Edit tour

Windows Analysis Report
oneDrive.exe

Overview

General Information

Sample name:	oneDrive.exe
Analysis ID:	1524367
MD5:	8509691d37f05049067df88592964a4b
SHA1:	37db71172ab64c108fedca85e5be51a499b2ba12
SHA256:	451ee465675e674cebe3c42ed41356ae2c972703e1dc7800a187426a6b34efdc
Tags:	CeranaKeeperexeuser-JAMESWT_MHT
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Found pyInstaller with non standard icon

Sigma detected: Rar Usage with Password and Compression Level

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

oneDrive.exe (PID: 7516 cmdline: "C:\Users\user\Desktop\oneDrive.exe" MD5: 8509691D37F05049067DF88592964A4B)

oneDrive.exe (PID: 7544 cmdline: "C:\Users\user\Desktop\oneDrive.exe" MD5: 8509691D37F05049067DF88592964A4B)

cmd.exe (PID: 7580 cmdline: C:\Windows\system32\cmd.exe /c "del C:\Windows\Help\en-us\*.rar" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7836 cmdline: C:\Windows\system32\cmd.exe /c "hostname" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 7888 cmdline: hostname MD5: 33AFAA43B84BDEAB12E02F9DBD2B2EE0)

cmd.exe (PID: 7904 cmdline: C:\Windows\system32\cmd.exe /c "C:\ProgramData\Microsoft\Rar.exe a -r -v1m -n@C:\Windows\media\check.wav -ta20240929000000 -hpN@991li#S!@# C:\Windows\Help\en-us\87072c.rar C:\users\*.*" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8008 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 8060 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 8116 cmdline: C:\Windows\system32\cmd.exe /c "hostname" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 8160 cmdline: hostname MD5: 33AFAA43B84BDEAB12E02F9DBD2B2EE0)

cmd.exe (PID: 8176 cmdline: C:\Windows\system32\cmd.exe /c "C:\ProgramData\Microsoft\Rar.exe a -r -v1m -n@C:\Windows\media\check.wav -ta20240929000000 -hpN@991li#S!@# C:\Windows\Help\en-us\87072D.rar D:\\*.*" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1848 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1964 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cleanup

Sigma Signatures

System Summary

Sigma detected: Rar Usage with Password and Compression Level

Source: Process started

Author: @ROxPinTeddy: Data: Command: C:\Windows\system32\cmd.exe /c "C:\ProgramData\Microsoft\Rar.exe a -r -v1m -n@C:\Windows\media\check.wav -ta20240929000000 -hpN@991li#S!@# C:\Windows\Help\en-us\87072c.rar C:\users\*.*", CommandLine: C:\Windows\system32\cmd.exe /c "C:\ProgramData\Microsoft\Rar.exe a -r -v1m -n@C:\Windows\media\check.wav -ta20240929000000 -hpN@991li#S!@# C:\Windows\Help\en-us\87072c.rar C:\users\*.*", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\oneDrive.exe", ParentImage: C:\Users\user\Desktop\oneDrive.exe, ParentProcessId: 7544, ParentProcessName: oneDrive.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "C:\ProgramData\Microsoft\Rar.exe a -r -v1m -n@C:\Windows\media\check.wav -ta20240929000000 -hpN@991li#S!@# C:\Windows\Help\en-us\87072c.rar C:\users\*.*", ProcessId: 7904, ProcessName: cmd.exe

Sigma detected: Suspicious Execution of Hostname

Source: Process started

Author: frack113: Data: Command: hostname, CommandLine: hostname, CommandLine|base64offset|contains: -, Image: C:\Windows\System32\HOSTNAME.EXE, NewProcessName: C:\Windows\System32\HOSTNAME.EXE, OriginalFileName: C:\Windows\System32\HOSTNAME.EXE, ParentCommandLine: C:\Windows\system32\cmd.exe /c "hostname", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7836, ParentProcessName: cmd.exe, ProcessCommandLine: hostname, ProcessId: 7888, ProcessName: HOSTNAME.EXE

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: oneDrive.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: oneDrive.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: oneDrive.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\_w\1\b\bin\amd64\python310.pdb source: oneDrive.exe, 00000002.00000002.2048958816.00007FFB0C10D000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: oneDrive.exe, 00000001.00000003.1516035668.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.1.dr

Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869D6714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	1_2_00007FF6869D6714
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869C7820 FindFirstFileExW,FindClose,	1_2_00007FF6869C7820
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869D6714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	1_2_00007FF6869D6714
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869E09B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF6869E09B4
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869C7820 FindFirstFileExW,FindClose,	2_2_00007FF6869C7820
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869D6714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	2_2_00007FF6869D6714
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869D6714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	2_2_00007FF6869D6714
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869E09B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF6869E09B4

Source: oneDrive.exe, 00000001.00000003.1518068983.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516699890.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516876549.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517195160.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518700114.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516336331.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D190000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517590579.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516990933.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516220557.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516515363.000002090D183000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.dr, _decimal.pyd.1.dr, _hashlib.pyd.1.dr, _socket.pyd.1.dr, libcrypto-1_1.dll.1.dr, python310.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: oneDrive.exe, 00000001.00000003.1516876549.000002090D183000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2Assure
Source: oneDrive.exe, 00000001.00000003.1518068983.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516699890.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516876549.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517195160.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518700114.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516336331.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517590579.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516990933.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516220557.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516515363.000002090D183000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.dr, _decimal.pyd.1.dr, _hashlib.pyd.1.dr, _socket.pyd.1.dr, libcrypto-1_1.dll.1.dr, python310.dll.1.dr, select.pyd.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: oneDrive.exe, 00000001.00000003.1518068983.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516699890.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516876549.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517195160.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518700114.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516336331.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D190000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517590579.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516990933.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516220557.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516515363.000002090D183000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.dr, _decimal.pyd.1.dr, _hashlib.pyd.1.dr, _socket.pyd.1.dr, libcrypto-1_1.dll.1.dr, python310.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: oneDrive.exe, 00000001.00000003.1516876549.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517590579.000002090D183000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digi
Source: oneDrive.exe, 00000001.00000003.1518068983.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516699890.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516876549.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517195160.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518700114.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516336331.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517590579.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516990933.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516220557.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516515363.000002090D183000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.dr, _decimal.pyd.1.dr, _hashlib.pyd.1.dr, _socket.pyd.1.dr, libcrypto-1_1.dll.1.dr, python310.dll.1.dr, select.pyd.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: oneDrive.exe, 00000001.00000003.1518068983.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516699890.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516876549.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517195160.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518700114.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516336331.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D190000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517590579.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516990933.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516220557.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516515363.000002090D183000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.dr, _decimal.pyd.1.dr, _hashlib.pyd.1.dr, _socket.pyd.1.dr, libcrypto-1_1.dll.1.dr, python310.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: oneDrive.exe, 00000001.00000003.1518068983.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516699890.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516876549.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517195160.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518700114.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516336331.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517590579.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516990933.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516220557.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516515363.000002090D183000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.dr, _decimal.pyd.1.dr, _hashlib.pyd.1.dr, _socket.pyd.1.dr, libcrypto-1_1.dll.1.dr, python310.dll.1.dr, select.pyd.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: oneDrive.exe, 00000001.00000003.1518068983.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516699890.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516876549.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517195160.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518700114.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516336331.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D190000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517590579.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516990933.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516220557.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516515363.000002090D183000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.dr, _decimal.pyd.1.dr, _hashlib.pyd.1.dr, _socket.pyd.1.dr, libcrypto-1_1.dll.1.dr, python310.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: oneDrive.exe, 00000001.00000003.1518068983.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516699890.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516876549.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517195160.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518700114.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516336331.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D190000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517590579.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516990933.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516220557.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516515363.000002090D183000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.dr, _decimal.pyd.1.dr, _hashlib.pyd.1.dr, _socket.pyd.1.dr, libcrypto-1_1.dll.1.dr, python310.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: oneDrive.exe, 00000001.00000003.1518068983.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516699890.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516876549.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517195160.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518700114.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516336331.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517590579.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516990933.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516220557.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516515363.000002090D183000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.dr, _decimal.pyd.1.dr, _hashlib.pyd.1.dr, _socket.pyd.1.dr, libcrypto-1_1.dll.1.dr, python310.dll.1.dr, select.pyd.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: oneDrive.exe, 00000001.00000003.1518068983.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516699890.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516876549.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517195160.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518700114.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516336331.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D190000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517590579.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516990933.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516220557.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516515363.000002090D183000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.dr, _decimal.pyd.1.dr, _hashlib.pyd.1.dr, _socket.pyd.1.dr, libcrypto-1_1.dll.1.dr, python310.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: oneDrive.exe, 00000001.00000003.1518068983.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516699890.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516876549.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517195160.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518700114.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516336331.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D190000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517590579.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516990933.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516220557.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516515363.000002090D183000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.dr, _decimal.pyd.1.dr, _hashlib.pyd.1.dr, _socket.pyd.1.dr, libcrypto-1_1.dll.1.dr, python310.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: oneDrive.exe, 00000001.00000003.1518068983.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516699890.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516876549.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517195160.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518700114.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516336331.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517590579.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516990933.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516220557.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516515363.000002090D183000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.dr, _decimal.pyd.1.dr, _hashlib.pyd.1.dr, _socket.pyd.1.dr, libcrypto-1_1.dll.1.dr, python310.dll.1.dr, select.pyd.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: oneDrive.exe, 00000001.00000003.1518068983.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516699890.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516876549.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517195160.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518700114.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516336331.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D190000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517590579.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516990933.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516220557.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516515363.000002090D183000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.dr, _decimal.pyd.1.dr, _hashlib.pyd.1.dr, _socket.pyd.1.dr, libcrypto-1_1.dll.1.dr, python310.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: oneDrive.exe, 00000002.00000003.2042519257.000002365FB4A000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000002.2046516934.000002365F4D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: oneDrive.exe, 00000001.00000003.1518068983.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516699890.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516876549.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517195160.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518700114.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516336331.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D190000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517590579.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516990933.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516220557.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516515363.000002090D183000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.dr, _decimal.pyd.1.dr, _hashlib.pyd.1.dr, _socket.pyd.1.dr, libcrypto-1_1.dll.1.dr, python310.dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: oneDrive.exe, 00000002.00000003.2042519257.000002365FB3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: oneDrive.exe, 00000002.00000002.2047409308.000002365FA9C000.00000004.00001000.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2042519257.000002365FB4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: base_library.zip.1.dr	String found in binary or memory: http://www.robotstxt.org/norobots-rfc.txt
Source: oneDrive.exe, 00000002.00000003.2044048368.000002365D78E000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.1524346227.000002365D781000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2043078495.000002365D766000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.1524238232.000002365D781000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2044640579.000002365D791000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2043151919.000002365D781000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.1525072404.000002365D77E000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2043506842.000002365D7C9000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000002.2046222587.000002365D791000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: oneDrive.exe, 00000002.00000002.2046516934.000002365F558000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: oneDrive.exe, 00000002.00000002.2046222587.000002365D791000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: oneDrive.exe, 00000002.00000003.2044048368.000002365D78E000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.1524346227.000002365D781000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2043078495.000002365D766000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.1524238232.000002365D781000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2044640579.000002365D791000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2043151919.000002365D781000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.1525072404.000002365D77E000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2043506842.000002365D7C9000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000002.2046222587.000002365D791000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: oneDrive.exe, 00000002.00000003.2044048368.000002365D78E000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.1524346227.000002365D781000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2043078495.000002365D766000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.1524238232.000002365D781000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2044640579.000002365D791000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2043151919.000002365D781000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.1525072404.000002365D77E000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2043506842.000002365D7C9000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000002.2046222587.000002365D791000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: base_library.zip.1.dr	String found in binary or memory: https://mahler:8092/site-updates.py
Source: oneDrive.exe, 00000002.00000002.2046516934.000002365F4D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pixeldrain.com/api/file
Source: oneDrive.exe, 00000002.00000002.2048958816.00007FFB0C10D000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: oneDrive.exe, 00000001.00000003.1518068983.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516699890.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516876549.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517195160.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518700114.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516336331.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D190000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517590579.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516990933.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1518520091.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516220557.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1516515363.000002090D183000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.dr, _decimal.pyd.1.dr, _hashlib.pyd.1.dr, _socket.pyd.1.dr, libcrypto-1_1.dll.1.dr, python310.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: oneDrive.exe, 00000001.00000003.1517590579.000002090D183000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr, libcrypto-1_1.dll.1.dr	String found in binary or memory: https://www.openssl.org/H
Source: base_library.zip.1.dr	String found in binary or memory: https://www.python.org/
Source: oneDrive.exe, 00000001.00000003.1518995615.000002090D183000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.1.dr	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: oneDrive.exe, 00000002.00000002.2046516934.000002365F4D0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.1.dr	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.

Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869C6780	1_2_00007FF6869C6780
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869E4E20	1_2_00007FF6869E4E20
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869E5D6C	1_2_00007FF6869E5D6C
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869D6714	1_2_00007FF6869D6714
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869E5820	1_2_00007FF6869E5820
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869D2800	1_2_00007FF6869D2800
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869D4F50	1_2_00007FF6869D4F50
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869D6F98	1_2_00007FF6869D6F98
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869D0FB4	1_2_00007FF6869D0FB4
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869D6714	1_2_00007FF6869D6714
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869C80A0	1_2_00007FF6869C80A0
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869E509C	1_2_00007FF6869E509C
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869DD098	1_2_00007FF6869DD098
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869D6560	1_2_00007FF6869D6560
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869DFA08	1_2_00007FF6869DFA08
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869D0DB0	1_2_00007FF6869D0DB0
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869DD718	1_2_00007FF6869DD718
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869D1E70	1_2_00007FF6869D1E70
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869D13C4	1_2_00007FF6869D13C4
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869D2C04	1_2_00007FF6869D2C04
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869DCC04	1_2_00007FF6869DCC04
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869E8B68	1_2_00007FF6869E8B68
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869D0BA4	1_2_00007FF6869D0BA4
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869D8BA0	1_2_00007FF6869D8BA0
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869C1B90	1_2_00007FF6869C1B90
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869E2D30	1_2_00007FF6869E2D30
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869D11C0	1_2_00007FF6869D11C0
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869E31CC	1_2_00007FF6869E31CC
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869DFA08	1_2_00007FF6869DFA08
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869D09A0	1_2_00007FF6869D09A0
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869E09B4	1_2_00007FF6869E09B4
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869E5D6C	2_2_00007FF6869E5D6C
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869E5820	2_2_00007FF6869E5820
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869D2800	2_2_00007FF6869D2800
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869D4F50	2_2_00007FF6869D4F50
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869D6F98	2_2_00007FF6869D6F98
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869D0FB4	2_2_00007FF6869D0FB4
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869C6780	2_2_00007FF6869C6780
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869D6714	2_2_00007FF6869D6714
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869C80A0	2_2_00007FF6869C80A0
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869E509C	2_2_00007FF6869E509C
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869DD098	2_2_00007FF6869DD098
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869E4E20	2_2_00007FF6869E4E20
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869D6560	2_2_00007FF6869D6560
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869DFA08	2_2_00007FF6869DFA08
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869D0DB0	2_2_00007FF6869D0DB0
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869DD718	2_2_00007FF6869DD718
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869D6714	2_2_00007FF6869D6714
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869D1E70	2_2_00007FF6869D1E70
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869D13C4	2_2_00007FF6869D13C4
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869D2C04	2_2_00007FF6869D2C04
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869DCC04	2_2_00007FF6869DCC04
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869E8B68	2_2_00007FF6869E8B68
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869D0BA4	2_2_00007FF6869D0BA4
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869D8BA0	2_2_00007FF6869D8BA0
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869C1B90	2_2_00007FF6869C1B90
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869E2D30	2_2_00007FF6869E2D30
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869D11C0	2_2_00007FF6869D11C0
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869E31CC	2_2_00007FF6869E31CC
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869DFA08	2_2_00007FF6869DFA08
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869D09A0	2_2_00007FF6869D09A0
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869E09B4	2_2_00007FF6869E09B4
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FFB24BD7508	2_2_00007FFB24BD7508

