy Hash: F6316D32608B8186DB60EF25E8402AEB3A1FBC9754F940136EAAD43BD5DF3CC145CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6EF478, Relevance: 6.2, APIs: 4, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

_Wcsftime.LIBCMT ref: 00007FF7FE6EF4C8
_Wcsftime.LIBCMT ref: 00007FF7FE6EF501

Part of subcall function 00007FF7FE6F4854: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6F487F

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: Wcsftime$_invalid_parameter_noinfo
String ID:
API String ID: 4239037671-0
Opcode ID: 5391c54f9391c5f4f0bc94dbcbeecf14428612a6a7ba88fec843e763a89e5dc0
Instruction ID: 212c610721989bf113e70b0e475f23edcd09028a142d121e3fed98d22448d96e
Opcode Fuzzy Hash: 5391c54f9391c5f4f0bc94dbcbeecf14428612a6a7ba88fec843e763a89e5dc0
Instruction Fuzzy Hash: 69712932A1878643EB24AB35A04137AB392FFC4794F944236EEBD43AD6DF3DD0018659

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6FBADC, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6FBB0C

Part of subcall function 00007FF7FE6EA780: GetCurrentProcess.KERNEL32(00007FF7FE6FD039), ref: 00007FF7FE6EA7AD

Strings

., xrefs: 00007FF7FE6FBF2C
*?, xrefs: 00007FF7FE6FBB33

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: 3725f18c3e09b3dedfd56ad382ccaa99fd3e04cfa4d10f67cf0d463e89ee3f67
Instruction ID: 7dea254a0c7cbc34d61f9ac71d9f89c771425022e98e55c52e4b05b7809f3c28
Opcode Fuzzy Hash: 3725f18c3e09b3dedfd56ad382ccaa99fd3e04cfa4d10f67cf0d463e89ee3f67
Instruction Fuzzy Hash: 8D51C562B14A9985EF10EF6598104BDB7A6FB88BD8B844531DE3D17BC9EF3CD0418360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6EF8C0, Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF7FE6EF94B

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 6068f228392bbde87faaf1bb2c3f41345029cc326c5add4b2fbc48b6656e6d30
Instruction ID: b4f9d9c48d31db00ff17752e11d86273f7854570f6a70c4562c87c78fd89b164
Opcode Fuzzy Hash: 6068f228392bbde87faaf1bb2c3f41345029cc326c5add4b2fbc48b6656e6d30
Instruction Fuzzy Hash: E3D1D232B1868A87DB34DF15E18466AB7A2FBC8784F548134CB5E57BC4DA3DE841CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6FF83C, Relevance: 4.7, APIs: 3, Instructions: 165COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FE6F54DC: GetLastError.KERNEL32(?,?,?,00007FF7FE6EB344,?,?,?,00007FF7FE6EC6D1), ref: 00007FF7FE6F54E6
Part of subcall function 00007FF7FE6F54DC: SetLastError.KERNEL32(?,?,?,00007FF7FE6EB344,?,?,?,00007FF7FE6EC6D1), ref: 00007FF7FE6F5564
Part of subcall function 00007FF7FE6F54DC: abort.LIBCMT ref: 00007FF7FE6F556A

Part of subcall function 00007FF7FE6F54DC: SetLastError.KERNEL32(?,?,?,00007FF7FE6EB344,?,?,?,00007FF7FE6EC6D1), ref: 00007FF7FE6F554E

GetLocaleInfoW.KERNEL32 ref: 00007FF7FE6FF8A9
GetLocaleInfoW.KERNEL32 ref: 00007FF7FE6FF8FB
GetLocaleInfoW.KERNEL32 ref: 00007FF7FE6FF9C0

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: ErrorInfoLastLocale$abort
String ID:
API String ID: 1112924360-0
Opcode ID: 64853bf7e2c86e5d7c90ab52e67232536f8263b239761c29a833a1e9e99bde33
Instruction ID: e7194dc974ba7a0f57a43ff232d5fd428ad3d81bc9c5bb36570ed7109fda498b
Opcode Fuzzy Hash: 64853bf7e2c86e5d7c90ab52e67232536f8263b239761c29a833a1e9e99bde33
Instruction Fuzzy Hash: 5961A172A0868A96EB30AF15E541279B3A3FB84744F848135C7BD836D5EF3CE451C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6FBCE8, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

., xrefs: 00007FF7FE6FBF2C

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 9c0b4f624a2424d573f2a4644f38db5a2d65d39e0f04b82793c13f2e50a6d786
Instruction ID: 6dc46f837df1a0add18d6cfb4c3d64f574217cd5096805cbfcb7270ffbd22789
Opcode Fuzzy Hash: 9c0b4f624a2424d573f2a4644f38db5a2d65d39e0f04b82793c13f2e50a6d786
Instruction Fuzzy Hash: C031E822B146D545E720AE22D8157BABA92ABC8BE4F948331EE7C07BC5DE3CD5058344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F5E28, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00007FF7FE6F4623), ref: 00007FF7FE6F5E9F

Strings

GetLocaleInfoEx, xrefs: 00007FF7FE6F5E5A

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: b7d08f78f528423dfcb768b2b42ef841cd564c6fb600a9670f01a76029085116
Instruction ID: d0f824017a872a2b35f7a9ffa03fbe601f4a9ae079ea7e07027cf470ebfa0a6a
Opcode Fuzzy Hash: b7d08f78f528423dfcb768b2b42ef841cd564c6fb600a9670f01a76029085116
Instruction Fuzzy Hash: 17019621B04B8581E704AB56A8000A9B7A5ABC8FD0B844136DE2D537A5DE3CD94183A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F43F0, Relevance: 3.3, APIs: 2, Instructions: 288COMMONLIBRARYCODE