Source: C:\Users\user\Desktop\oneDrive.exe

Code function: String function: 00007FF6869C2770 appears 82 times

Source: unicodedata.pyd.1.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: oneDrive.exe, 00000001.00000003.1516699890.000002090D183000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs oneDrive.exe
Source: oneDrive.exe, 00000001.00000003.1516035668.000002090D183000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs oneDrive.exe
Source: oneDrive.exe, 00000001.00000003.1516876549.000002090D183000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs oneDrive.exe
Source: oneDrive.exe, 00000001.00000003.1518700114.000002090D183000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs oneDrive.exe
Source: oneDrive.exe, 00000001.00000003.1516336331.000002090D183000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs oneDrive.exe
Source: oneDrive.exe, 00000001.00000003.1517590579.000002090D183000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs oneDrive.exe
Source: oneDrive.exe, 00000001.00000003.1516990933.000002090D183000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs oneDrive.exe
Source: oneDrive.exe, 00000001.00000003.1518520091.000002090D183000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs oneDrive.exe
Source: oneDrive.exe, 00000001.00000003.1516220557.000002090D183000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs oneDrive.exe
Source: oneDrive.exe, 00000001.00000003.1516515363.000002090D183000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs oneDrive.exe
Source: oneDrive.exe	Binary or memory string: OriginalFilename vs oneDrive.exe
Source: oneDrive.exe, 00000002.00000002.2049775351.00007FFB0C237000.00000004.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython310.dll. vs oneDrive.exe
Source: oneDrive.exe, 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs oneDrive.exe

Source: libcrypto-1_1.dll.1.dr	Static PE information: Section: UPX1 ZLIB complexity 0.998725
Source: libssl-1_1.dll.1.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9921420784883721
Source: python310.dll.1.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9990745427643289
Source: unicodedata.pyd.1.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9937514282449725

Source: classification engine

Classification label: mal68.winEXE@32/13@0/0

Source: C:\Users\user\Desktop\oneDrive.exe

Code function: 1_2_00007FF6869C74B0 GetLastError,FormatMessageW,WideCharToMultiByte,

1_2_00007FF6869C74B0

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8016:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7588:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8124:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7912:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1748:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7844:120:WilError_03

Source: C:\Users\user\Desktop\oneDrive.exe

File created: C:\Users\user~1\AppData\Local\Temp\_MEI75162

Jump to behavior

Source: oneDrive.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\oneDrive.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: oneDrive.exe

ReversingLabs: Detection: 31%

Source: C:\Users\user\Desktop\oneDrive.exe

File read: C:\Users\user\Desktop\oneDrive.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\oneDrive.exe "C:\Users\user\Desktop\oneDrive.exe"
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Users\user\Desktop\oneDrive.exe "C:\Users\user\Desktop\oneDrive.exe"
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "del C:\Windows\Help\en-us\*.rar"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "hostname"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\ProgramData\Microsoft\Rar.exe a -r -v1m -n@C:\Windows\media\check.wav -ta20240929000000 -hpN@991li#S!@# C:\Windows\Help\en-us\87072c.rar C:\users\."
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "hostname"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\ProgramData\Microsoft\Rar.exe a -r -v1m -n@C:\Windows\media\check.wav -ta20240929000000 -hpN@991li#S!@# C:\Windows\Help\en-us\87072D.rar D:\\."
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Users\user\Desktop\oneDrive.exe "C:\Users\user\Desktop\oneDrive.exe"	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "del C:\Windows\Help\en-us\*.rar"	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "hostname"	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\ProgramData\Microsoft\Rar.exe a -r -v1m -n@C:\Windows\media\check.wav -ta20240929000000 -hpN@991li#S!@# C:\Windows\Help\en-us\87072c.rar C:\users\."	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "hostname"	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\ProgramData\Microsoft\Rar.exe a -r -v1m -n@C:\Windows\media\check.wav -ta20240929000000 -hpN@991li#S!@# C:\Windows\Help\en-us\87072D.rar D:\\."	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist

Source: C:\Users\user\Desktop\oneDrive.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior

Source: C:\Windows\System32\tasklist.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist

Source: C:\Users\user\Desktop\oneDrive.exe

File opened: C:\Users\user\Desktop\pyvenv.cfg

Jump to behavior

Source: oneDrive.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: oneDrive.exe

Static file information: File size 4802649 > 1048576

Source: oneDrive.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: oneDrive.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: oneDrive.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: oneDrive.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: oneDrive.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: oneDrive.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: oneDrive.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: oneDrive.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\_w\1\b\bin\amd64\python310.pdb source: oneDrive.exe, 00000002.00000002.2048958816.00007FFB0C10D000.00000040.00000001.01000000.00000004.sdmp
Source:	Binary string: d:\a01\_work\2\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: oneDrive.exe, 00000001.00000003.1516035668.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.1.dr

Source: oneDrive.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: oneDrive.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: oneDrive.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: oneDrive.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: oneDrive.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: oneDrive.exe	Static PE information: section name: _RDATA
Source: VCRUNTIME140.dll.1.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF686A110E4 push rcx; retn 0000h	1_2_00007FF686A110ED
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF686A110CC push rbp; retn 0000h	1_2_00007FF686A110CD
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF686A110E4 push rcx; retn 0000h	2_2_00007FF686A110ED
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF686A110CC push rbp; retn 0000h	2_2_00007FF686A110CD

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\oneDrive.exe

Process created: "C:\Users\user\Desktop\oneDrive.exe"

Source: C:\Users\user\Desktop\oneDrive.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75162\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\oneDrive.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75162\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\oneDrive.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75162\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\oneDrive.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75162\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\oneDrive.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75162\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\oneDrive.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75162\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\oneDrive.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75162\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\oneDrive.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75162\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\oneDrive.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75162\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\oneDrive.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75162\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\oneDrive.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75162\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\oneDrive.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75162\_decimal.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\oneDrive.exe

Code function: 1_2_00007FF6869C3DF0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00007FF6869C3DF0

Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Users\user\Desktop\oneDrive.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75162\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\oneDrive.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75162\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\oneDrive.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75162\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\oneDrive.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75162\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\oneDrive.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75162\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\oneDrive.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75162\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\oneDrive.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75162\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\oneDrive.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75162\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\oneDrive.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75162\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\oneDrive.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75162\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\oneDrive.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75162\_decimal.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\oneDrive.exe

API coverage: 5.5 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869D6714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	1_2_00007FF6869D6714
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869C7820 FindFirstFileExW,FindClose,	1_2_00007FF6869C7820
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869D6714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	1_2_00007FF6869D6714
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869E09B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF6869E09B4
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869C7820 FindFirstFileExW,FindClose,	2_2_00007FF6869C7820
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869D6714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	2_2_00007FF6869D6714
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869D6714 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	2_2_00007FF6869D6714
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869E09B4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF6869E09B4

Source: HOSTNAME.EXE, 00000010.00000002.1835588220.000002AE70119000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: HOSTNAME.EXE, 00000008.00000002.1627714013.00000234D0FB9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllVV

Source: C:\Users\user\Desktop\oneDrive.exe

Code function: 1_2_00007FF6869CB69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_00007FF6869CB69C

Source: C:\Users\user\Desktop\oneDrive.exe

Code function: 1_2_00007FF6869E25A0 GetProcessHeap,

1_2_00007FF6869E25A0

Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869CB880 SetUnhandledExceptionFilter,	1_2_00007FF6869CB880
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869CAE00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF6869CAE00
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869CB69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF6869CB69C
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 1_2_00007FF6869D9AE4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF6869D9AE4
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869CB880 SetUnhandledExceptionFilter,	2_2_00007FF6869CB880
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869CAE00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF6869CAE00
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869CB69C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF6869CB69C
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FF6869D9AE4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF6869D9AE4
Source: C:\Users\user\Desktop\oneDrive.exe	Code function: 2_2_00007FFB24BE004C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFB24BE004C

Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Users\user\Desktop\oneDrive.exe "C:\Users\user\Desktop\oneDrive.exe"	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "del C:\Windows\Help\en-us\*.rar"	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "hostname"	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\ProgramData\Microsoft\Rar.exe a -r -v1m -n@C:\Windows\media\check.wav -ta20240929000000 -hpN@991li#S!@# C:\Windows\Help\en-us\87072c.rar C:\users\."	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "hostname"	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "C:\ProgramData\Microsoft\Rar.exe a -r -v1m -n@C:\Windows\media\check.wav -ta20240929000000 -hpN@991li#S!@# C:\Windows\Help\en-us\87072D.rar D:\\."	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist

Source: C:\Users\user\Desktop\oneDrive.exe

Code function: 1_2_00007FF6869E89B0 cpuid

1_2_00007FF6869E89B0

Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\Desktop\oneDrive.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\Desktop\oneDrive.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\Desktop\oneDrive.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\Desktop\oneDrive.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\Desktop\oneDrive.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\Desktop\oneDrive.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\Desktop\oneDrive.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\Desktop\oneDrive.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\Desktop\oneDrive.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\Desktop\oneDrive.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\Desktop\oneDrive.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\Desktop\oneDrive.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75162 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\oneDrive.exe	Queries volume information: \Device\CdRom0\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\oneDrive.exe

Code function: 1_2_00007FF6869CB580 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_00007FF6869CB580

Source: C:\Users\user\Desktop\oneDrive.exe

Code function: 1_2_00007FF6869E4E20 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

1_2_00007FF6869E4E20

Source: C:\Users\user\Desktop\oneDrive.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	11 Process Injection	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	21 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Software Packing	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	24 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
oneDrive.exe	32%	ReversingLabs	Win32.Trojan.Generic
oneDrive.exe	100%	Avira	TR/Drop.Agent.nuump

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI75162\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75162\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75162\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75162\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75162\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75162\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75162\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75162\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75162\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75162\python310.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75162\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75162\unicodedata.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://www.openssl.org/H	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	oneDrive.exe, 00000002.00000002.2046516934.000002365F558000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://pixeldrain.com/api/file	oneDrive.exe, 00000002.00000002.2046516934.000002365F4D0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://mahler:8092/site-updates.py	base_library.zip.1.dr	false		unknown
http://www.robotstxt.org/norobots-rfc.txt	base_library.zip.1.dr	false		unknown
https://www.python.org/download/releases/2.3/mro/.	oneDrive.exe, 00000002.00000002.2046516934.000002365F4D0000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.1.dr	false		unknown
https://www.python.org/	base_library.zip.1.dr	false		unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	oneDrive.exe, 00000002.00000003.2044048368.000002365D78E000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.1524346227.000002365D781000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2043078495.000002365D766000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.1524238232.000002365D781000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2044640579.000002365D791000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2043151919.000002365D781000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.1525072404.000002365D77E000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2043506842.000002365D7C9000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000002.2046222587.000002365D791000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.openssl.org/H	oneDrive.exe, 00000001.00000003.1517590579.000002090D183000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.1.dr, libcrypto-1_1.dll.1.dr	false	URL Reputation: safe	unknown
http://www.iana.org/time-zones/repository/tz-link.html	oneDrive.exe, 00000002.00000003.2042519257.000002365FB3A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.python.org/dev/peps/pep-0205/	oneDrive.exe, 00000001.00000003.1518995615.000002090D183000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.1.dr	false		unknown
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	oneDrive.exe, 00000002.00000003.2042519257.000002365FB4A000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000002.2046516934.000002365F4D0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://python.org/dev/peps/pep-0263/	oneDrive.exe, 00000002.00000002.2048958816.00007FFB0C10D000.00000040.00000001.01000000.00000004.sdmp	false		unknown
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	oneDrive.exe, 00000002.00000003.2044048368.000002365D78E000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.1524346227.000002365D781000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2043078495.000002365D766000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.1524238232.000002365D781000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2044640579.000002365D791000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2043151919.000002365D781000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.1525072404.000002365D77E000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2043506842.000002365D7C9000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000002.2046222587.000002365D791000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	oneDrive.exe, 00000002.00000002.2046222587.000002365D791000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	oneDrive.exe, 00000002.00000002.2047409308.000002365FA9C000.00000004.00001000.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2042519257.000002365FB4A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl3.digi	oneDrive.exe, 00000001.00000003.1516876549.000002090D183000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000001.00000003.1517590579.000002090D183000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	oneDrive.exe, 00000002.00000003.2044048368.000002365D78E000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.1524346227.000002365D781000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2043078495.000002365D766000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.1524238232.000002365D781000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2044640579.000002365D791000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2043151919.000002365D781000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.1525072404.000002365D77E000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000003.2043506842.000002365D7C9000.00000004.00000020.00020000.00000000.sdmp, oneDrive.exe, 00000002.00000002.2046222587.000002365D791000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524367
Start date and time:	2024-10-02 18:08:56 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	oneDrive.exe
Detection:	MAL
Classification:	mal68.winEXE@32/13@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 58 Number of non-executed functions: 158
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: oneDrive.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI75162\VCRUNTIME140.dll	file.exe	Get hash	malicious	DUMPNTLM	Browse
	newvideozones.click.ps1	Get hash	malicious	Unknown	Browse
	https://github.com/VioletteChiara/AnimalTA/releases/download/v3.2.2/AnimalTA_installer_v3.2.2.exe	Get hash	malicious	Unknown	Browse
	pkgconsole.exe	Get hash	malicious	AsyncRAT, Discord Token Stealer, MicroClip, RedLine	Browse
	hvKNAvvNd4.exe	Get hash	malicious	AsyncRAT, Discord Token Stealer, MicroClip, RedLine	Browse
	check.bat	Get hash	malicious	Python Stealer	Browse
	corpsero.exe	Get hash	malicious	Unknown	Browse
	83MZfLKh7D.exe	Get hash	malicious	AsyncRAT, Discord Token Stealer, Luca Stealer, MicroClip, RedLine	Browse
	TWlznBtQLz.exe	Get hash	malicious	AsyncRAT, Luca Stealer, MicroClip, RedLine	Browse
	8Mgx5RP6Wc.exe	Get hash	malicious	Discord Token Stealer	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI75162\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\oneDrive.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	97160
Entropy (8bit):	6.422776154074499
Encrypted:	false
SSDEEP:	1536:yDHLG4SsAzAvadZw+1Hcx8uIYNUzUnHg4becbK/zJrCT:yDrfZ+jPYNznHg4becbK/Fr
MD5:	11D9AC94E8CB17BD23DEA89F8E757F18
SHA1:	D4FB80A512486821AD320C4FD67ABCAE63005158
SHA-256:	E1D6F78A72836EA120BD27A33AE89CBDC3F3CA7D9D0231AAA3AAC91996D2FA4E
SHA-512:	AA6AFD6BEA27F554E3646152D8C4F96F7BCAAA4933F8B7C04346E410F93F23CFA6D29362FD5D51CCBB8B6223E094CD89E351F072AD0517553703F5BF9DE28778
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: newvideozones.click.ps1, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: pkgconsole.exe, Detection: malicious, Browse Filename: hvKNAvvNd4.exe, Detection: malicious, Browse Filename: check.bat, Detection: malicious, Browse Filename: corpsero.exe, Detection: malicious, Browse Filename: 83MZfLKh7D.exe, Detection: malicious, Browse Filename: TWlznBtQLz.exe, Detection: malicious, Browse Filename: 8Mgx5RP6Wc.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d....(.`.........." .........`......p.....................................................`A.........................................B..4....J...............p..X....X...#..........h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75162\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\oneDrive.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44784
Entropy (8bit):	7.758117629952991
Encrypted:	false
SSDEEP:	768:KYALi+CQICxpocJb5PR1qNWk7xGZ6jtdZZxF3oIUCy6tScjqpL4IAMVOeEDG4yw4:9ALiIISocD6Ck7ZxGYy6t24IAMVO7yw
MD5:	CE449D962AD4E5C30A9979FB518768C5
SHA1:	5F5B634AF8F539699C1147AD7D008AD352E6C90F
SHA-256:	6F941039F9B458AF12F44D077C149E64F2FF5111D4CD252E05388628E9FE54FB
SHA-512:	4E400E233779D93A006387C552DAEA14896D5865C22BF0D0E0061034E233F49D3EC2DFE4D7DF7EA03A9470DE5F140702F87D747A69BE78EB0C405E50CB6254D4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G..>...m...m...m..=m...mQ..l...me.Sm...mQ..l...mQ..l...mQ..l...m...l...m...l...m...m\..m...l...m...l...m..Qm...m...l...mRich...m................PE..d....O[a.........." .................c....................................................`.............................................H.................... ..,..............$....................................o..8...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI75162\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\oneDrive.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	103656
Entropy (8bit):	7.926445614908681
Encrypted:	false
SSDEEP:	1536:Gr2FnfxlQ7BIxnMRA40Jg9fsX9WyBP9CaYW93ZuHaIyRkJgU1uIAYqYJwyxo:82FfMR0asX9WwTJuHaIOIAYqYJ1o
MD5:	A43584E0A77663AE9EF880F795C3443B
SHA1:	49381996DE63CC596B13AC5A5A6E2E38A41F7242
SHA-256:	6187149EDFFA1BA7139940E99A2DC71731C10698B243A21BE770BA39F4B201C9
SHA-512:	97D546DF59A0E3C46339F73B2F82B0380C60B25E1AC29780C407AB7C153AD349F4876A59753CF700C858F149E230134B8ACD4EBFD7715AFB7991DBA3F235039E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........>..P..P..P.....P...Q..P...U..P...T..P...S..P.Q.Q..P...Q..P..Q...P.Q.S..P.Q.]..P.Q.P..P.Q...P.Q.R..P.Rich.P.................PE..d....O[a.........." .....p...................................................0............`..........................................,..P....)....... ...........'...........-..........................................8...........................................UPX0....................................UPX1.....p.......f..................@....rsrc........ .......j..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI75162\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\oneDrive.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31464
Entropy (8bit):	7.601890523826956
Encrypted:	false
SSDEEP:	768:TpB1JH2ZEsqMA7VPLgbbSxp48IAYITmDG4ywh2:TpB1J8EsqPPLgb2U8IAYITyyz
MD5:	813FED5002DBC12187B9854C3F7B19E1
SHA1:	8F25D1FA742E44B53B936BECF96E5578905BD49B
SHA-256:	7871BA8E0A2E62CBF67B3C325856F3A6C184244F4EA182CA4D37DF71E3579372
SHA-512:	2500CB93D3110081BC7D67913E968E8FA2AE5DEA96371650FAFD1920E7301FCD0D5EF8DCA5B248497E36C6F491C86BCF9EBA6D67595D202D64FC6B9DAB25C089
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.................m.....B.......B.......B.......B.....................F......................................Rich....................PE..d....O[a.........." .....P..........P/.......................................P............`.........................................\|K..P....I.......@.......................K......................................P;..8...........................................UPX0....................................UPX1.....P.......N..................@....rsrc........@.......R..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI75162\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\oneDrive.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83176
Entropy (8bit):	7.914477090250098
Encrypted:	false
SSDEEP:	1536:K9axlKSugjKItvsXAVDW/UVkbqLYYOHrPvIAD1F/yo0:VkHgjKIRCAV4akb4YlIAD1FA
MD5:	EA47E0C7CE88D0E5B2DDDB4CD87B19CB
SHA1:	DBDA90AC617CA7B436E64EEA0EA67F7588E88A54
SHA-256:	346EC5F471A698C200C639E4FBF1759BA270DC36CB2EA92CAD70F18F735B872F
SHA-512:	89E4AA3B4EEB01DD8143A0822C379EF6F6A1E7972F7CA14808C21D85B38FCA13BCDCF71A9DF881634B4B93EB553C7F99E0C4F5C45CFB139F179F36D258A2737A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........l.h...h...h.......h.......h.......h.......h.......h..+....h.......h...h...h..+....h..+....h..+....h..+....h..Rich.h..........PE..d....O[a.........." ..... ................................................................`.........................................4...L....................@..........................................................8...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI75162\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\oneDrive.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39144
Entropy (8bit):	7.677237240694584
Encrypted:	false
SSDEEP:	768:s6p4KUJsCdi2aLC8RJGcNETXKqcJjwynQjk/HXgdpTbpIABwOmfDG4y/W7h5:VpghdidC8uc2TaqchwyQjsHibpIABwOC
MD5:	0E93D87D1523899D18C6E2636CAE3147
SHA1:	714CFCA29BF82FD5C61292676710E8614D62E364
SHA-256:	C762D81610A4163A40724E1EF13FA9C07ACC99BEC928AD90D1A27705DF477E98
SHA-512:	7464168BF26A96112109944BC837BF477BDFCCE8DAACC63A19799FCDFEF03DCEF3A552DA7D433E9553B94D7C2DA36CF69F92F20633E9BC2C491D80DF2BF6DB40
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......BV...7...7...7...Og..7..TB...7..TB..7..TB..7..TB...7...B...7...\...7...7...7...B...7...B...7...B...7...B...7..Rich.7..........................PE..d....O[a.........." .....p...........k....................................................`.............................................P.......h............ ..<...........X........................................w..8...........................................UPX0....................................UPX1.....p.......j..................@....rsrc................n..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI75162\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\oneDrive.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59112
Entropy (8bit):	7.825725095421999
Encrypted:	false
SSDEEP:	1536:SVSeTECZ1REn5q3bzLzeqmDXt+LHD04KT0WhvG2IAM7F5vyU:y9EWbK+bz70Xt+Lg4q0UnIAM7F/
MD5:	8CFBBD3785EE9D63F6964CE3DD6A3DDF
SHA1:	68F03518A2B886DC55D528ACB35A2BE1B88DD7CF
SHA-256:	6F080DE35210710561CA59EDF39EE23833913FBDF6124C75D01397AC56E93368
SHA-512:	BB952983EC05969D9B1A58ED044A99C39017EF4713069066B06BA8DE1BB91421D43507D004F0743E66362CBAAF5AA2C6C05242DECCAE502C17D5295DF104E6C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H..w&.w&.w&....w&...'.w&...#.w&...".w&...%.w&.%.'.w&...'.w&..'.w&.w'..v&.%.+.w&.%.&.w&.%...w&.%.$.w&.Rich.w&.................PE..d....O[a.........." ................`.....................................................`.........................................p...d....................P......................................................p...8...........................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip

Download File

Process:	C:\Users\user\Desktop\oneDrive.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	modified
Size (bytes):	1064190
Entropy (8bit):	5.6724117500610065
Encrypted:	false
SSDEEP:	12288:LVghgWWy4C6Sdc77A4a2YloXVw9sfJEKHwQjuErsv6SDQN+:LVgh1V4hLa2kAVw9sfJEKH9uEYv9QN+
MD5:	4DAA5024B193E214F7FD551E13EEE561
SHA1:	4FCE6977CA26624EAE0B571D83300A6245E1D1FA
SHA-256:	2EDDABBF799E207E1602BC200D7C96594990AD95047C49D69C1025C4C10A7E48
SHA-512:	4137600AAD6B23FFB1449C1AF64614C6FA5770F945E70FAE35AE7156CB0DF2F176D2291CB747BA3DA1EC5668F4FCACB3FAB94F37D44C490B8F960026B4AAB582
Malicious:	false
Preview:	PK..........!.^/.............._collections_abc.pyco....................................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

C:\Users\user\AppData\Local\Temp\_MEI75162\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\oneDrive.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1102072
Entropy (8bit):	7.937741945378803
Encrypted:	false
SSDEEP:	24576:ZmjOKwERFZcyYl23vf5/PuYm5jOukzPRHE935b1CPwDv3uFfJT:899rZcyY0vf5eYtzgpb1CPwDv3uFfJT
MD5:	ED33D69655B6698FE1AB97F41C37659E
SHA1:	6BA390714A1ED0926B81923340EAC22A115384BF
SHA-256:	16A844C815B485BAB5A705AE2DCA11D7C24E6AC84649D506EE0B0A0302233C90
SHA-512:	8499087665554161A31CF3C60100AF0AFF04A8D1F7F5978E6CEA959154F46C486CFCB371185E29C37C2CA96B4AA696162BD740BF22237823DE37603547BB0E10
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.>y..P..P..Pv..m.P-.Q+}.P-.U+t.P-.T+w.P-.S+{.Pk.Q+t.P..Q..P).S+b.P).T+..P).P+~.P).~.P).R+~.PRich..P*........PE..d.....'a.........." .............p&.P.5...&..................................@7...........`......................................... 85......35.h....05......@2..............87.....................................h$5.8...........................................UPX0.....p&.............................UPX1..........&.....................@....rsrc........05.....................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI75162\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\oneDrive.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	203000
Entropy (8bit):	7.923707983801741
Encrypted:	false
SSDEEP:	3072:Ar1sMu77AZKZYQH0MLv5L/gUBx/GkGI4xoga1dFTDmeXxQotSZmdvKYT:sDmn6QUATTCkmza1/TD6lZmYYT
MD5:	A662C288C164C94EF0C171BB1E2F8FB8
SHA1:	B374A807CD8FF4CACA62C69C7BF9D2944BB58D26
SHA-256:	C414891850A20CE9DF7CF6739EC3FA8A57D1A2C711E1D246DC137EF3F58DD377
SHA-512:	4D1A80EA673CED29BDEEA4B6C9DC2CFA88AE60FF32329503196B5C6B37A72FF84ADF12F1DAA1598D1AFB0031949B0FD7171094B631DD65E08C6BCAC99992269F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&v..G.^.G.^.G.^.?.^.G.^.2._.G.^.,._.G.^.2._.G.^.2._.G.^.2._.G.^.2._.G.^.G.^HF.^.2._.G.^.2._.G.^.2.^.G.^.2._.G.^Rich.G.^........................PE..d.....'a.........." .........P...P.......`...................................`............`.............................................4@.......................K...........V..........................................8...........................................UPX0.....P..............................UPX1.........`......................@....rsrc....P.......H..................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI75162\python310.dll

Download File

Process:	C:\Users\user\Desktop\oneDrive.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1500400
Entropy (8bit):	7.991842049368431
Encrypted:	true
SSDEEP:	24576:Vfng8rkHg8NdzWjg0oHc47V2AvoceevFH1fuc0kk3do2Nnix7zXKx2NHgP8txDi:xrQAkzWnoHc452+Luc0Ndo2NnuzXof0H
MD5:	FE730FAA642713F53BE7423421CF3273
SHA1:	B31588980A40F4FC45C5DEB51869D850D1490DA1
SHA-256:	DE05A58247136D07970B5D3A0582143833E397ABFB9BA22E36FCAE99F4C7C66D
SHA-512:	AB11100259A5B81A8C424F2EA47886CA821BAD1128973FD4BC068F9F46B4000F54793EDB2DCB596E63616BB45E88B30EA129100225685C17ED36CA6B238C37BF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................~..........................................3...F..3......3.\|....3......Rich...........PE..d...pO[a.........." .............`/.0SE..p/..................................PF...........`...........................................E......yE.d....pE......@B.0............@F.$...................................H_E.8...........................................UPX0.....`/.............................UPX1.........p/.....................@....rsrc........pE.....................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI75162\select.pyd

Download File

Process:	C:\Users\user\Desktop\oneDrive.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21744
Entropy (8bit):	7.246215527153422
Encrypted:	false
SSDEEP:	384:fliRfircQWhIRkgnNU3frZa7gJXp+zhIAmGT6UDG4y8JAgwhp:flGCcQWyR1gp5+zhIAmGTxDG4yMwh
MD5:	6706A624334444775C2919E761B79852
SHA1:	2CD002957A611C0C714A28AF085FA79D7DE300BD
SHA-256:	37825176B35BA6835F779DEDCF1BAFD5B84AE05B525002811D7B30CD8D8FDC61
SHA-512:	FA3842089DC70FA9916EFCD40D33804989B198EF7A0AFB75BE3DB5ECDF9DEEFB03AC32CBEC4C5AC1035CF2079BA8B1A6A510447A2571DEF2A03D2EED8014C612
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f ...N...N...N.......N..rO...N..rK...N..rJ...N..rM...N..rO...N..lO...N...O...N..rC...N..rN...N..r....N..rL...N.Rich..N.........................PE..d....O[a.........." .....0................................................................`......................................... ...L....................`..............l...........................................8...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI75162\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\oneDrive.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	292080
Entropy (8bit):	7.984827890087239
Encrypted:	false
SSDEEP:	6144:h9pWfzi7fiLvelz/zPkE9V/IGti/soJKmDh25ncxN//k1eIuxUyWHaxuf:g+fnz/zcuVQIklJjKcxN/Me+yhuf
MD5:	C82E111F974B574899395A75A01BEEC6
SHA1:	2D55CE3F5F871C617086E4ED3010B57A9D499E7A
SHA-256:	57DFC216E9D0B94A8426CA3B49A1D0BE4FFEC672330D9092B1875571A202E99D
SHA-512:	14B958FDCBA90D743C9E512BBEE03FB1415866AE0E10BF5BCEC6C2F16BE6B31ADC8190BB1B96BE7445607C2CAFFD197D40957F28D48B7FA0CBE7F39D7C62AB7A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N$z./J)./J)./J).W.)./J).ZK(./J).ZO(./J).ZN(./J).ZI(./J)YZK(./J).DK(./J)./K)./J)YZG(./J)YZJ(./J)YZ.)./J)YZH(./J)Rich./J)................PE..d....O[a.........." .....P...........V... ................................................`..........................................{..X....y.......p.......................{.......................................b..8...........................................UPX0....................................UPX1.....P... ...F..................@....rsrc........p.......J..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.9851804812646066
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	oneDrive.exe
File size:	4'802'649 bytes
MD5:	8509691d37f05049067df88592964a4b
SHA1:	37db71172ab64c108fedca85e5be51a499b2ba12
SHA256:	451ee465675e674cebe3c42ed41356ae2c972703e1dc7800a187426a6b34efdc
SHA512:	d023e939b7eb96837c1ea1a0ccb9479a82b4cbb5d1a195927f0e3ca28ed281c93dff5aaf726027d4598152693629872880d6343b46aa932120350e49f8343783
SSDEEP:	98304:I2XvRHtJQi9UWvGf//PuIsLR5l0XnwQXuerDkRTrJD:IMvRHvUWvoXPu0X7roRTt
TLSH:	5826335835A494FAFDB7C03EC880981AEA71B4321765E7CF13B044624F3B6925C7ABD6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W...W...W.../...W.../...W.../...W...+l..W...+...W...+...W...+...W.../...W...W..)W..e+...W..e+...W..Rich.W.................