Download Yara Rule

APIs

__lc_wcstolc.LIBCMT ref: 00007FF7FE6F4570

Part of subcall function 00007FF7FE6FF3C8: TranslateName.LIBCMT ref: 00007FF7FE6FF432
Part of subcall function 00007FF7FE6FF3C8: TranslateName.LIBCMT ref: 00007FF7FE6FF46D
Part of subcall function 00007FF7FE6FF3C8: IsValidCodePage.KERNEL32(?,?,?,?,?,00007FF7FE6F459C), ref: 00007FF7FE6FF4CA

GetACP.KERNEL32 ref: 00007FF7FE6F462F

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: NameTranslate$CodePageValid__lc_wcstolc
String ID:
API String ID: 1519730825-0
Opcode ID: 09b881e24a0124f1539d90a42e71456a2bf02c99a24c152b11166297dcebc328
Instruction ID: 60f0afb558c7203b7cfa4e70db77763177324d7d9cc493c391d14c62792b8b3e
Opcode Fuzzy Hash: 09b881e24a0124f1539d90a42e71456a2bf02c99a24c152b11166297dcebc328
Instruction Fuzzy Hash: 61B1E472A087DA41EB64EB6695117BAB6A3FBC5784F804035EE7D43EC5EF3CE1018690

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6FB184, Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7FE6FB3D1
RaiseException.KERNEL32 ref: 00007FF7FE6FB3E2

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 2d42aaa0dc037b263a5f8bd83070e6257a882c6a2e415b908038bead6dbbba0e
Instruction ID: bc3140736a8391b8842efb8cf2f3e291fee6ab4dfb9982a4325ba9c163f027b5
Opcode Fuzzy Hash: 2d42aaa0dc037b263a5f8bd83070e6257a882c6a2e415b908038bead6dbbba0e
Instruction Fuzzy Hash: 4AB17B73604B888BEB15DF29C84636CBBA1F788B48F588821DB7D877A8DB39D451C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6EEE9C, Relevance: 1.8, APIs: 1, Instructions: 339COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF7FE6EEFE6

Part of subcall function 00007FF7FE6EF79C: HeapFree.KERNEL32 ref: 00007FF7FE6EF7B2
Part of subcall function 00007FF7FE6EF79C: GetLastError.KERNEL32 ref: 00007FF7FE6EF7C4

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: ErrorFreeHeapInfoLast
String ID:
API String ID: 1648928578-0
Opcode ID: 86dc87f05313872d6ef83cca71d06855ca776dc1e51ea117e108957a95b2c796
Instruction ID: e6770a2d54afc644632e6a7c04b31ba028972e103f3a0bf1758ea3c14c1d0963
Opcode Fuzzy Hash: 86dc87f05313872d6ef83cca71d06855ca776dc1e51ea117e108957a95b2c796
Instruction Fuzzy Hash: F202BF32A08BC586E711DF3894052FDB3A5FB98748F819235EF9C86296EF39E181C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6FD8E8, Relevance: 1.8, APIs: 1, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fcbf20d4f0bf067d05a5202d50d09d66d3483df6e7c3dc2ffc0ba1f10391a3c
Instruction ID: 99c048baf3755475951a9b412ed3eb02429c9501a83449b76bda41fe1a38ca00
Opcode Fuzzy Hash: 7fcbf20d4f0bf067d05a5202d50d09d66d3483df6e7c3dc2ffc0ba1f10391a3c
Instruction Fuzzy Hash: 18E18232A04B8585EB10EBA1E4406EE77A9FB95788F814631DFAD537D6EF38D244C390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE70062C, Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7FE700691

Part of subcall function 00007FF7FE6F3C10: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6F3C24

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: b835f74d8c8f40226b9b703131785c3597d634ab092b780ca59af1818bd6004b
Instruction ID: 859a5ffcc17fa67d44d5e7b42ccebf032ea5f657300baa8def1a5a55c6673b3d
Opcode Fuzzy Hash: b835f74d8c8f40226b9b703131785c3597d634ab092b780ca59af1818bd6004b
Instruction Fuzzy Hash: 0F71E922E0868246FB64A929DC40679E293BFC8374F940A34DB7D466D9DF7DF84187B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6FFA80, Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FE6F54DC: GetLastError.KERNEL32(?,?,?,00007FF7FE6EB344,?,?,?,00007FF7FE6EC6D1), ref: 00007FF7FE6F54E6
Part of subcall function 00007FF7FE6F54DC: SetLastError.KERNEL32(?,?,?,00007FF7FE6EB344,?,?,?,00007FF7FE6EC6D1), ref: 00007FF7FE6F5564
Part of subcall function 00007FF7FE6F54DC: abort.LIBCMT ref: 00007FF7FE6F556A

Part of subcall function 00007FF7FE6F54DC: SetLastError.KERNEL32(?,?,?,00007FF7FE6EB344,?,?,?,00007FF7FE6EC6D1), ref: 00007FF7FE6F554E

GetLocaleInfoW.KERNEL32 ref: 00007FF7FE6FFAE9

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: ErrorLast$InfoLocaleabort
String ID:
API String ID: 3293382891-0
Opcode ID: d21d62257fd27cd6f6ead1db77854c0e3a4a789e41723b507cd43fb17ce120d8
Instruction ID: f0c9b2a98e71e33c1e37be155a910ede828196fffa5f4aa3d8fdb86cbd5aa4c7
Opcode Fuzzy Hash: d21d62257fd27cd6f6ead1db77854c0e3a4a789e41723b507cd43fb17ce120d8
Instruction Fuzzy Hash: BA219132A0868A86EB20EF11E5513A9B3A2FBC8784F808035D77D836D5EF3CE554C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6FF6D4, Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7FE6F54DC: GetLastError.KERNEL32(?,?,?,00007FF7FE6EB344,?,?,?,00007FF7FE6EC6D1), ref: 00007FF7FE6F54E6
Part of subcall function 00007FF7FE6F54DC: SetLastError.KERNEL32(?,?,?,00007FF7FE6EB344,?,?,?,00007FF7FE6EC6D1), ref: 00007FF7FE6F5564
Part of subcall function 00007FF7FE6F54DC: abort.LIBCMT ref: 00007FF7FE6F556A

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF7FE6FFEB7,?,?,?,00000000,00000001,00000000,?,00007FF7FE6F4595), ref: 00007FF7FE6FF772

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemabort
String ID:
API String ID: 2459050469-0
Opcode ID: 5bce3e16c0335674342c04b0145e2936ad842f828c13a709e5e7f5d989e0980d
Instruction ID: 01f852e5b0842414f2732e6789334cf0dde841639717747ed1ff518369f547f0
Opcode Fuzzy Hash: 5bce3e16c0335674342c04b0145e2936ad842f828c13a709e5e7f5d989e0980d
Instruction Fuzzy Hash: 1511EB67E0868985EB549F25E4402A8FBA1F7D0FA0F844135D639433D4EE78D5D1C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6FFC7C, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FE6F54DC: GetLastError.KERNEL32(?,?,?,00007FF7FE6EB344,?,?,?,00007FF7FE6EC6D1), ref: 00007FF7FE6F54E6
Part of subcall function 00007FF7FE6F54DC: SetLastError.KERNEL32(?,?,?,00007FF7FE6EB344,?,?,?,00007FF7FE6EC6D1), ref: 00007FF7FE6F5564
Part of subcall function 00007FF7FE6F54DC: abort.LIBCMT ref: 00007FF7FE6F556A

GetLocaleInfoW.KERNEL32(?,?,?,00007FF7FE6FFA3C), ref: 00007FF7FE6FFCB3

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: ErrorLast$InfoLocaleabort
String ID:
API String ID: 3293382891-0
Opcode ID: 04d682cb2008d4e24ccdba713d077b9a68f06b6cc7c400ff78ff1d4dc4bbe719
Instruction ID: 4cf377fd030b158f09fe35679bf1752d8d196d47734d3117ee1ba98c71cdd7ab
Opcode Fuzzy Hash: 04d682cb2008d4e24ccdba713d077b9a68f06b6cc7c400ff78ff1d4dc4bbe719
Instruction Fuzzy Hash: 9311CA32A185EA82E7647B11A04067AB352FBC4754FA05631DE7E477C5EE39D88187A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6FF7A4, Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7FE6F54DC: GetLastError.KERNEL32(?,?,?,00007FF7FE6EB344,?,?,?,00007FF7FE6EC6D1), ref: 00007FF7FE6F54E6
Part of subcall function 00007FF7FE6F54DC: SetLastError.KERNEL32(?,?,?,00007FF7FE6EB344,?,?,?,00007FF7FE6EC6D1), ref: 00007FF7FE6F5564
Part of subcall function 00007FF7FE6F54DC: abort.LIBCMT ref: 00007FF7FE6F556A

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF7FE6FFE73,?,?,?,00000000,00000001,00000000,?,00007FF7FE6F4595), ref: 00007FF7FE6FF824

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemabort
String ID:
API String ID: 2459050469-0
Opcode ID: 9831cadc67901be87db63930c5d7cffa9d3afe162e365fb9e64c8ca607be4b3d
Instruction ID: b08e378da247241a965a83b6b61dcb0e5041da2e82de1cff6980cc02ef21a5b7
Opcode Fuzzy Hash: 9831cadc67901be87db63930c5d7cffa9d3afe162e365fb9e64c8ca607be4b3d
Instruction Fuzzy Hash: 8D01F962F082C946E7106F25E8407B9F7A2EB80B64FC19231D638432C4EF689481C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F589C, Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF7FE6F5CA1,?,?,?,?,?,?,00000000,00007FF7FE6FECA6), ref: 00007FF7FE6F58F0

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: b54175c0ae6588dfff99f81a058ddd15eca637263f6170948a960b0f527f492f
Instruction ID: 07a0b0e1128c7a08613d01e129ff47f0f51947194e1e7143de0cc1a3a0a29191
Opcode Fuzzy Hash: b54175c0ae6588dfff99f81a058ddd15eca637263f6170948a960b0f527f492f
Instruction Fuzzy Hash: BF01C472B14B4583E704DB25EC400A9B362F7CCB80B448136EA5D877A8DF3CD8518390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6ED414, Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF7FE6ED5AE

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 1da25a436641ffdaaa5332239eaef1689e64a4c63fcedabc066eff3563ac9ae9
Instruction ID: a0c6ba50e9dd7478210fe51398dd9c4faff1a40a04c11707444517ea7b98df84
Opcode Fuzzy Hash: 1da25a436641ffdaaa5332239eaef1689e64a4c63fcedabc066eff3563ac9ae9
Instruction Fuzzy Hash: EB71F851A0C68B46FB64AA35404027DF7A29BC174CF941531DD2C8B6D7CE2FE84987EB

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6ED198, Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF7FE6ED332

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 57773de01bccddd33972bb7aba26c8b13c5a1234f29c8d174926197d7e406daa
Instruction ID: b3cd59fd531b09290dc88561a2f69582edf7b4c43b451d029edb6c564040080d
Opcode Fuzzy Hash: 57773de01bccddd33972bb7aba26c8b13c5a1234f29c8d174926197d7e406daa
Instruction Fuzzy Hash: F471D821A0C24A4AFB68AA35404027DF793DFD2744F941535DE288B6D5CE3FEC4687AB

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F9F6C, Relevance: 1.4, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7FE6FA011

Part of subcall function 00007FF7FE6EEBB0: RtlAllocateHeap.NTDLL ref: 00007FF7FE6EEC05

Part of subcall function 00007FF7FE6EF79C: HeapFree.KERNEL32 ref: 00007FF7FE6EF7B2
Part of subcall function 00007FF7FE6EF79C: GetLastError.KERNEL32 ref: 00007FF7FE6EF7C4

Part of subcall function 00007FF7FE7025B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE7025DF