File Icon


Icon Hash:	1fe731b1b131f02f

Static PE Info

General

Entrypoint:	0x14000b310
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x64E5BE24 [Wed Aug 23 08:07:00 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	0b5552dccd9d0a834cea55c0c8fc05be

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F8FCC8D780Ch
dec eax
add esp, 28h
jmp 00007F8FCC8D741Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F8FCC8D7D84h
test eax, eax
je 00007F8FCC8D75C3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F8FCC8D75A7h
dec eax
cmp ecx, eax
je 00007F8FCC8D75B6h
xor eax, eax
dec eax
cmpxchg dword ptr [0004121Ch], ecx
jne 00007F8FCC8D7590h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F8FCC8D7599h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
movzx eax, byte ptr [00041207h]
test ecx, ecx
mov ebx, 00000001h
cmove eax, ebx
mov byte ptr [000411F7h], al
call 00007F8FCC8D7B83h
call 00007F8FCC8D8CB2h
test al, al
jne 00007F8FCC8D75A6h
xor al, al
jmp 00007F8FCC8D75B6h
call 00007F8FCC8E5291h
test al, al
jne 00007F8FCC8D75ABh
xor ecx, ecx
call 00007F8FCC8D8CC2h
jmp 00007F8FCC8D758Ch
mov al, bl
dec eax
add esp, 20h
pop ebx
ret
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [000411BCh], 00000000h
mov ebx, ecx
jne 00007F8FCC8D7609h
cmp ecx, 01h
jnbe 00007F8FCC8D760Ch
call 00007F8FCC8D7CEAh
test eax, eax
je 00007F8FCC8D75CAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3bd0c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x13ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x4e000	0x20c4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x54000	0x758	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x39480	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39340	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2a000	0x418	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28800	0x28800	443d51fb84559b563832949912f06b00	False	0.5583465952932098	data	6.488023200564254	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2a000	0x12b16	0x12c00	31d3f3f02dca1cad12d52351b53207de	False	0.5154817708333334	data	5.8246724563252075	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3d000	0x103f8	0xe00	afabb66fdcd2825de5909f10c900fca7	False	0.13309151785714285	DOS executable (block device driver \377\3)	1.8096886543499544	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x4e000	0x20c4	0x2200	7b210ceebebc00c96d1c55c2b456bbb4	False	0.47794117647058826	data	5.274096406482418	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x51000	0x15c	0x200	c059b775abce97446903f3597b027fae	False	0.384765625	data	2.808567494642619	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x52000	0x13ac	0x1400	2293c301736cb09e6f08486e35624f8d	False	0.71171875	data	6.938870651173487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x54000	0x758	0x800	11aaafc72361ec8886a740c3e209ceb3	False	0.544921875	data	5.2576643703968475	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x520e8	0xd24	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.8341260404280618
RT_GROUP_ICON	0x52e0c	0x14	data	1.05
RT_MANIFEST	0x52e20	0x58c	XML 1.0 document, ASCII text, with CRLF line terminators	0.44577464788732396

Imports

DLL	Import
USER32.dll	CreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, IsValidCodePage, GetACP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, GetOEMCP, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEnvironmentVariableW, RtlUnwindEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, SetEndOfFile, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 18:10:35.820175886 CEST	53	58483	1.1.1.1	192.168.2.7

Target ID:	1
Start time:	12:10:16
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\oneDrive.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\oneDrive.exe"
Imagebase:	0x7ff6869c0000
File size:	4'802'649 bytes
MD5 hash:	8509691D37F05049067DF88592964A4B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:10:17
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\oneDrive.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\oneDrive.exe"
Imagebase:	0x7ff6869c0000
File size:	4'802'649 bytes
MD5 hash:	8509691D37F05049067DF88592964A4B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:10:18
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "del C:\Windows\Help\en-us\*.rar"
Imagebase:	0x7ff70f680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:10:18
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:10:28
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "hostname"
Imagebase:	0x7ff70f680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:10:28
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:10:28
Start date:	02/10/2024
Path:	C:\Windows\System32\HOSTNAME.EXE
Wow64 process (32bit):	false
Commandline:	hostname
Imagebase:	0x7ff719ff0000
File size:	14'848 bytes
MD5 hash:	33AFAA43B84BDEAB12E02F9DBD2B2EE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:10:28
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "C:\ProgramData\Microsoft\Rar.exe a -r -v1m -n@C:\Windows\media\check.wav -ta20240929000000 -hpN@991li#S!@# C:\Windows\Help\en-us\87072c.rar C:\users\."
Imagebase:	0x7ff70f680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:10:28
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:10:48
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist"
Imagebase:	0x7ff70f680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:10:48
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:10:48
Start date:	02/10/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff73b6a0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:10:49
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "hostname"
Imagebase:	0x7ff70f680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 8124, Parent PID: 8116

General

Target ID:	15
Start time:	12:10:49
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:10:49
Start date:	02/10/2024
Path:	C:\Windows\System32\HOSTNAME.EXE
Wow64 process (32bit):	false
Commandline:	hostname
Imagebase:	0x7ff719ff0000
File size:	14'848 bytes
MD5 hash:	33AFAA43B84BDEAB12E02F9DBD2B2EE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:10:49
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "C:\ProgramData\Microsoft\Rar.exe a -r -v1m -n@C:\Windows\media\check.wav -ta20240929000000 -hpN@991li#S!@# C:\Windows\Help\en-us\87072D.rar D:\\."
Imagebase:	0x7ff70f680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:10:49
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:11:09
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist"
Imagebase:	0x7ff70f680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 1748, Parent PID: 1848

General

Target ID:	22
Start time:	12:11:09
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:11:09
Start date:	02/10/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff73b6a0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	50

Executed Functions

Function 00007FF6869E4E20 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF6869E4E65

Part of subcall function 00007FF6869E47B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E47CC

Part of subcall function 00007FF6869D9E18: RtlFreeHeap.NTDLL(?,?,?,00007FF6869E1E42,?,?,?,00007FF6869E1E7F,?,?,00000000,00007FF6869E2345,?,?,?,00007FF6869E2277), ref: 00007FF6869D9E2E
Part of subcall function 00007FF6869D9E18: GetLastError.KERNEL32(?,?,?,00007FF6869E1E42,?,?,?,00007FF6869E1E7F,?,?,00000000,00007FF6869E2345,?,?,?,00007FF6869E2277), ref: 00007FF6869D9E38

Part of subcall function 00007FF6869D9DD0: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6869D9DAF,?,?,?,?,?,00007FF6869D21EC), ref: 00007FF6869D9DD9
Part of subcall function 00007FF6869D9DD0: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6869D9DAF,?,?,?,?,?,00007FF6869D21EC), ref: 00007FF6869D9DFE

_get_daylight.LIBCMT ref: 00007FF6869E4E54

Part of subcall function 00007FF6869E4818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E482C

_get_daylight.LIBCMT ref: 00007FF6869E50CA
_get_daylight.LIBCMT ref: 00007FF6869E50DB
_get_daylight.LIBCMT ref: 00007FF6869E50EC
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6869E532C), ref: 00007FF6869E5113

Strings

Eastern Standard Time, xrefs: 00007FF6869E51B9
Eastern Summer Time, xrefs: 00007FF6869E51D1

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 77ba2d10f7a40a17f98ee8fd01e8c058cff67636c36494bf754a44884999314e
Instruction ID: 4a730f5b140078a5de538043c89b975cabd17c3897cac6644a78913b76a902d4
Opcode Fuzzy Hash: 77ba2d10f7a40a17f98ee8fd01e8c058cff67636c36494bf754a44884999314e
Instruction Fuzzy Hash: 44D17C66A18283C6EF20AF25D4511B967A1FF84B94F45813EEA0D876C6DF7EEC42C740

Function 00007FF6869E5D6C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6869E5AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E5AE1
Part of subcall function 00007FF6869E5AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E5B5F
Part of subcall function 00007FF6869E5AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E5BB0

CreateFileW.KERNELBASE ref: 00007FF6869E5E72
CreateFileW.KERNEL32 ref: 00007FF6869E5EC2
GetLastError.KERNEL32 ref: 00007FF6869E5EF2
GetFileType.KERNELBASE ref: 00007FF6869E5F07
GetLastError.KERNEL32 ref: 00007FF6869E5F11
CloseHandle.KERNEL32 ref: 00007FF6869E5F44
CloseHandle.KERNEL32 ref: 00007FF6869E60A7
CreateFileW.KERNEL32 ref: 00007FF6869E60DC
GetLastError.KERNEL32 ref: 00007FF6869E60EB

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: f9714f3a8e10acd42ca2d2c5b2c2c8a966f4ca54d5d677232d284773bb45134f
Instruction ID: ffb95471b4a742d7601a96979353f00057265813c4828013fc064cbb673f0455
Opcode Fuzzy Hash: f9714f3a8e10acd42ca2d2c5b2c2c8a966f4ca54d5d677232d284773bb45134f
Instruction Fuzzy Hash: 6FC1A236B24A82C6EF51CF69C4906AC3761FB49BA8B015239DA1E977D6CF7AD851C300

Function 00007FF6869C6780 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,00000000,?,00007FF6869C674D), ref: 00007FF6869C681A

Part of subcall function 00007FF6869C6990: GetEnvironmentVariableW.KERNEL32(00007FF6869C36E7), ref: 00007FF6869C69CA
Part of subcall function 00007FF6869C6990: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6869C69E7

Part of subcall function 00007FF6869D66B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D66CD

SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF6869C68D1

Part of subcall function 00007FF6869C2770: MessageBoxW.USER32 ref: 00007FF6869C2841

Strings

TMP, xrefs: 00007FF6869C67B8, 00007FF6869C6879, 00007FF6869C6907
TMP, xrefs: 00007FF6869C67DE
_MEI%d, xrefs: 00007FF6869C6828
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF6869C67F8

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: e6afb0128859ccbf49ce8011b8d869e8e025b7611e3f9a50b4fcc1994f3a2000
Instruction ID: 12615383b6e2257a10b6f3c23b9eacad0eb6fbf4281c3efd35d3c732767b3415
Opcode Fuzzy Hash: e6afb0128859ccbf49ce8011b8d869e8e025b7611e3f9a50b4fcc1994f3a2000
Instruction Fuzzy Hash: 84515921B1D6C3C1FE54AB62A9556BA5251BF89BD0F484439ED0ECB7D7EE2EEC01C600

Function 00007FF6869E509C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF6869E50CA

Part of subcall function 00007FF6869E4818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E482C

_get_daylight.LIBCMT ref: 00007FF6869E50DB

Part of subcall function 00007FF6869E47B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E47CC

_get_daylight.LIBCMT ref: 00007FF6869E50EC

Part of subcall function 00007FF6869E47E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E47FC

Part of subcall function 00007FF6869D9E18: RtlFreeHeap.NTDLL(?,?,?,00007FF6869E1E42,?,?,?,00007FF6869E1E7F,?,?,00000000,00007FF6869E2345,?,?,?,00007FF6869E2277), ref: 00007FF6869D9E2E
Part of subcall function 00007FF6869D9E18: GetLastError.KERNEL32(?,?,?,00007FF6869E1E42,?,?,?,00007FF6869E1E7F,?,?,00000000,00007FF6869E2345,?,?,?,00007FF6869E2277), ref: 00007FF6869D9E38

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6869E532C), ref: 00007FF6869E5113

Strings

Eastern Standard Time, xrefs: 00007FF6869E51B9
Eastern Summer Time, xrefs: 00007FF6869E51D1

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 74e2aae664cff904285b8cceaf5bd78e264b53cf78d1017760ee0a7f729cca6e
Instruction ID: f05a120133836877883eb79a7598f4e417a44c09cbd800705c14821e6c1c51b4
Opcode Fuzzy Hash: 74e2aae664cff904285b8cceaf5bd78e264b53cf78d1017760ee0a7f729cca6e
Instruction Fuzzy Hash: F9516A72A18683C6EB20EF21E9911A96760BF88784F45513EEA4DC36D6DF7EEC01C740

Function 00007FF6869C17B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF6869C185C
_fread_nolock.LIBCMT ref: 00007FF6869C190E

Part of subcall function 00007FF6869CF370: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869CF384

Part of subcall function 00007FF6869C2770: MessageBoxW.USER32 ref: 00007FF6869C2841

Strings

Cannot read Table of Contents., xrefs: 00007FF6869C1995
Error on file., xrefs: 00007FF6869C193D
Could not allocate buffer for TOC!, xrefs: 00007FF6869C18E3
fread, xrefs: 00007FF6869C186E
Could not read full TOC!, xrefs: 00007FF6869C1919
Failed to read cookie!, xrefs: 00007FF6869C1867
malloc, xrefs: 00007FF6869C18EA
fseek, xrefs: 00007FF6869C1836
Failed to seek to cookie position!, xrefs: 00007FF6869C182F
MEI, xrefs: 00007FF6869C17EF

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _fread_nolock$Message_invalid_parameter_noinfo
String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 2153230061-4158440160
Opcode ID: 68b35546f29596827bc47b3227837218a9e837bbf0a69e001d444f975be426ca
Instruction ID: 6baa0f4772c03c00f59c1df640cf9658c2e9d7bfcb866351f80806edd549a0fc
Opcode Fuzzy Hash: 68b35546f29596827bc47b3227837218a9e837bbf0a69e001d444f975be426ca
Instruction Fuzzy Hash: 33511A72A09683C6EF54CF28E45517833A0FF48B58B518139DA0EC77DAEE6EE944C744

Function 00007FF6869C1440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF6869C14CA
fread, xrefs: 00007FF6869C15EC
fopen, xrefs: 00007FF6869C1491
Failed to extract %s: failed to open target file!, xrefs: 00007FF6869C148A
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF6869C15D5
malloc, xrefs: 00007FF6869C1560
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6869C14F9
fseek, xrefs: 00007FF6869C1500
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF6869C1559
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6869C15E5
fwrite, xrefs: 00007FF6869C15DC

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 0-666925554
Opcode ID: 6041479c6bed9feef08198157533aa3f314bee298d6c7b4abc1b35478bb2c527
Instruction ID: ec3dde29b07e951715218c0a3e8332ebf4329088ddccf8077d0ee4201b64d0fe
Opcode Fuzzy Hash: 6041479c6bed9feef08198157533aa3f314bee298d6c7b4abc1b35478bb2c527
Instruction Fuzzy Hash: F5517861B08AC3C1EE209B21E5546B963A0BF45BE8F444539DE0EC76E7EE7EE945C304

Function 00007FF6869C78A0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00007FF6869C685A,?,00007FF6869C674D), ref: 00007FF6869C78E0
OpenProcessToken.ADVAPI32(?,00007FF6869C674D), ref: 00007FF6869C78F1
GetTokenInformation.KERNELBASE(?,00007FF6869C674D(TokenIntegrityLevel)), ref: 00007FF6869C7913
GetLastError.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF6869C791D
GetTokenInformation.KERNELBASE(?,TokenIntegrityLevel), ref: 00007FF6869C795A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6869C796C
CloseHandle.KERNEL32(?,00007FF6869C674D), ref: 00007FF6869C7984
LocalFree.KERNEL32(?,00007FF6869C674D), ref: 00007FF6869C79B6
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF6869C79DD
CreateDirectoryW.KERNELBASE(?,00007FF6869C674D), ref: 00007FF6869C79EE

Strings

S-1-3-4, xrefs: 00007FF6869C798F
D:(A;;FA;;;%s), xrefs: 00007FF6869C7999

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: bd17a40a22c884ade7d87aa0fec574675d56acca5ecee7ff6bf5a056ddc52e71
Instruction ID: 8da2eea8deb8d7015943f864ab9d974cea02c40b2eda5059854a239fdba017de
Opcode Fuzzy Hash: bd17a40a22c884ade7d87aa0fec574675d56acca5ecee7ff6bf5a056ddc52e71
Instruction Fuzzy Hash: 96413D3161C6C3C2EF509F61E4446AA7361FF857A4F440239EA9E866E6DF7DD944CB00

Function 00007FF6869C6FD0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6869C7A30: MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7A6A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF6869C3A30), ref: 00007FF6869C701F
GetStartupInfoW.KERNEL32 ref: 00007FF6869C703E

Part of subcall function 00007FF6869D9184: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D9198

Part of subcall function 00007FF6869D6EF8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D6F5F

GetCommandLineW.KERNEL32 ref: 00007FF6869C70DE
CreateProcessW.KERNELBASE ref: 00007FF6869C7120
WaitForSingleObject.KERNEL32 ref: 00007FF6869C7134
GetExitCodeProcess.KERNELBASE ref: 00007FF6869C7144

Strings

CreateProcessW, xrefs: 00007FF6869C7157
Error creating child process!, xrefs: 00007FF6869C7150

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 818e29d337d92c80142cd965dc47d4137e35c853672c1fb6e5a7bce6e7f526a1
Instruction ID: 7f8df44f7d045042c4078dee0a01664aadb41bf48f778d8dee9f7bd61b584d72
Opcode Fuzzy Hash: 818e29d337d92c80142cd965dc47d4137e35c853672c1fb6e5a7bce6e7f526a1
Instruction Fuzzy Hash: A4412032A087C3C2DE209B64E8552AAB364FF95364F400339E6AD87AE6DF7DD454CB40

Function 00007FF6869C1000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6869C3BA0: GetModuleFileNameW.KERNEL32(?,00007FF6869C3699), ref: 00007FF6869C3BD1

SetDllDirectoryW.KERNEL32 ref: 00007FF6869C38A5

Part of subcall function 00007FF6869C6990: GetEnvironmentVariableW.KERNEL32(00007FF6869C36E7), ref: 00007FF6869C69CA
Part of subcall function 00007FF6869C6990: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6869C69E7

Strings

Cannot side-load external archive %s (code %d)!, xrefs: 00007FF6869C382C
Failed to convert DLL search path!, xrefs: 00007FF6869C388D
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF6869C378E
_MEIPASS2, xrefs: 00007FF6869C36D3, 00007FF6869C373C, 00007FF6869C39EB, 00007FF6869C39FB
_PYI_ONEDIR_MODE, xrefs: 00007FF6869C36FC, 00007FF6869C3727
MEI, xrefs: 00007FF6869C37E7

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: 50111eb3a4ecf2aa9f2e8277530249e951fb5dfdc06a0922ff57c1695f9e45b2
Instruction ID: 8a413891b6935212a964e5ed665dfd365a39070ce06dff9cbd96d0c9a3657484
Opcode Fuzzy Hash: 50111eb3a4ecf2aa9f2e8277530249e951fb5dfdc06a0922ff57c1695f9e45b2
Instruction Fuzzy Hash: D1B18121A1CAC3D1EE65AB2194512FD6390BF44784F80413AEA4FC76DBEE2EEE05D740

Function 00007FF6869C1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6869C1249
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6869C10B4
1.2.13, xrefs: 00007FF6869C107E
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6869C10F1
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6869C111F
malloc, xrefs: 00007FF6869C10F8, 00007FF6869C1126

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Message
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1655038675
Opcode ID: 2f46febe429223a823cb0d88def6e2cd0a3a4a90dbb08f42ff036ba8ee2fdb2c
Instruction ID: 955c61dbf2f9955b0a763ad5e6a27ffde3007a405058485060dfca9b9a955f49
Opcode Fuzzy Hash: 2f46febe429223a823cb0d88def6e2cd0a3a4a90dbb08f42ff036ba8ee2fdb2c
Instruction Fuzzy Hash: 8551BC22A086C3C5EE609B55E4503BA6290BF86BA4F444139DE4EC77DAEF3EE945C704

Function 00007FF6869DDDB8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,00000000,?,00007FF6869DE152,?,?,-00000018,00007FF6869DA223,?,?,?,00007FF6869DA11A,?,?,?,00007FF6869D5472), ref: 00007FF6869DDF34
GetProcAddress.KERNEL32(?,00000000,?,00007FF6869DE152,?,?,-00000018,00007FF6869DA223,?,?,?,00007FF6869DA11A,?,?,?,00007FF6869D5472), ref: 00007FF6869DDF40

Strings

api-ms-, xrefs: 00007FF6869DDE7E
ext-ms-, xrefs: 00007FF6869DDE91

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 01869d8b0b1ae08ce046380e8c955ca032c286979885a37836ee5a28d8bde6d1
Instruction ID: 9d107852cfc4aa0f868c5404c2d617d4e674a6d402143d49c1fa439845df7a03
Opcode Fuzzy Hash: 01869d8b0b1ae08ce046380e8c955ca032c286979885a37836ee5a28d8bde6d1
Instruction Fuzzy Hash: 9341E122B19693C1FE25CB1698005756299BF15BA0F4A413DDD0DC77DAEE7EEC49C310

Function 00007FF6869DAF2C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869DB359

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 184652ea66a00c646f0d6e367f8fa0d47b8fb75159f9cd0cc9461bb9675fa9ff
Instruction ID: 35f6306d704fc450e07160b12ce18835cde31332b95a2372a797c17fbde69450
Opcode Fuzzy Hash: 184652ea66a00c646f0d6e367f8fa0d47b8fb75159f9cd0cc9461bb9675fa9ff
Instruction Fuzzy Hash: 13C1B262A086C7C2EF609B1594402BD6BA6FF91B90F550139DA4E837DBCE7EEC45C300

Function 00007FF6869DC430 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF6869DC41B), ref: 00007FF6869DC54C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF6869DC41B), ref: 00007FF6869DC5D7

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: f410d9e07cb2d854853af875ff306a0e9c9ee922f70c4cde11a48ef332fbc2ec
Instruction ID: a9441e32a3afeeca4ddadcb5b85b1b15deb759aef26ec62ca785a7e1ea7d543a
Opcode Fuzzy Hash: f410d9e07cb2d854853af875ff306a0e9c9ee922f70c4cde11a48ef332fbc2ec
Instruction Fuzzy Hash: BE918C62A18693C5FB608F6594403BD2BA9BF44BC8F54513DDA0EA7AD6DF3AD842C700

Function 00007FF6869DE8DC Relevance: 6.2, APIs: 4, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF6869DE9CC
_get_daylight.LIBCMT ref: 00007FF6869DE9DD
_get_daylight.LIBCMT ref: 00007FF6869DE9EE
_isindst.LIBCMT ref: 00007FF6869DEAB9

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: d5d13d1c94d14ccfec0c44e7243bbda22246c77cf8c41a11f0b86d98f8b3a05c
Instruction ID: 9284604e2a3f059722f4b685aee7ca3fc47244255e99c7c081658d03c1867a06
Opcode Fuzzy Hash: d5d13d1c94d14ccfec0c44e7243bbda22246c77cf8c41a11f0b86d98f8b3a05c
Instruction Fuzzy Hash: 2351C572F04693CAEF14DB68A9816BC27A5BF50368F54423DED1E92AD6DF39AC41C700

Function 00007FF6869CB19C Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF6869CB1AB

Part of subcall function 00007FF6869CB36C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6869CB38E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6869CB1C0
__scrt_release_startup_lock.LIBCMT ref: 00007FF6869CB22E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6869CB281

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 90a7fcc3a81af5bf04ad81541e301d7d9fb9f11ea0fdd18d74326f9016f6428e
Instruction ID: c44b0a608571c3da6aa2a096032fc1fad657fba48939cd9cdd61962a0bcf5723
Opcode Fuzzy Hash: 90a7fcc3a81af5bf04ad81541e301d7d9fb9f11ea0fdd18d74326f9016f6428e
Instruction Fuzzy Hash: A5313911E08183C6FE14AB6095613BD3282BFA5384F45003CD94FCB2EBDE6FAE06C201

Function 00007FF6869D4680 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D46AD
CreateFileW.KERNELBASE ref: 00007FF6869D46EC
CloseHandle.KERNEL32 ref: 00007FF6869D4721

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 1c8fa0e9f1f268703cdfbf571ccde9a0ae4dbb37f3b5d3b3dc57de33b3aee677
Instruction ID: 54af97e77354bbb2b2d59b266c33b0ebdf1e0cd9b2f329112b284c0e020acf48
Opcode Fuzzy Hash: 1c8fa0e9f1f268703cdfbf571ccde9a0ae4dbb37f3b5d3b3dc57de33b3aee677
Instruction Fuzzy Hash: 5E418322E187C2C3EB948B61951037962A0FF95B64F109338E69C47AD7DF6DA9E0C700

Function 00007FF6869D8888 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6869D8884), ref: 00007FF6869D8899
TerminateProcess.KERNEL32(?,?,?,00007FF6869D8884), ref: 00007FF6869D88A4
ExitProcess.KERNEL32 ref: 00007FF6869D88B3

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: d426427e4f48dbbb9dc5f253e5f2c69f0b75b8518679dacd75070a6bbb583433
Instruction ID: 3dfb40239b053b8c91d6a486a76a98fa43dadd9ed469e1c9b6dae5d383991e51
Opcode Fuzzy Hash: d426427e4f48dbbb9dc5f253e5f2c69f0b75b8518679dacd75070a6bbb583433
Instruction Fuzzy Hash: ABD06C10B18683C2EE182BB0599517912127F88B61B11283CC81A8A7E7CDAEAC49C300

Function 00007FF6869CF39C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869CF3E0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869CF4D7

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e6b31fcbb010569d964db91d6e465c54053a5eb593f9b70391a20bf1ad845ba7
Instruction ID: 1ddfc6e910e589cafb0d55d111a27352bfd63f83c7b17d911d935b6c52a2941c
Opcode Fuzzy Hash: e6b31fcbb010569d964db91d6e465c54053a5eb593f9b70391a20bf1ad845ba7
Instruction Fuzzy Hash: BB51D461B092C3C6EE689E25950467A6691BF44BE4F148638DE6EC77CBCF3EDC01C601

Function 00007FF6869DB604 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,00000000,00007FF6869DB79D), ref: 00007FF6869DB650
GetLastError.KERNEL32(?,?,?,?,00000000,00007FF6869DB79D), ref: 00007FF6869DB65A

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: ff2257711b1d275b862e663729d543ef4812b290fbf882e2e1232765a84f7875
Instruction ID: 55e0760c798f35c2569b785a52dc0337a394420d47c0e93d2944f701cd1159ca
Opcode Fuzzy Hash: ff2257711b1d275b862e663729d543ef4812b290fbf882e2e1232765a84f7875
Instruction Fuzzy Hash: 2A118FA2A18B82C1DE108B25A40416D7762BF45BF4F944339EA7D877EACF7DD851C700

Function 00007FF6869D6984 Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6869D6801), ref: 00007FF6869D69A7
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6869D6801), ref: 00007FF6869D69BD

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 830c94081867150c960b6d723a3faffd283ff7679e667b9fb6d49bf0e5e2b665
Instruction ID: 7f54df71d7538cbb144f8064f4618191f39e1c964096e6fb4732ff075b316b05
Opcode Fuzzy Hash: 830c94081867150c960b6d723a3faffd283ff7679e667b9fb6d49bf0e5e2b665
Instruction Fuzzy Hash: 53017C3250C692C2EB608F15A40167AB7A0FF81731F60023AF6AD815D9DF7ED815CB00

Function 00007FF6869D9E18 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF6869E1E42,?,?,?,00007FF6869E1E7F,?,?,00000000,00007FF6869E2345,?,?,?,00007FF6869E2277), ref: 00007FF6869D9E2E
GetLastError.KERNEL32(?,?,?,00007FF6869E1E42,?,?,?,00007FF6869E1E7F,?,?,00000000,00007FF6869E2345,?,?,?,00007FF6869E2277), ref: 00007FF6869D9E38

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 875bb2537aa3df01b4a1e34b7b101e94a2dc47b4cb64fa0c1180c15e07a79d81
Instruction ID: e233039c3f063b84a7f2222e7b2d7db71e5b20832fec8a66159b2c913f31ce4d
Opcode Fuzzy Hash: 875bb2537aa3df01b4a1e34b7b101e94a2dc47b4cb64fa0c1180c15e07a79d81
Instruction Fuzzy Hash: A5E08C60F08283C2FF58ABB2A88513912A07F98B40F04503CC90DC72E3EF2EAC85C350

Function 00007FF6869D6F70 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE ref: 00007FF6869D6F74
GetLastError.KERNEL32 ref: 00007FF6869D6F7E

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 677f2ceb8ee0d5d75214142403d5559098fe9c7e5a50d88e5e1a5187c850d191
Instruction ID: e23ef4bed944f0971e34f0f881a1d4b31390db087d012cd2a05c2f1beeb829a9
Opcode Fuzzy Hash: 677f2ceb8ee0d5d75214142403d5559098fe9c7e5a50d88e5e1a5187c850d191
Instruction Fuzzy Hash: 3BD01224F28983C6EE542B794C4553C12907F55731F50063DE019C02E3EE6EBD85D201

Function 00007FF6869D66EC Relevance: 3.0, APIs: 2, Instructions: 12COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE ref: 00007FF6869D66F0
GetLastError.KERNEL32 ref: 00007FF6869D66FA

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 45670ffc5494559b4402bb32e1ee61b2bed3bec50e0362f78a5b89dc8e7724e5
Instruction ID: de8b7a7429b0e363d698a6a7e4a2abd745c67795f0992667521d8f71bde5fdd1
Opcode Fuzzy Hash: 45670ffc5494559b4402bb32e1ee61b2bed3bec50e0362f78a5b89dc8e7724e5
Instruction Fuzzy Hash: DAD01220F1C687C2EF5427754D4523811A03F54771F51063CE01AC52E3DE6FAD55C211

Function 00007FF6869DA028 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF6869D9EA5,?,?,00000000,00007FF6869D9F5A), ref: 00007FF6869DA096
GetLastError.KERNEL32(?,?,?,00007FF6869D9EA5,?,?,00000000,00007FF6869D9F5A), ref: 00007FF6869DA0A0

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 649148bb364a2e2bb6c01b4b98e8ba63ccdb9764b03dbbc10b4a89a301f042aa
Instruction ID: d737a1cc6f16eeebada49c06781e2be62655489af6c7ef62383d8b29d848b388
Opcode Fuzzy Hash: 649148bb364a2e2bb6c01b4b98e8ba63ccdb9764b03dbbc10b4a89a301f042aa
Instruction Fuzzy Hash: 68219F21B186C3C5EE509765D4542791292BF85BF0F14423DEA2EC77D3CE6EAC65C300

Function 00007FF6869C6C90 Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6869C7A30: MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7A6A

_findclose.LIBCMT ref: 00007FF6869C6EE9

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ByteCharMultiWide_findclose
String ID:
API String ID: 2772937645-0
Opcode ID: 37a4e224697fbf4831613d35a88c56fbb79b718194e75a506f580689560dc945
Instruction ID: 536e0067b1d47790b8fd2d2bda9182463fb96266c8619a8a656472d7656cdf94
Opcode Fuzzy Hash: 37a4e224697fbf4831613d35a88c56fbb79b718194e75a506f580689560dc945
Instruction Fuzzy Hash: DD71AE62E18AC6C1EA10CB2CC5052FD6360FBA9B48F55E325DB9D52593EF29E6D9C300