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: ErrorHeapLast$AllocateFree_invalid_parameter_noinfo
String ID:
API String ID: 3806578645-0
Opcode ID: e934392d6bcc54cee49789a6c09898018760e102a2ef6601351ef8b227c3f7a9
Instruction ID: 0b76e0138d4eff4cd2d0621ed34a89f10b11785e181ba4f3abf2c4654cc1af8b
Opcode Fuzzy Hash: e934392d6bcc54cee49789a6c09898018760e102a2ef6601351ef8b227c3f7a9
Instruction Fuzzy Hash: 5C41E421F0968B41EB20BA26786177AF682AFC47C4F844535EE7E477C5FE3DE40142A4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F9DA4, Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7FE6F9DA8

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 28cb9544bf14eeb21071fcf7dd54e0b3d477cda592650f1a000c34684372a440
Instruction ID: 76dbd3a3de2aa71c49d5b2ef9a4b0a27a799a8664a08ea1f9c5f2b34553cd65b
Opcode Fuzzy Hash: 28cb9544bf14eeb21071fcf7dd54e0b3d477cda592650f1a000c34684372a440
Instruction Fuzzy Hash: 8DB09220E07B02C6EB083B11AC4221862A4BF9C710FC45078C22C41360DF6C20A647B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6EFDDA, Relevance: .5, Instructions: 535COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f50ed185b1410141001d1256e3ba9dabdecc2524991e5c76c2614713671394
Instruction ID: ec9a50fc0ae20cd942d0cabe29a28d7417db9dae4e4cdc54d134b1553c8877dd
Opcode Fuzzy Hash: 90f50ed185b1410141001d1256e3ba9dabdecc2524991e5c76c2614713671394
Instruction Fuzzy Hash: 63426221929E4688E793AF35EC11535B729FFD93C0F809733E92E666D4DF2CA44246B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6FED70, Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: bcfd70041c73d7935904fd4fdd596137f718f99dfcfb54f5a1415d36565c5cbe
Instruction ID: fdd819fc13543c9e72c4078fbaf599bc2c687ee95795e57b088970a1e66a408c
Opcode Fuzzy Hash: bcfd70041c73d7935904fd4fdd596137f718f99dfcfb54f5a1415d36565c5cbe
Instruction Fuzzy Hash: F3C1C632A186DA41E764FF21D8116BAB753EBC4B98F804131DE7943AC9EF3CE55187A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6FB5C0, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29bbc79e574e84b392b246cd6699b7abbf5323aaa95dfd338c73e9b7c350b287
Instruction ID: 37c7f88485988d2d92ebae60a9f604f03467f7e9f8c2f327a21381a67892b0df
Opcode Fuzzy Hash: 29bbc79e574e84b392b246cd6699b7abbf5323aaa95dfd338c73e9b7c350b287
Instruction Fuzzy Hash: 0BF0C271B192958EEBE89F28E84262DB7D0E74C390F908039D69C83B44D63C81609FA4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6E712C, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d9137be30ca762c515b27eb6a4003b00807810aa1c88afda74bd61cd8db352f
Instruction ID: 6e8f6599d6f818b745142cb6288e7636f9280ebe5f9f6d339946e41081b5e6b5
Opcode Fuzzy Hash: 5d9137be30ca762c515b27eb6a4003b00807810aa1c88afda74bd61cd8db352f
Instruction Fuzzy Hash: 6BA0012190E906E0E704AB00EC58460A221ABD9300B854131C16D450E09F2DA41183A5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F9880, Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6F99FD

Strings

INF, xrefs: 00007FF7FE6F98F3
nan(ind), xrefs: 00007FF7FE6F9936
nan, xrefs: 00007FF7FE6F98E8
NAN(SNAN), xrefs: 00007FF7FE6F9915
nan(snan), xrefs: 00007FF7FE6F9920
NAN, xrefs: 00007FF7FE6F98E1
inf, xrefs: 00007FF7FE6F9906
NAN(IND), xrefs: 00007FF7FE6F992B

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: 621f7c38c05972134e20e5dd54a4157b30d26810895ff4e4dd1d06f7fdd2e535
Instruction ID: bcdc059c19ea5a8fa9a3ea19179397eb0a5d24da8ae536708e411404f8a740db
Opcode Fuzzy Hash: 621f7c38c05972134e20e5dd54a4157b30d26810895ff4e4dd1d06f7fdd2e535
Instruction Fuzzy Hash: B041CF72A09B8989E704DF64E8417ED73A5FB48398F814536EE6C07B99EE3CD025C390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE700C54, Relevance: 13.8, APIs: 9, Instructions: 272fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FE7008C0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE700901
Part of subcall function 00007FF7FE7008C0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE70097E
Part of subcall function 00007FF7FE7008C0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE7009CF
Part of subcall function 00007FF7FE7008C0: _get_daylight.LIBCMT ref: 00007FF7FE700A2B

CreateFileW.KERNEL32 ref: 00007FF7FE700D55
CreateFileW.KERNEL32 ref: 00007FF7FE700DB1
GetLastError.KERNEL32 ref: 00007FF7FE700DE5
GetFileType.KERNEL32 ref: 00007FF7FE700DFA
GetLastError.KERNEL32 ref: 00007FF7FE700E04
CloseHandle.KERNEL32 ref: 00007FF7FE700E37
CloseHandle.KERNEL32 ref: 00007FF7FE700F90
CreateFileW.KERNEL32 ref: 00007FF7FE700FC8
GetLastError.KERNEL32 ref: 00007FF7FE700FD7

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: 07c87b0e914a2fb98f6e026bb06df96fe4a127e2d411886919b1d3098c328c8c
Instruction ID: 8750913ed41d05ba7444e8ab46de9cf6ce316aeb898f134fe7c8cab7bf5fb590
Opcode Fuzzy Hash: 07c87b0e914a2fb98f6e026bb06df96fe4a127e2d411886919b1d3098c328c8c
Instruction Fuzzy Hash: 02C1D033B18A468AEB50AB64D8503AD7762E7887A8F414635DF3E577D9CF38E015C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6E3028, Relevance: 12.1, APIs: 8, Instructions: 84COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7FE6E3048
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7FE6E306D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7FE6E3097
messages.LIBCPMT ref: 00007FF7FE6E30F6
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7FE6E3106
_CxxThrowException.LIBVCRUNTIME ref: 00007FF7FE6E3117
std::_Facet_Register.LIBCPMT ref: 00007FF7FE6E3140
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7FE6E314B