Function 00007FF6869DB37C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869DB3A4

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7edcb5c19051daea02f21c4053ec30bf8603933813fd22e9cae156a3527bc5bd
Instruction ID: 231b8e70e92c901180214fd3ef494851442aee016d0e91d6841f46d27fdd9029
Opcode Fuzzy Hash: 7edcb5c19051daea02f21c4053ec30bf8603933813fd22e9cae156a3527bc5bd
Instruction Fuzzy Hash: C941CF72909283C7EE24DA19E540279B3A2FF95B54F100239D68EC76D6CF2EE802C751

Function 00007FF6869C7200 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF6869C72AA

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: abb5fb2f1e2ece73c5b7ea27c97ed87c428d7c079f2870cf2a6124b1c0566b16
Instruction ID: 64991a8481fd01b862e2bf2ecb1abfc886ec1adce2d048773d07bdb5ced14326
Opcode Fuzzy Hash: abb5fb2f1e2ece73c5b7ea27c97ed87c428d7c079f2870cf2a6124b1c0566b16
Instruction Fuzzy Hash: A7218021B092D3C6EE119A12A5147BAA651BF45BD4F884438EF0E8B7C7CE3EE946C600

Function 00007FF6869DAE0C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869DAE92

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 47f2cb7360056a46563935c31beadd7a45ae652dec1b657f4a22353b163fa2db
Instruction ID: cb0f4aae9aa6e56c07f7b2345923d5c3fc933e9148756c73f83a58709fd9c366
Opcode Fuzzy Hash: 47f2cb7360056a46563935c31beadd7a45ae652dec1b657f4a22353b163fa2db
Instruction Fuzzy Hash: 0C316722A18683C9EF91AF15C8413782690BF40BA0F410239EA1D833D3CFBEEC91C725

Function 00007FF6869D87B9 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6869D87E7

Part of subcall function 00007FF6869D88E0: GetModuleHandleExW.KERNEL32 ref: 00007FF6869D8905
Part of subcall function 00007FF6869D88E0: GetProcAddress.KERNEL32 ref: 00007FF6869D891B
Part of subcall function 00007FF6869D88E0: FreeLibrary.KERNEL32 ref: 00007FF6869D8942

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: e9a7e304643df4a79f5f92f113a909c0855d61e5f1cd2648997e34e72053eb35
Instruction ID: 2f5a657defdde97fecea673e24998d2ae17fb294642703dd0b7496241ee72114
Opcode Fuzzy Hash: e9a7e304643df4a79f5f92f113a909c0855d61e5f1cd2648997e34e72053eb35
Instruction Fuzzy Hash: 3B216932E04A86CAEF259F64D4402AC33A0FF44718F15163AD62C8AAD7DF39D984CB80

Function 00007FF6869D54C8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D542D

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction ID: dbd4f0277b0e975a140a45a9be0193ea1b0fb7296ff64198b296dd7a40225499
Opcode Fuzzy Hash: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction Fuzzy Hash: BD115E21A0E6C3C1EE619F5194012B9A2A0BF85B84F444439EA8C97BD7CF7EDC51C742

Function 00007FF6869E575C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E577F

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bc68aba4551d34184bb05bda2552568f64e358e9307c55527e30db01171bb599
Instruction ID: baeb1ffdf0cccce4bb1848af9da19655a8c0a8ee857090300bcd218459b548fb
Opcode Fuzzy Hash: bc68aba4551d34184bb05bda2552568f64e358e9307c55527e30db01171bb599
Instruction Fuzzy Hash: 29214172A18682C6DF619F18E44036976A0FF84B54F144239EA5D876DADF7FD810CB00

Function 00007FF6869CF61C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869CF670

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction ID: 19d8271c81482c0947bf7c50bb4d989528cd58a8303711f9ebab4c5e849c13f6
Opcode Fuzzy Hash: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction Fuzzy Hash: AC01A521A08BC7C1EE049B529A01069A695BF85FE4F084639DE5D97BD7CE3ED901C700

Function 00007FF6869C7330 Relevance: 1.3, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: de2adb1bf489c698f757e3417ae5e0a26a5c09157b409e8aff6e044788b7f808
Instruction ID: 9a438ab6699f15137a2a3cd074472f0c4bc68f492fc35a2e59fb6e1073452cfa
Opcode Fuzzy Hash: de2adb1bf489c698f757e3417ae5e0a26a5c09157b409e8aff6e044788b7f808
Instruction Fuzzy Hash: 4D418716D186C7C2EA119B2495012FC6361FFA9784F45923AEF8E871D3EF29A9C8C700

Function 00007FF6869DDD40 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF6869DA8B6,?,?,?,00007FF6869D9A73,?,?,00000000,00007FF6869D9D0E), ref: 00007FF6869DDD95

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 2e0f3e4b2c9ccc38d96cb592f5054ed38be707e8bf6a1ab6843b3be497aa41a7
Instruction ID: 00c93ae9c86ed463d8c4816b99b927637622d912605ba3f5c2904ae2bb6c4832
Opcode Fuzzy Hash: 2e0f3e4b2c9ccc38d96cb592f5054ed38be707e8bf6a1ab6843b3be497aa41a7
Instruction Fuzzy Hash: 7AF09054B19683C0FE956BA299413B5128C7F99B90F4CA43EC90ED6BD3DD5EEC88C710

Function 00007FF6869DCACC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF6869CFE44,?,?,?,00007FF6869D1356,?,?,?,?,?,00007FF6869D2949), ref: 00007FF6869DCB0A

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c69b2b415516246c39874758743c65376e97b2ba2b88f646b423658d781f7dfd
Instruction ID: 857b5f3d8c902fd6cf67e3c247b7c297b20072a85fee0e46adc12bd882366ae4
Opcode Fuzzy Hash: c69b2b415516246c39874758743c65376e97b2ba2b88f646b423658d781f7dfd
Instruction Fuzzy Hash: ADF05810B092C3C0FE646AB159413752188BF58BF0F080638D82ED76C3EE6EEC80C610

Non-executed Functions

Function 00007FF6869C3DF0 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF6869C30BE), ref: 00007FF6869C3E06
GetProcAddress.KERNEL32(?,?,00000000,00007FF6869C30BE), ref: 00007FF6869C3E45
GetProcAddress.KERNEL32(?,?,00000000,00007FF6869C30BE), ref: 00007FF6869C3E6A
GetProcAddress.KERNEL32(?,?,00000000,00007FF6869C30BE), ref: 00007FF6869C3E8F
GetProcAddress.KERNEL32(?,?,00000000,00007FF6869C30BE), ref: 00007FF6869C3EB7
GetProcAddress.KERNEL32(?,?,00000000,00007FF6869C30BE), ref: 00007FF6869C3EDF
GetProcAddress.KERNEL32(?,?,00000000,00007FF6869C30BE), ref: 00007FF6869C3F07
GetProcAddress.KERNEL32(?,?,00000000,00007FF6869C30BE), ref: 00007FF6869C3F2F
GetProcAddress.KERNEL32(?,?,00000000,00007FF6869C30BE), ref: 00007FF6869C3F57

Strings

PyImport_AddModule, xrefs: 00007FF6869C4225
Failed to get address for Py_DecRef, xrefs: 00007FF6869C3FE9
Failed to get address for Py_IncRef, xrefs: 00007FF6869C4039
PyMem_RawFree, xrefs: 00007FF6869C4595
Failed to get address for Py_SetPath, xrefs: 00007FF6869C4089
PyMarshal_ReadObjectFromString, xrefs: 00007FF6869C451D
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF6869C4219
Py_FileSystemDefaultEncoding, xrefs: 00007FF6869C3E3B
PySys_SetPath, xrefs: 00007FF6869C44CD
Failed to get address for PyImport_AddModule, xrefs: 00007FF6869C4241
Py_DecRef, xrefs: 00007FF6869C3FCD
Py_IgnoreEnvironmentFlag, xrefs: 00007FF6869C3E85
Py_FrozenFlag, xrefs: 00007FF6869C3E60
Failed to get address for PyErr_Restore, xrefs: 00007FF6869C41F1
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF6869C4421
Failed to get address for PyLong_AsLong, xrefs: 00007FF6869C4309
PyUnicode_DecodeFSDefault, xrefs: 00007FF6869C460D
GetProcAddress, xrefs: 00007FF6869C3E1F
Failed to get address for Py_SetProgramName, xrefs: 00007FF6869C40D9
Failed to get address for Py_NoUserSiteDirectory, xrefs: 00007FF6869C3EF1
PyUnicode_FromString, xrefs: 00007FF6869C4545
Py_BuildValue, xrefs: 00007FF6869C3FA5
PyErr_Restore, xrefs: 00007FF6869C41D5
PyUnicode_Join, xrefs: 00007FF6869C465D
PyEval_EvalCode, xrefs: 00007FF6869C44F5
PyLong_AsLong, xrefs: 00007FF6869C42ED
Failed to get address for PyUnicode_Replace, xrefs: 00007FF6869C46A1
PySys_SetArgvEx, xrefs: 00007FF6869C4455
Py_OptimizeFlag, xrefs: 00007FF6869C3EFD
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF6869C4269
PyList_Append, xrefs: 00007FF6869C429D
PySys_AddWarnOption, xrefs: 00007FF6869C442D
Failed to get address for PySys_SetArgvEx, xrefs: 00007FF6869C4471
Failed to get address for Py_BuildValue, xrefs: 00007FF6869C3FC1
Failed to get address for Py_SetPythonHome, xrefs: 00007FF6869C4101
Failed to get address for Py_DontWriteBytecodeFlag, xrefs: 00007FF6869C3E18
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF6869C43D1
Failed to get address for PyErr_Occurred, xrefs: 00007FF6869C4179
Failed to get address for PyUnicode_Join, xrefs: 00007FF6869C4679
Failed to get address for PyObject_CallFunction, xrefs: 00007FF6869C4359
Failed to get address for PyList_Append, xrefs: 00007FF6869C42B9
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF6869C4651
PyErr_Occurred, xrefs: 00007FF6869C415D
Failed to get address for Py_VerboseFlag, xrefs: 00007FF6869C3F41
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF6869C45D9
PyObject_GetAttrString, xrefs: 00007FF6869C43B5
Py_SetProgramName, xrefs: 00007FF6869C40BD
Failed to get address for Py_DecodeLocale, xrefs: 00007FF6869C4589
Py_Finalize, xrefs: 00007FF6869C3FF5
Failed to get address for Py_OptimizeFlag, xrefs: 00007FF6869C3F19
Failed to get address for Py_UnbufferedStdioFlag, xrefs: 00007FF6869C3F69
PySys_GetObject, xrefs: 00007FF6869C447D
Failed to get address for PySys_SetPath, xrefs: 00007FF6869C44E9
PyUnicode_Decode, xrefs: 00007FF6869C45E5
Failed to get address for PyMem_RawFree, xrefs: 00007FF6869C45B1
Failed to get address for PyObject_Str, xrefs: 00007FF6869C43F9
Failed to get address for Py_Initialize, xrefs: 00007FF6869C4061
Failed to get address for PyEval_EvalCode, xrefs: 00007FF6869C4511
Failed to get address for PyErr_Clear, xrefs: 00007FF6869C4151
Failed to get address for PyList_New, xrefs: 00007FF6869C42E1
Failed to get address for PyImport_ImportModule, xrefs: 00007FF6869C4291
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF6869C4539
PyDict_GetItemString, xrefs: 00007FF6869C410D
Py_NoSiteFlag, xrefs: 00007FF6869C3EAD
Failed to get address for Py_GetPath, xrefs: 00007FF6869C40B1
Failed to get address for PyDict_GetItemString, xrefs: 00007FF6869C4129
Failed to get address for Py_FrozenFlag, xrefs: 00007FF6869C3E7C
Failed to get address for PySys_AddWarnOption, xrefs: 00007FF6869C4449
PyUnicode_AsUTF8, xrefs: 00007FF6869C4635
PyObject_CallFunctionObjArgs, xrefs: 00007FF6869C4365
Failed to get address for Py_Finalize, xrefs: 00007FF6869C4011
PyErr_Print, xrefs: 00007FF6869C4185
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF6869C4629
Py_UnbufferedStdioFlag, xrefs: 00007FF6869C3F4D
Failed to get address for PyUnicode_FromString, xrefs: 00007FF6869C4561
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF6869C43A9
Py_VerboseFlag, xrefs: 00007FF6869C3F25
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF6869C4381
PyUnicode_Replace, xrefs: 00007FF6869C4685
PyRun_SimpleStringFlags, xrefs: 00007FF6869C4405
PyUnicode_FromFormat, xrefs: 00007FF6869C45BD
Py_DontWriteBytecodeFlag, xrefs: 00007FF6869C3DFF
Failed to get address for Py_UTF8Mode, xrefs: 00007FF6869C3F99
PyImport_ExecCodeModule, xrefs: 00007FF6869C424D
Failed to get address for PyModule_GetDict, xrefs: 00007FF6869C4331
Py_IncRef, xrefs: 00007FF6869C401D
PyList_New, xrefs: 00007FF6869C42C5
PyErr_NormalizeException, xrefs: 00007FF6869C41FD
Failed to get address for PyUnicode_Decode, xrefs: 00007FF6869C4601
PySys_SetObject, xrefs: 00007FF6869C44A5
Failed to get address for PySys_GetObject, xrefs: 00007FF6869C4499
Failed to get address for PyErr_Fetch, xrefs: 00007FF6869C41C9
PyObject_CallFunction, xrefs: 00007FF6869C433D
Failed to get address for PyErr_Print, xrefs: 00007FF6869C41A1
PyObject_Str, xrefs: 00007FF6869C43DD
Py_NoUserSiteDirectory, xrefs: 00007FF6869C3ED5
Py_GetPath, xrefs: 00007FF6869C4095
Py_UTF8Mode, xrefs: 00007FF6869C3F7D
Failed to get address for Py_FileSystemDefaultEncoding, xrefs: 00007FF6869C3E57
PyModule_GetDict, xrefs: 00007FF6869C4315
PyImport_ImportModule, xrefs: 00007FF6869C4275
Py_SetPath, xrefs: 00007FF6869C406D
Py_DecodeLocale, xrefs: 00007FF6869C456D
PyErr_Fetch, xrefs: 00007FF6869C41AD
Failed to get address for Py_NoSiteFlag, xrefs: 00007FF6869C3EC9
PyObject_SetAttrString, xrefs: 00007FF6869C438D
Failed to get address for PySys_SetObject, xrefs: 00007FF6869C44C1
Py_Initialize, xrefs: 00007FF6869C4045
PyErr_Clear, xrefs: 00007FF6869C4135
Failed to get address for Py_IgnoreEnvironmentFlag, xrefs: 00007FF6869C3EA1
Py_SetPythonHome, xrefs: 00007FF6869C40E5

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
API String ID: 190572456-3109299426
Opcode ID: 67747be8a076f706c1c9372e7d2496993eaa02b7082083ef588a9e8b618be952
Instruction ID: c8d9f9b5edfaa15344947d12d845e44874886091f7758a2788adb69aff7ce728
Opcode Fuzzy Hash: 67747be8a076f706c1c9372e7d2496993eaa02b7082083ef588a9e8b618be952
Instruction Fuzzy Hash: 9E42A164A0DB87D1FE55CB08E95017423A6BF157A5B84503ED80E863EAFFBEAD58D300