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrowmessagesstd::bad_alloc::bad_alloc
String ID:
API String ID: 3381189198-0
Opcode ID: a3e398a192c544bcf7aa698f88f046e3f40437f6836fc58a8a8267729689b771
Instruction ID: d76d407a3cc0f7c0c96c4f6c0ef7692f0e7a4f83d6ec2e694444d43a966c8ba6
Opcode Fuzzy Hash: a3e398a192c544bcf7aa698f88f046e3f40437f6836fc58a8a8267729689b771
Instruction Fuzzy Hash: 66315E21A4DA4681EB11AB25D5400B9F362EFD4BE4F980231D67D077E9CF2DE442C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6E3160, Relevance: 12.1, APIs: 8, Instructions: 84COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7FE6E3180
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7FE6E31A5
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7FE6E31CF
ctype.LIBCPMT ref: 00007FF7FE6E322E
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7FE6E323E
_CxxThrowException.LIBVCRUNTIME ref: 00007FF7FE6E324F
std::_Facet_Register.LIBCPMT ref: 00007FF7FE6E3278
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7FE6E3283

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrowctypestd::bad_alloc::bad_alloc
String ID:
API String ID: 3407776516-0
Opcode ID: decb80e405cbae5fe1879ff8e2001fa6b7108771bd9d88fcbf89a1bdebcadd0b
Instruction ID: d5ee7ef4cdb90d8c7c68fc9a511fd9e3750625ecc66d2a122a0b97efdd4021a4
Opcode Fuzzy Hash: decb80e405cbae5fe1879ff8e2001fa6b7108771bd9d88fcbf89a1bdebcadd0b
Instruction Fuzzy Hash: FD313E21A4CB4681EB15BB25D5400B9B362EBD4BE0F980231DA7D036E9DE2DE842C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F7858, Relevance: 10.8, APIs: 7, Instructions: 294COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6F7C9D

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 399ed0f814fc6bba712557e4b6ddd87f34d4c4d53dd3710662006a788d3cf252
Instruction ID: eb908d682b2181e637a2fc80f73e116a88f69784e32ed6d654d171c9de6247c6
Opcode Fuzzy Hash: 399ed0f814fc6bba712557e4b6ddd87f34d4c4d53dd3710662006a788d3cf252
Instruction Fuzzy Hash: 12C10426A2D6CA45EB61AF14940027ABB63BFC1B90F864134EA7E033D5DF3DE44183E5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6E2170, Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_CxxThrowException.LIBVCRUNTIME ref: 00007FF7FE6E21A9
_CxxThrowException.LIBVCRUNTIME ref: 00007FF7FE6E21EB
_CxxThrowException.LIBVCRUNTIME ref: 00007FF7FE6E222D
_CxxThrowException.LIBVCRUNTIME ref: 00007FF7FE6E226F

Strings

ios_base::eofbit set, xrefs: 00007FF7FE6E223C
ios_base::failbit set, xrefs: 00007FF7FE6E21FA
ios_base::badbit set, xrefs: 00007FF7FE6E21B8

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: ExceptionThrow
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 432778473-1866435925
Opcode ID: 5494c9595a8e6530fee949300e5293447ae4c170e5c66bbfcc8c263e8da6cfb1
Instruction ID: 8cebfc8254cbad23c4f2a4031bff89acd99dc4b1a753666b76b8fb7a6abe20a2
Opcode Fuzzy Hash: 5494c9595a8e6530fee949300e5293447ae4c170e5c66bbfcc8c263e8da6cfb1
Instruction Fuzzy Hash: 06313062E05B1A98FB00FBA4E8410EC7371BF94318FD00136DA5D279D9EF399556C390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6FAA08, Relevance: 9.2, APIs: 6, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6FAA64

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ae4dc5ab1dc0e9134f76bde21df7ab4744a3ef4efc259b3fc9e090e4a2d278b6
Instruction ID: 63e23f28935ee3e42f66dc1973b1e4e1e001b6a51a00e857e7b5f142752a8082
Opcode Fuzzy Hash: ae4dc5ab1dc0e9134f76bde21df7ab4744a3ef4efc259b3fc9e090e4a2d278b6
Instruction Fuzzy Hash: 8A919432A096D986FB60AB119440279B6A6BF84BA4F944235DE7D076D4FF3CD486C3B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6E188C, Relevance: 9.0, APIs: 6, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

new.LIBCMT ref: 00007FF7FE6E18CB
new.LIBCMT ref: 00007FF7FE6E18E6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7FE6E18F2

Part of subcall function 00007FF7FE6E2F98: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7FE6E2FA1
Part of subcall function 00007FF7FE6E2F98: _CxxThrowException.LIBVCRUNTIME ref: 00007FF7FE6E2FB2

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7FE6E18F8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FE6E18FE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FE6E1904

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn$ExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 2825306756-0
Opcode ID: 28bbfb1be02d542ebacf3b19222a74f9398d47626543ea032c1e7c9ebfd48b94
Instruction ID: 9a768276c2858c69010104042aec22d1d95d91b6e4a175e686a84e811cfca770
Opcode Fuzzy Hash: 28bbfb1be02d542ebacf3b19222a74f9398d47626543ea032c1e7c9ebfd48b94
Instruction Fuzzy Hash: D701F614E1A60F09FF2CB2A544152BAB1934FD5374FE00B72D63D017D2ED5E694162EA

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F2CC4, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7FE6F2CE4
GetProcAddress.KERNEL32 ref: 00007FF7FE6F2CFA
FreeLibrary.KERNEL32 ref: 00007FF7FE6F2D1F