Function 00007FF6869C1B90 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF6869C1BDE
MulDiv.KERNEL32 ref: 00007FF6869C1BF2
MulDiv.KERNEL32 ref: 00007FF6869C1C13
SystemParametersInfoW.USER32 ref: 00007FF6869C1C5B
CreateFontIndirectW.GDI32 ref: 00007FF6869C1C6F
#380.COMCTL32 ref: 00007FF6869C1C93
CreateWindowExW.USER32 ref: 00007FF6869C1CE6
CreateWindowExW.USER32 ref: 00007FF6869C1D40
CreateWindowExW.USER32 ref: 00007FF6869C1D9D
CreateWindowExW.USER32 ref: 00007FF6869C1DFF
SendMessageW.USER32 ref: 00007FF6869C1E1F
SendMessageW.USER32 ref: 00007FF6869C1E39
SendMessageW.USER32 ref: 00007FF6869C1E58
SendMessageW.USER32 ref: 00007FF6869C1E77
SendMessageW.USER32 ref: 00007FF6869C1E95
SendMessageW.USER32 ref: 00007FF6869C1EB3
SendMessageW.USER32 ref: 00007FF6869C1ED1
SendMessageW.USER32 ref: 00007FF6869C1EE9
SendMessageW.USER32 ref: 00007FF6869C1F01
GetClientRect.USER32 ref: 00007FF6869C1F10

Part of subcall function 00007FF6869C2030: GetDC.USER32 ref: 00007FF6869C205B
Part of subcall function 00007FF6869C2030: SelectObject.GDI32 ref: 00007FF6869C20A2
Part of subcall function 00007FF6869C2030: DrawTextW.USER32 ref: 00007FF6869C20C5
Part of subcall function 00007FF6869C2030: SelectObject.GDI32 ref: 00007FF6869C20DB
Part of subcall function 00007FF6869C2030: ReleaseDC.USER32 ref: 00007FF6869C20EB
Part of subcall function 00007FF6869C2030: MoveWindow.USER32 ref: 00007FF6869C213B
Part of subcall function 00007FF6869C2030: MoveWindow.USER32 ref: 00007FF6869C217B
Part of subcall function 00007FF6869C2030: MoveWindow.USER32 ref: 00007FF6869C21CE

Strings

BUTTON, xrefs: 00007FF6869C1DB6
EDIT, xrefs: 00007FF6869C1D4B
STATIC, xrefs: 00007FF6869C1C9C, 00007FF6869C1CF1
Close, xrefs: 00007FF6869C1DA8
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF6869C1BBD

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 47b3578659853d453a5822a751c8e2f63cfdf798862dd1eeebf7592aa26dc86d
Instruction ID: 0477b2ba14464ed9a822cbd2da8e6cd8e0b4b4d0c1d87d4f7dff378c594421b7
Opcode Fuzzy Hash: 47b3578659853d453a5822a751c8e2f63cfdf798862dd1eeebf7592aa26dc86d
Instruction Fuzzy Hash: 2EA15B32208B82C7DB148F11E55479AB360FB88BA0F50412ADB8D43B65DFBEE565CB40

Function 00007FF6869E31CC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF6869E321A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E3886
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E39FC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E3CBA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E3EDA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E4117
memcpy_s.LIBCPMT ref: 00007FF6869E41F2
memcpy_s.LIBCPMT ref: 00007FF6869E429D
memcpy_s.LIBCPMT ref: 00007FF6869E436C

Strings

1#INF, xrefs: 00007FF6869E3343
1#IND, xrefs: 00007FF6869E3307
1#QNAN, xrefs: 00007FF6869E3333
1#SNAN, xrefs: 00007FF6869E332A

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 46fb5d0366b8e1e712cdd684d815614daf2c7cda5b16cac76ba58e706ef79b66
Instruction ID: ae24ae5abe43e1dc281be432cd0b5c4c28a20f429c0c771a9e831ee2c44bba08
Opcode Fuzzy Hash: 46fb5d0366b8e1e712cdd684d815614daf2c7cda5b16cac76ba58e706ef79b66
Instruction Fuzzy Hash: 04B28E72A182C3CAEB658E65D4407F937A1FF54788F405139DA0E97AC6DFBAAD01CB40

Function 00007FF6869C74B0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF6869C26A0), ref: 00007FF6869C74D7
FormatMessageW.KERNEL32(00000000,00007FF6869C26A0), ref: 00007FF6869C7506
WideCharToMultiByte.KERNEL32 ref: 00007FF6869C755C

Part of subcall function 00007FF6869C2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6869C7744,?,?,?,?,?,?,?,?,?,?,?,00007FF6869C101D), ref: 00007FF6869C2654
Part of subcall function 00007FF6869C2620: MessageBoxW.USER32 ref: 00007FF6869C272C

Strings

No error messages generated., xrefs: 00007FF6869C7510
Failed to encode wchar_t as UTF-8., xrefs: 00007FF6869C7566
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF6869C7579
PyInstaller: FormatMessageW failed., xrefs: 00007FF6869C7523
WideCharToMultiByte, xrefs: 00007FF6869C756D
FormatMessageW, xrefs: 00007FF6869C7517

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 8b0166d5a5045c769a8e77ad43af0852bc728ff9b5502801be361ecb61f6b2fa
Instruction ID: b033085725c13a7986ea97f6fe2a985c09bd342bac3ea676cab11986621025a0
Opcode Fuzzy Hash: 8b0166d5a5045c769a8e77ad43af0852bc728ff9b5502801be361ecb61f6b2fa
Instruction Fuzzy Hash: 58213031A18AC3C2EF209B11E8413766265BF48394F84003DE69EC66E6EFBEE945C740

Function 00007FF6869CB69C Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6869CB6B8
RtlCaptureContext.KERNEL32 ref: 00007FF6869CB6E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6869CB6FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF6869CB740
IsDebuggerPresent.KERNEL32 ref: 00007FF6869CB794
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6869CB7B5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6869CB7C0

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 24fff5600ca101af0e2334446d678d156eb325a0e0e0c0538aba544f51e330ab
Instruction ID: e6bfce1863a5ba720a7819482a11e462114de780809be9d01ece5cbd1e777c48
Opcode Fuzzy Hash: 24fff5600ca101af0e2334446d678d156eb325a0e0e0c0538aba544f51e330ab
Instruction Fuzzy Hash: 14313C72608AC2C6EF608F60E8803E97361FB84754F444439DA4E87A99DF7DDA48C710

Function 00007FF6869D9AE4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6869D9B5D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6869D9B75
RtlVirtualUnwind.KERNEL32 ref: 00007FF6869D9BB0
IsDebuggerPresent.KERNEL32 ref: 00007FF6869D9BE9
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6869D9BF3
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6869D9BFE

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 4204087c2144b4154cc610f07160e172692864cccd6c23e577d201b1c5d7dbdf
Instruction ID: a1e27d5aacefb87dfccb981d6cb2b78c9e86ffb13a174d6217a010ff4b3b5a92
Opcode Fuzzy Hash: 4204087c2144b4154cc610f07160e172692864cccd6c23e577d201b1c5d7dbdf
Instruction Fuzzy Hash: 4A313E32618B82C6DF609B65E8402AE73A4FF84764F500139EA8D83BA6DF7DD945CB00

Function 00007FF6869E09B4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E0A00
FindFirstFileExW.KERNEL32 ref: 00007FF6869E0B0A

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 1a8060551746b007c23963201f19a9fa9ddec40a19b74045b76b4ab8f762ca91
Instruction ID: 0571d8a96a6ab2270c820fbaabde35dea725f2852ef88dde61022697707ef2cd
Opcode Fuzzy Hash: 1a8060551746b007c23963201f19a9fa9ddec40a19b74045b76b4ab8f762ca91
Instruction Fuzzy Hash: ADB1B022B186D7C1EE619B21A4042B963A0FF44BE4F44417AEA5D97BC6DFBEEC51C700

Function 00007FF6869E2D30 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF6869E2D96
memcpy_s.LIBCPMT ref: 00007FF6869E2DC1

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 51def3e237b6bc4efa00a09e3a6779f09cb407167a6e00ed9f337cb92699c77a
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 17C1BF72A186C6C7EB248F59E04466AB791FB88B84F44813DDB4E87785DE7EEC05CB40

Function 00007FF6869E8B68 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6869E8DB7
RaiseException.KERNEL32 ref: 00007FF6869E8DC8

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 34bf4ba4d1f77b159a602f4f3a79dc58b46c4397abc6f90fe1b78d3c276b8e03
Instruction ID: 0e258823a54e4b170d8886c1f2c258feaf7d0f870368a83c7808a906779d11f7
Opcode Fuzzy Hash: 34bf4ba4d1f77b159a602f4f3a79dc58b46c4397abc6f90fe1b78d3c276b8e03
Instruction Fuzzy Hash: 09B18E77600B8ACBEB15CF29C94636837A0FB44B48F16892ADB5D877A5CF7AD851C700

Function 00007FF6869C7820 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF6869C7851
FindClose.KERNEL32 ref: 00007FF6869C7860

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: b154a429360a9d8fc422caeeb97d2d39407f5ca637504bf6a4efef03296319f0
Instruction ID: ff1baf78c2e9d3ed1140d8bb94a5888a6bc93e9f4343bd8a0ac6e17d61b64168
Opcode Fuzzy Hash: b154a429360a9d8fc422caeeb97d2d39407f5ca637504bf6a4efef03296319f0
Instruction Fuzzy Hash: C5F08122A186C2C6EB60CF60E49476A7390BF44774F040339EA6E466E5DF7CD409CB00

Function 00007FF6869D2C04 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF6869D2FB4
, xrefs: 00007FF6869D2D72

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 2d8c388a4af4e59f7aa018185c24a80b808f927c20487c79df8fa8b9671cd73b
Instruction ID: 5388d19cefbd211cba58ffcf86b209c06c2287623f0fb256c6391b869ee7df99
Opcode Fuzzy Hash: 2d8c388a4af4e59f7aa018185c24a80b808f927c20487c79df8fa8b9671cd73b
Instruction Fuzzy Hash: 09E18136A08687C6EF688E29815117963A0FF45B88F24513ADB4E876D6DF3FEC52C740

Function 00007FF6869DD098 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF6869DD1A5
gfff, xrefs: 00007FF6869DD222

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: e8ad3313ac50deca76865dcff50c63e8317fb702a62c77948e89599ff08dba86
Instruction ID: 85064a8a8e1ebc2e708d5dd106570db43fa241d096c64db156d613108b90515c
Opcode Fuzzy Hash: e8ad3313ac50deca76865dcff50c63e8317fb702a62c77948e89599ff08dba86
Instruction Fuzzy Hash: E9516C62B182C686EB248E35D9417697795FB44B94F489239CB5C87AC6CF3ED845C700

Function 00007FF6869DFA08 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 2f1140fd3f6f5e7d67c42ca6fc456eae8160b6473a59202e1228688bc9ba3277
Instruction ID: 9856b1ad0baaca16deff47967da4220e3dd800f404ec82513d20c5be57fd33de
Opcode Fuzzy Hash: 2f1140fd3f6f5e7d67c42ca6fc456eae8160b6473a59202e1228688bc9ba3277
Instruction Fuzzy Hash: 0F026822A0D6C3C0FE65AB21A5022792694BF45BA4F44463EDD5ECB7D3EE7EAC11C310

Function 00007FF6869DCC04 Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF6869DCF46

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 24567b7b7ad9cc25883cfe86a0af8cdb31fb8148e1153fa934f37376d4be2ae6
Instruction ID: 1b5ba28f2c42ced63bb6dec389e6cb0e5d0102d0be5a80a12ba37801ca32fd34
Opcode Fuzzy Hash: 24567b7b7ad9cc25883cfe86a0af8cdb31fb8148e1153fa934f37376d4be2ae6
Instruction Fuzzy Hash: 12A10162A086C6C6EF21CB29A4107B97B99BF55BC4F048136DA8D877D6DE3EE805C700

Function 00007FF6869D6F98 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF6869D6FB7

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 8bf532746fbfdd3304831ccd4c5a1a1816c9a4087bc6ecff30edaf665492098b
Instruction ID: d4b2c072dd6fa491ac67281212b9e08aed54a772ce5aa6c89bef0cada974f634
Opcode Fuzzy Hash: 8bf532746fbfdd3304831ccd4c5a1a1816c9a4087bc6ecff30edaf665492098b
Instruction Fuzzy Hash: 58516711B08683C1FE68AA2699115BA6290BF94BC4F48453DDF0DDB7D3EE7FE852C240

Function 00007FF6869E25A0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6869E25A4

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 6aaf01db4fcd6d8e5e92a2165bcca8bef3bc9097c29bcaeff3790f5a52787e5b
Instruction ID: 8280a2b3ed09bfa236844de758bd1b153834bbb1c8ff34c99f40bb5cf22aefce
Opcode Fuzzy Hash: 6aaf01db4fcd6d8e5e92a2165bcca8bef3bc9097c29bcaeff3790f5a52787e5b
Instruction Fuzzy Hash: 8AB09260E07A42D2EE082B616C8221423A47F48720F98007CC00C80320DF2D28AA9701

Function 00007FF6869D2800 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720b0f885fc535c3a242e303a59ba9c626026de2633fd245c18c7096fc28f432
Instruction ID: 462c3184ff873a285234c8f74c2971a516062005c7e54d320ae1832a6c2eba69
Opcode Fuzzy Hash: 720b0f885fc535c3a242e303a59ba9c626026de2633fd245c18c7096fc28f432
Instruction Fuzzy Hash: 32D17C26A08687C6EF688E29865227D27A0FF45B58F14523DCF4E876D6DF2EEC45C340

Function 00007FF6869C80A0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25b4879d951165098d7d9ad8dfdbe188c5f26750c92d05a39af3c572e9b4c9ce
Instruction ID: 2a808caec630687c102f8a9a22a16678ca6fd61c10224e6546b95693ce4d0234
Opcode Fuzzy Hash: 25b4879d951165098d7d9ad8dfdbe188c5f26750c92d05a39af3c572e9b4c9ce
Instruction Fuzzy Hash: 5EC1C4722141E18BE2C9EB29E56947E7791F78930DB85403BEB8747BCACB3CA814D750

Function 00007FF6869D1E70 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3511ad376341763adbf03eaa1481790c1cd7a3e825f7d6c297581565e8b6740f
Instruction ID: cc08abdc5fb66eed3c18aec25ff4cd042923fe95cbb4d31be0773ff1ccf379b1
Opcode Fuzzy Hash: 3511ad376341763adbf03eaa1481790c1cd7a3e825f7d6c297581565e8b6740f
Instruction Fuzzy Hash: 8AB12976A08686C5EB658F29C45127C3BA0FB4AB48F244239CB4E87396DF3FD842D750

Function 00007FF6869DD718 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b482d32cf4439f597672c93949c919f143e2d798b80af63496daf47fa9f459cc
Instruction ID: 8f4740da0b4d63bb3f40fce93c20d0516d0c34f49e2b64a3e7b1a1f8fdcb10ad
Opcode Fuzzy Hash: b482d32cf4439f597672c93949c919f143e2d798b80af63496daf47fa9f459cc
Instruction Fuzzy Hash: 3C81B272A087C2C6EF64CB2994403696AA4FF45794F145239DA9D87BDADF3EE844CB00

Function 00007FF6869E5820 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 43964b9baea6600a933ee8e1a049a499104490ec7162e6d0a4f8078b6de4c171
Instruction ID: 0b122e0712f761bf78d611e923e51a3dbc87edb5fe2cc0c3e60fb32da71e38b6
Opcode Fuzzy Hash: 43964b9baea6600a933ee8e1a049a499104490ec7162e6d0a4f8078b6de4c171
Instruction Fuzzy Hash: E56191A2E182D3C6FF669A2894903796691BF40770F54423DDA5EC66D7EEAFEC40C700

Function 00007FF6869D0FB4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d861661aa08db629cc23cdca8c369b076586a2e450c00db1ba5d57a294e44a4f
Instruction ID: d6a01aeafa71f16d794bebcddb8b090bdbd9dfa9629bf555e8c41514c6868d92
Opcode Fuzzy Hash: d861661aa08db629cc23cdca8c369b076586a2e450c00db1ba5d57a294e44a4f
Instruction Fuzzy Hash: AC515177A186D2C6EB248B29D04022827A0FF55BA8F244139CA4D977E6DF7BEC53C740

Function 00007FF6869D13C4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 867914ff4df0b6b44d704adc42bbe88cde9096fdc707783f05752eff833c7ffe
Instruction ID: 98815c3a7f7c38495de8fe8770828f3f0f14ae42437c98f4fffa728f8c0645a1
Opcode Fuzzy Hash: 867914ff4df0b6b44d704adc42bbe88cde9096fdc707783f05752eff833c7ffe
Instruction Fuzzy Hash: 30514E77A18692C6EB248B29D04022837A1FF55B6CF244139CA4D977D6EF3BEC82C740

Function 00007FF6869D0BA4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c32b4ddfd43473a216dec7aa9a0be5b617892f75f4149cffacdc7470c95e978f
Instruction ID: 4a03d13888bc7415af52e1aac856095bc6ed61b23ebaa82752226b81681e7597
Opcode Fuzzy Hash: c32b4ddfd43473a216dec7aa9a0be5b617892f75f4149cffacdc7470c95e978f
Instruction Fuzzy Hash: 33516C76A18692C6EF248F29D04022837A0FF44B68F24517ACA8D877D6CF3BEC52C750

Function 00007FF6869D0DB0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1de1d42fcd570761cca71ddda72003ed022ec41b6526507f8e47f89f031e3167
Instruction ID: 5db2fc562d8cdde6dded8f3d9cec446e5f94830979756e265e9705b9dd56a554
Opcode Fuzzy Hash: 1de1d42fcd570761cca71ddda72003ed022ec41b6526507f8e47f89f031e3167
Instruction Fuzzy Hash: F8515936A18692C6EB648F29D04023C27A1FF48B58F245179CA4D977EACF3BEC52D740

Function 00007FF6869D11C0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b4a4146db3bd1fe649265067838c8b0d7c1a5e97031d62dd0eb31e0fdd0228e
Instruction ID: 76de2a8bee4db954ee67ce74be2c45fc0e8190533c5703ecc5527d9a79912d8f
Opcode Fuzzy Hash: 6b4a4146db3bd1fe649265067838c8b0d7c1a5e97031d62dd0eb31e0fdd0228e
Instruction Fuzzy Hash: 74516C37A18692C6EB248B29C04022867A1FF45B68F644139CE4D977DAEF3BEC53C740

Function 00007FF6869D09A0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 876697f8e8f5cbbdb44752562e3cb115d809b93d1bac5633a342ac63b65505f1
Instruction ID: 9b6d7f5e12f18601229709c81f89281e41a20ea252c70e1a6162e42c8efc48f7
Opcode Fuzzy Hash: 876697f8e8f5cbbdb44752562e3cb115d809b93d1bac5633a342ac63b65505f1
Instruction Fuzzy Hash: 3F515E36A18A96C6EF648F29C04422927A1FF44B68F284179CA4D977D6DF3BEC52C740

Function 00007FF6869D4F50 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: d591e84ffc370335a5d65e1e5927622a38b06be2881b84dfe953116f00f95b8e
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 7B41855280A6CBC5FD96891C8500AB42680BF22BE5E6852BCDD9ED37D7CD1F6D86C341

Function 00007FF6869D8BA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: d52a693ca64156346f3ce50e8e1564a69fccf06189b002bdd4e7495fde204544
Instruction ID: 85f3a4686d497f9acb5b9042ef4d2f3bbc603f5ae5447da9b2f2a7135d955430
Opcode Fuzzy Hash: d52a693ca64156346f3ce50e8e1564a69fccf06189b002bdd4e7495fde204544
Instruction Fuzzy Hash: D6412562B14A96C2EF04CF2AD91456973A1BB48FD0B49903BEE0DD7B95DE7DC846C300

Function 00007FF6869D6560 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 709f6445809074b3fd878d66f1ae61fc27f70d00436a2f6cfa1359df9a62e73e
Instruction ID: 1576bf8b49f629c40d7b98eb3bc3f9242d961a64cfc8f9759557fbfa894440ed
Opcode Fuzzy Hash: 709f6445809074b3fd878d66f1ae61fc27f70d00436a2f6cfa1359df9a62e73e
Instruction Fuzzy Hash: 5D318F32608B83C2EB649F25A44152E76D5BF85BA0F54423CEA8D93BDBDF3DD812C604

Function 00007FF6869E89B0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b98f8205f4dd5ad0f3b4c63852b6076f32f3a1b530b1ff8e23dc59df104b107b
Instruction ID: fb7a583d67ce6549c435cb043d7759aa72655723cfd9af57f4caa8e4ac377f3a
Opcode Fuzzy Hash: b98f8205f4dd5ad0f3b4c63852b6076f32f3a1b530b1ff8e23dc59df104b107b
Instruction Fuzzy Hash: 89F06872718296CADB989F69A80262977D0FB083C4F80A03DD58DC3B04DF3D9451DF05

Function 00007FF6869CB880 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ec394501486fefa8e68c4fc5f22486c81951ca79d36a27091b1f9b4683aa64
Instruction ID: 8d8bc187319dff08ac8fb5f151abb026342f1bde308f0561d59e8bd7ec2d4fde
Opcode Fuzzy Hash: 03ec394501486fefa8e68c4fc5f22486c81951ca79d36a27091b1f9b4683aa64
Instruction Fuzzy Hash: EDA0012190C887D0EE449B40A8505302265BF90311B400039D50E810E6DE6EA940D300

Function 00007FF6869C55D0 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6869C71B0: LoadLibraryExW.KERNEL32(?,?,00000000,00007FF6869C30BE), ref: 00007FF6869C71D3

GetProcAddress.KERNEL32 ref: 00007FF6869C5F67
GetProcAddress.KERNEL32 ref: 00007FF6869C5FA6
GetProcAddress.KERNEL32 ref: 00007FF6869C5FCB
GetProcAddress.KERNEL32 ref: 00007FF6869C5FF0
GetProcAddress.KERNEL32 ref: 00007FF6869C6018
GetProcAddress.KERNEL32 ref: 00007FF6869C6040
GetProcAddress.KERNEL32 ref: 00007FF6869C6068
GetProcAddress.KERNEL32 ref: 00007FF6869C6090
GetProcAddress.KERNEL32 ref: 00007FF6869C60B8

Strings

Failed to get address for Tcl_GetObjResult, xrefs: 00007FF6869C6322
Tcl_Free, xrefs: 00007FF6869C63CE
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF6869C639A
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF6869C643A
Tcl_DeleteInterp, xrefs: 00007FF6869C605E
Failed to get address for Tcl_Init, xrefs: 00007FF6869C5F79
Tcl_Finalize, xrefs: 00007FF6869C600E
Tcl_ConditionWait, xrefs: 00007FF6869C6176
Tcl_Alloc, xrefs: 00007FF6869C63A6
Tcl_FindExecutable, xrefs: 00007FF6869C5FC1
Tcl_ThreadAlert, xrefs: 00007FF6869C61C6
Failed to get address for Tcl_MutexLock, xrefs: 00007FF6869C60F2
Failed to get address for Tcl_CreateThread, xrefs: 00007FF6869C60A2
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF6869C625A
GetProcAddress, xrefs: 00007FF6869C5F80
Failed to get address for Tcl_Free, xrefs: 00007FF6869C63EA
Failed to get address for Tcl_Alloc, xrefs: 00007FF6869C63C2
Failed to get address for Tcl_GetString, xrefs: 00007FF6869C6282
Tcl_GetObjResult, xrefs: 00007FF6869C6306
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF6869C616A
Tk_GetNumMainWindows, xrefs: 00007FF6869C641E
Tcl_GetVar2, xrefs: 00007FF6869C61EE
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF6869C62AA
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF6869C6142
Failed to get address for Tcl_SetVar2, xrefs: 00007FF6869C6232
Tcl_NewByteArrayObj, xrefs: 00007FF6869C62B6
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF6869C60CA
Failed to get address for Tk_Init, xrefs: 00007FF6869C6412
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF6869C5FDD
Tcl_ConditionNotify, xrefs: 00007FF6869C614E
Tcl_DoOneEvent, xrefs: 00007FF6869C5FE6
Tcl_MutexLock, xrefs: 00007FF6869C60D6
Tcl_SetVar2, xrefs: 00007FF6869C6216
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF6869C6002
Failed to get address for Tcl_EvalFile, xrefs: 00007FF6869C634A
Tcl_GetCurrentThread, xrefs: 00007FF6869C60AE
LOADER: Failed to load tcl/tk libraries, xrefs: 00007FF6869C561A
Tcl_CreateInterp, xrefs: 00007FF6869C5F9C
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF6869C6192
Tcl_ConditionFinalize, xrefs: 00007FF6869C6126
Tcl_GetString, xrefs: 00007FF6869C6266
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF6869C61BA
Tcl_MutexUnlock, xrefs: 00007FF6869C60FE
Tcl_CreateObjCommand, xrefs: 00007FF6869C623E
Failed to get address for Tcl_GetVar2, xrefs: 00007FF6869C620A
Tcl_SetVar2Ex, xrefs: 00007FF6869C62DE
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF6869C611A
Tk_Init, xrefs: 00007FF6869C63F6
Failed to get address for Tcl_EvalEx, xrefs: 00007FF6869C6372
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF6869C62D2
Tcl_EvalEx, xrefs: 00007FF6869C6356
Tcl_Init, xrefs: 00007FF6869C5F60
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF6869C62FA
Tcl_EvalObjv, xrefs: 00007FF6869C637E
Tcl_CreateThread, xrefs: 00007FF6869C6086
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF6869C607A
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF6869C5FB8
Tcl_EvalFile, xrefs: 00007FF6869C632E
Tcl_NewStringObj, xrefs: 00007FF6869C628E
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF6869C6052
Tcl_FinalizeThread, xrefs: 00007FF6869C6036
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF6869C61E2
Failed to get address for Tcl_Finalize, xrefs: 00007FF6869C602A
Tcl_ThreadQueueEvent, xrefs: 00007FF6869C619E

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 2238633743-1453502826
Opcode ID: ba523ba2b13c4ea14ee618d69630f35f7ff64aa3d65f3ca8e14aa07d75cb9247
Instruction ID: a2811b3cd48626fc7b102f29f6d7b8bb0c45153efacc1a6ff7f91671dfc5caf5
Opcode Fuzzy Hash: ba523ba2b13c4ea14ee618d69630f35f7ff64aa3d65f3ca8e14aa07d75cb9247
Instruction Fuzzy Hash: 72E1F760A0DB83D5FE59CB08A95027423A9BF15791B84503DC85EC63EAEFBEBD58D301

Function 00007FF6869C2030 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6869C205B
SelectObject.GDI32 ref: 00007FF6869C20A2
DrawTextW.USER32 ref: 00007FF6869C20C5
SelectObject.GDI32 ref: 00007FF6869C20DB
ReleaseDC.USER32 ref: 00007FF6869C20EB
MoveWindow.USER32 ref: 00007FF6869C213B
MoveWindow.USER32 ref: 00007FF6869C217B
MoveWindow.USER32 ref: 00007FF6869C21CE
MoveWindow.USER32 ref: 00007FF6869C2216

Strings

P%, xrefs: 00007FF6869C20AF

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
Instruction ID: 10a2cfe017bc9901790bd3251bd4720250bdaebab6c13eb73d989123c7bdfc82
Opcode Fuzzy Hash: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
Instruction Fuzzy Hash: 90512626608BE2C6DA349F26E0181BAB7A1FB98B61F004125EFCF83695DF7DD445DB10

Function 00007FF6869D0228 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D0268
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D0630
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D08CF

Strings

f, xrefs: 00007FF6869D0300
f, xrefs: 00007FF6869D04B5
f, xrefs: 00007FF6869D036A
p, xrefs: 00007FF6869D030D
p, xrefs: 00007FF6869D0372

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction ID: 2eb7f65ec5b1043f3e062cde9a2dc9a687b26e1f4d8482bebcea5b9c5b4a7a12
Opcode Fuzzy Hash: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction Fuzzy Hash: ED128C62E0C1C3C6FF209E15A0546BA76A1FF90754F884179E68987AC6DF7EEC80CB54

Function 00007FF6869C12B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF6869C12E2
fread, xrefs: 00007FF6869C13E9
malloc, xrefs: 00007FF6869C1353
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6869C1312
fseek, xrefs: 00007FF6869C1319
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6869C13E2
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6869C134C

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 026f885360816c96bdd77ba67c1eb1664edbcbfa270e969d54b231075d802d52
Instruction ID: 9fa2b0cfd654436aeca4cb589196669ed3e15a82a63e47ed4d4c030ee9d81fac
Opcode Fuzzy Hash: 026f885360816c96bdd77ba67c1eb1664edbcbfa270e969d54b231075d802d52
Instruction Fuzzy Hash: DA415E21A086C3C2EE24DB15E4512BA63A0FF44B94F44443ADE4E87BD7EE7EE942C704

Function 00007FF6869CDC30 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6869CDC8D

Part of subcall function 00007FF6869CEBA0: __GetUnwindTryBlock.LIBCMT ref: 00007FF6869CEBE3
Part of subcall function 00007FF6869CEBA0: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6869CEC08

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6869CDD65
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6869CDFBA
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6869CE0C6

Strings

csm, xrefs: 00007FF6869CDCA7
csm, xrefs: 00007FF6869CDD88
csm, xrefs: 00007FF6869CDD0E

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 64a04dea20eab758f09741b49381e36ae6aa3d4dbdf263ead872da10faeebcc4
Instruction ID: ea632bb401eb1443126ce2c3b0a2881f2bef4ac76ed3a491a3bb03b45bd34a6b
Opcode Fuzzy Hash: 64a04dea20eab758f09741b49381e36ae6aa3d4dbdf263ead872da10faeebcc4
Instruction Fuzzy Hash: 37E16072A08786CAEF209F65A4402AD77A4FF45798F100139EE4E97B96CF39E895C740

Function 00007FF6869C7600 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6869C101D), ref: 00007FF6869C769F
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6869C101D), ref: 00007FF6869C76EF

Strings

Failed to encode wchar_t as UTF-8., xrefs: 00007FF6869C7718
Failed to get UTF-8 buffer size., xrefs: 00007FF6869C7731
WideCharToMultiByte, xrefs: 00007FF6869C7738
win32_utils_to_utf8, xrefs: 00007FF6869C7728
Out of memory., xrefs: 00007FF6869C7721

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: d9d72b3d70819d691a45a5c69d72243a1061b564855b32675f65c1480a0ef4ee
Instruction ID: b7ba52b738895a4525354db50a6cb80c1245ccdb882ed0a2bbf737f81afecc0c
Opcode Fuzzy Hash: d9d72b3d70819d691a45a5c69d72243a1061b564855b32675f65c1480a0ef4ee
Instruction Fuzzy Hash: A3416B32A08BC3C6EA20CF15B44026AA7A5FF84B90F584139DA