Strings

mscoree.dll, xrefs: 00007FF7FE6F2CDB
CorExitProcess, xrefs: 00007FF7FE6F2CF3

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f1be5df30555893e54c542df797027a03ddf9dd6fdbabe88f71ae3b4706f5321
Instruction ID: 5a284e29bdb059edc3c7149ec6d0bcde8f843e67964c2d226949fcebb1212472
Opcode Fuzzy Hash: f1be5df30555893e54c542df797027a03ddf9dd6fdbabe88f71ae3b4706f5321
Instruction Fuzzy Hash: 60F04421A1974691EF45AB11F890279A361AFCCB90F881139EA2F466E4DF3CD4848770

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE7041D4, Relevance: 7.8, APIs: 5, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d246371e59d778666016ed12019df7df57383548cc464478e3f87e27cd87e76
Instruction ID: d8efc8e3137a9d918626d1a0927052f9290fca8932441f4bb4833ebcd51a90ec
Opcode Fuzzy Hash: 6d246371e59d778666016ed12019df7df57383548cc464478e3f87e27cd87e76
Instruction Fuzzy Hash: 6BA1E462B0978246EB20AA62D8103BDE691AFC87A4FC44635DB7D477C5EF7CD44483B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F800C, Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,00000000,?,?,00007FF7FE6F883F), ref: 00007FF7FE6F8069
WideCharToMultiByte.KERNEL32 ref: 00007FF7FE6F8145
WriteFile.KERNEL32 ref: 00007FF7FE6F816B
WriteFile.KERNEL32 ref: 00007FF7FE6F81AA
GetLastError.KERNEL32 ref: 00007FF7FE6F81E2

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: d57330dd6350b4712869357c23d41393f3fa72bb58bfac2c5f7fd052ef84af7e
Instruction ID: bfb34cb1f18ead6ad9ce70e1f25404807318485ed29179739ad005d676147543
Opcode Fuzzy Hash: d57330dd6350b4712869357c23d41393f3fa72bb58bfac2c5f7fd052ef84af7e
Instruction Fuzzy Hash: 8B51F632B14A9685E710DB65E8443ACB772FB88798F448235DE6E47BD8DF38E141C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6FA6DC, Relevance: 7.6, APIs: 5, Instructions: 133COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6FA72D

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8a37e831644ee33ea1f564136319b7d885d67e8178be3949b1c02c9981534d04
Instruction ID: 56960a3ad8158300f0c490a2bd25fe3aa80d52615698ddeac56b8ba546523e34
Opcode Fuzzy Hash: 8a37e831644ee33ea1f564136319b7d885d67e8178be3949b1c02c9981534d04
Instruction Fuzzy Hash: 1351A422A0C7C585E764AB119440579FBA6EFC4BB0F994235DA7D076D0EE7CE442C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE703410, Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE703440

Part of subcall function 00007FF7FE6EF7DC: RtlAllocateHeap.NTDLL ref: 00007FF7FE6EF81A

MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00007FF7FE700BBE), ref: 00007FF7FE703477
GetLastError.KERNEL32(?,?,?,00000000,?,00007FF7FE700BBE), ref: 00007FF7FE703484
MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00007FF7FE700BBE), ref: 00007FF7FE7034BC
GetLastError.KERNEL32(?,?,?,00000000,?,00007FF7FE700BBE), ref: 00007FF7FE7034C6

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide$AllocateHeap_invalid_parameter_noinfo
String ID:
API String ID: 1500607604-0
Opcode ID: ff58d773185b4df460b58ef6c3fa682540996f8bf41ee4a67c4972ad629606b5
Instruction ID: 765037e380c0fed465df9e57eccc0ca8b63b621edff2c0c100f2d87381f32278
Opcode Fuzzy Hash: ff58d773185b4df460b58ef6c3fa682540996f8bf41ee4a67c4972ad629606b5
Instruction Fuzzy Hash: 8021C421A09B4241EB25BF62BC0013AE796AFC8BA0F844634EE7D477D5DF3CE40242B0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE7027D8, Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7FE7027FF
_set_statfp.LIBCMT ref: 00007FF7FE70281A
_set_statfp.LIBCMT ref: 00007FF7FE702836
_set_statfp.LIBCMT ref: 00007FF7FE702872

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 18c091fff185a02c6b0f9dcafe86012acda0c8a3f3905ffffcfb0eaf2df4b852
Instruction ID: cb5881d4bb305d8c33cc2435313acccd5094104e4b1d1cd0fcccfaf6a99d3a2d
Opcode Fuzzy Hash: 18c091fff185a02c6b0f9dcafe86012acda0c8a3f3905ffffcfb0eaf2df4b852
Instruction Fuzzy Hash: 2C11C12BE1CA8705F758B5A5E84637AD9426FCC3A0F844234EB7E065D7DF1CA44042F5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F6810, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 197COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6F6A98

Strings

ccs, xrefs: 00007FF7FE6F69E5
UTF-16LEUNICODE, xrefs: 00007FF7FE6F6A40
UTF-8, xrefs: 00007FF7FE6F6A1D

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: bf2b8c16eadd9d5db84e603cc91450b30a88a0842af54cad9983de0b64117b2d
Instruction ID: 59fd4ff944bcc92018887e658571c6fb301f74a982d160fb9695245abc91e245
Opcode Fuzzy Hash: bf2b8c16eadd9d5db84e603cc91450b30a88a0842af54cad9983de0b64117b2d
Instruction Fuzzy Hash: 8C71B372D0C2CB45FB656E24865433CFBDAEF91748F84A134C63A465D5EB2DA81093E3

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6EC86C, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6EC895
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6ECA72

Strings

, xrefs: 00007FF7FE6EC9FB
*, xrefs: 00007FF7FE6EC9A6

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 23d9b31577de7f2a86e552a4b12be4897c7d88f11550b486e18f67c3137794f9
Instruction ID: ed77763510bdf16c2f170852f9d59a68c5dbdc1537f082c3f25d6dfb48cc22f2
Opcode Fuzzy Hash: 23d9b31577de7f2a86e552a4b12be4897c7d88f11550b486e18f67c3137794f9
Instruction Fuzzy Hash: 6B61FD3291C2C986F768AE39805437CBBA2FB81B08F941135D66A521C5CF2ED441C7AB

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F8438, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF7FE6F851E
WriteFile.KERNEL32 ref: 00007FF7FE6F8551
GetLastError.KERNEL32 ref: 00007FF7FE6F8573

Strings

U, xrefs: 00007FF7FE6F84FC

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: 034f733c7c169919fd78daaf25f8cd59d38ee1893bcac3a6967da1b0a74d948d
Instruction ID: 2c27ba4acb2db326c8ac0fb9f29c4ee32cc1d8df800411deb696ba1fe79fe27e
Opcode Fuzzy Hash: 034f733c7c169919fd78daaf25f8cd59d38ee1893bcac3a6967da1b0a74d948d
Instruction Fuzzy Hash: 1E41A222B1968582DB60AF25E8453BAB7A1FB88794F808031EE5D877D4EF3CD405C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE7008C0, Relevance: 6.2, APIs: 4, Instructions: 160COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE700901
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE70097E
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE7009CF
_get_daylight.LIBCMT ref: 00007FF7FE700A2B

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: 4f29ab0b7ae97194a582883ddba2c3802a8675c08871253ff472d340cc7ca090
Instruction ID: 67b9c0f2c937f8141c3fa2b0615a530af07b43ac44104fceec4b4d8a0576d108
Opcode Fuzzy Hash: 4f29ab0b7ae97194a582883ddba2c3802a8675c08871253ff472d340cc7ca090
Instruction Fuzzy Hash: 9B51B072D1C64686F765B928CC0537AE592ABC9334F994834DBA9462D9CF2CF84086F2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F8DF4, Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6F8E47
WideCharToMultiByte.KERNEL32 ref: 00007FF7FE6F8F19
GetLastError.KERNEL32 ref: 00007FF7FE6F8F3C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6F8F6E

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: 3b4ce5be346d9fefcd45327643f26a8dca00848a0727ff22629e1f0a54d34f79
Instruction ID: 8b0149b8ba1f2dfd48149c1c4d7d7236331b69771c68efeb6a98e0e2ff07160d
Opcode Fuzzy Hash: 3b4ce5be346d9fefcd45327643f26a8dca00848a0727ff22629e1f0a54d34f79
Instruction Fuzzy Hash: CE41D422E0D78A86FB65AB10D450379F6A2EFC4B90F944170DABC07AD5EF3CD84197A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6FCB00, Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF7FE6F31B7,?,?,00000000,00007FF7FE6F3172,?,?,00000000,00007FF7FE6F34A1), ref: 00007FF7FE6FCB19
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF7FE6F31B7,?,?,00000000,00007FF7FE6F3172,?,?,00000000,00007FF7FE6F34A1), ref: 00007FF7FE6FCB7B
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF7FE6F31B7,?,?,00000000,00007FF7FE6F3172,?,?,00000000,00007FF7FE6F34A1), ref: 00007FF7FE6FCBB5
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF7FE6F31B7,?,?,00000000,00007FF7FE6F3172,?,?,00000000,00007FF7FE6F34A1), ref: 00007FF7FE6FCBDF

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: a9bea5402cd1f14d8878be8d3d82df4723dbd0ea76f45f1e698c4fb268765643
Instruction ID: f14ef4eef882319859c56cc0ccf4eeed03ab1b3431e8311c70ce3218e053ddf6
Opcode Fuzzy Hash: a9bea5402cd1f14d8878be8d3d82df4723dbd0ea76f45f1e698c4fb268765643
Instruction Fuzzy Hash: 0A216125E197D581EB20AF12B440029F7A5EBC8BD0B984234DEAE63BD8DF3CE4528755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F54DC, Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7FE6EB344,?,?,?,00007FF7FE6EC6D1), ref: 00007FF7FE6F54E6
SetLastError.KERNEL32(?,?,?,00007FF7FE6EB344,?,?,?,00007FF7FE6EC6D1), ref: 00007FF7FE6F554E
SetLastError.KERNEL32(?,?,?,00007FF7FE6EB344,?,?,?,00007FF7FE6EC6D1), ref: 00007FF7FE6F5564
abort.LIBCMT ref: 00007FF7FE6F556A

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: 1317ccaa99e41bd68a19f88fb0a1cac3767944e40dac533040339ab513557f2b
Instruction ID: c1bf7efb3fe4f5622be68683c561fb8d4da6660dc55b368802ffcbb6a859e94a
Opcode Fuzzy Hash: 1317ccaa99e41bd68a19f88fb0a1cac3767944e40dac533040339ab513557f2b
Instruction Fuzzy Hash: CC018C20B0938B42FB987760A55523CB1835FC8791F944638D93E06BD7EE2CEC0042B1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F8FF4, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 245COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6F9058

Strings

gfffffff, xrefs: 00007FF7FE6F92E6

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: d2963831934c30ccb4cfcb4f0bf33f4b1da78e88b74f01f9e8dbc79468fd3ddc
Instruction ID: d436fe77c900b10f043afa728e616af4771da7137d058c0b36d3dd9946e5bd98
Opcode Fuzzy Hash: d2963831934c30ccb4cfcb4f0bf33f4b1da78e88b74f01f9e8dbc79468fd3ddc
Instruction Fuzzy Hash: 97914863A093CA46EB219F6995443ACBB56ABA67C0F448131CABD073E9EE3DE111C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F9424, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6F9467

Strings

gfff, xrefs: 00007FF7FE6F9592
e+000, xrefs: 00007FF7FE6F950F

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 99f65d63c4fee04bbf4b03e11efa300556e8319af9f1dac972224b273c518fa0
Instruction ID: 5f1b366081aa787b3a404a14c7ed04c7205c33d36d5ac41d6b3fb59892eda354
Opcode Fuzzy Hash: 99f65d63c4fee04bbf4b03e11efa300556e8319af9f1dac972224b273c518fa0
Instruction Fuzzy Hash: BF514B62B187C546EB259F359841369BB92EBD0B90F888231C7BC87BEADE2DD444C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6F2FD4, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FE6F2FFE
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF7FE6E6AA6), ref: 00007FF7FE6F301F

Strings

C:\Users\user\Desktop\anchorAsjuster_x64.exe, xrefs: 00007FF7FE6F300D

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\anchorAsjuster_x64.exe
API String ID: 3307058713-760163324
Opcode ID: 2d4c4b1f5580e3aa0e2996ef6e66e21aff2f71a5fa00ad03c85682e0b499f597
Instruction ID: 452bb1d1bf5220de7264dbb291d756e0a851a5c96d5f2f2fdd73e6e858a79bb3
Opcode Fuzzy Hash: 2d4c4b1f5580e3aa0e2996ef6e66e21aff2f71a5fa00ad03c85682e0b499f597
Instruction Fuzzy Hash: FD418336A08A9685EB14EF25E8400BCB7A5FFC47D4B854036E96D477C5EE3DE44183A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6FB754, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

_handle_errorf.LIBCMT ref: 00007FF7FE6FB8C6

Strings

", xrefs: 00007FF7FE6FB871
powf, xrefs: 00007FF7FE6FB8BF

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: _handle_errorf
String ID: "$powf
API String ID: 2315412904-603753351
Opcode ID: b2af2f20b014646dacddcfc01c9e05fdd9c1dd23ac71afa094eaf007085ec443
Instruction ID: 6444b5bd0c3085ec25129c8351534de5670f0e20c1531fa97d0c4356976c1aae
Opcode Fuzzy Hash: b2af2f20b014646dacddcfc01c9e05fdd9c1dd23ac71afa094eaf007085ec443
Instruction Fuzzy Hash: CA416173D28684DAE370CF22E0807AABBA0F7D9358F101325F769029D9DB7DC5509B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6FB630, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF7FE6FB742

Strings

", xrefs: 00007FF7FE6FB71B
pow, xrefs: 00007FF7FE6FB731

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID: _handle_error
String ID: "$pow
API String ID: 1757819995-713443511
Opcode ID: b62c5f13f2b0d528926c9eafe068bc8a0b6b1a509fd00555c16b37540bfbf9e9
Instruction ID: 782c7ced6adda5f7566653baa1d69f6d7d6ef7569decc95784e26d3e3e16a4be
Opcode Fuzzy Hash: b62c5f13f2b0d528926c9eafe068bc8a0b6b1a509fd00555c16b37540bfbf9e9
Instruction Fuzzy Hash: 49316F76D1CAC886D760DF10E44076AFAA1FBDE344F602326F79906A94EB7DD0819F10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7FE6FF210, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,?,000000A0,00007FF7FE6FF4AE,?,?,?,?,?,00007FF7FE6F459C), ref: 00007FF7FE6FF2AE

Strings

OCP, xrefs: 00007FF7FE6FF241
ACP, xrefs: 00007FF7FE6FF231

Memory Dump Source

Source File: 00000000.00000002.640581092.00007FF7FE6E1000.00000020.00020000.sdmp, Offset: 00007FF7FE6E0000, based on PE: true

Associated: 00000000.00000002.640577824.00007FF7FE6E0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640597465.00007FF7FE707000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640607514.00007FF7FE71C000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.640611275.00007FF7FE71F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640617317.00007FF7FE722000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.640620880.00007FF7FE724000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fe6e0000_anchorAsjuster_x64.jbxd

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: 4113e7883a2318e83645ecbe440b6e2a187b727b4ac3f9e966a918965728443c
Instruction ID: 9a3d9c11c913fd2d62d6e28a01e8af52f0f83315d2cbca0278cb02ce0856add6
Opcode Fuzzy Hash: 4113e7883a2318e83645ecbe440b6e2a187b727b4ac3f9e966a918965728443c
Instruction Fuzzy Hash: E0115425A1C6C751FBA4FB91A9805BAF361AFC8780FC44431EE7D426C5EF6CE941C6A0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report anchorAsjuster_x64.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

Compliance:

Spreading:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: anchorAsjuster_x64.exe PID: 6848 Parent PID: 5916

General

Chronological Activities

Analysis Process: conhost.exe PID: 6860 Parent PID: 6848

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: anchorAsjuster_x64.exe PID: 6848 Parent PID: 5916 anchorAsjuster_x64.exeCOMMON

Execution Graph

Graph

Executed Functions

Function 00007FF7FE6E6B1C, Relevance: 3.0, APIs: 2, Instructions: 18
COMMON

Function 00007FF7FE6E29BC, Relevance: 21.2, APIs: 2, Strings: 10, Instructions: 193
stringCOMMON

Function 00007FF7FE6E6B38, Relevance: 13.6, APIs: 9, Instructions: 92
COMMON

Function 00007FF7FE6F8698, Relevance: 7.7, APIs: 5, Instructions: 203
COMMONLIBRARYCODE

Function 00007FF7FE6F5934, Relevance: 7.6, APIs: 5, Instructions: 114
libraryloaderCOMMONLIBRARYCODE

Function 00007FF7FE6F650C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
COMMON

Function 00007FF7FE6F2C78, Relevance: 4.5, APIs: 3, Instructions: 19
COMMON

Function 00007FF7FE6EE640, Relevance: 3.1, APIs: 2, Instructions: 82
COMMON

Function 00007FF7FE6F8214, Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMONLIBRARYCODE

Function 00007FF7FE6E42F4, Relevance: 1.7, APIs: 1, Instructions: 163
COMMON

Function 00007FF7FE6F2B0C, Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 00007FF7FE6F85AC, Relevance: 1.6, APIs: 1, Instructions: 68
COMMONLIBRARYCODE

Function 00007FF7FE6FD3B8, Relevance: 1.6, APIs: 1, Instructions: 51
COMMON

Function 00007FF7FE6EEBB0, Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Function 00007FF7FE6EF7DC, Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMONLIBRARYCODE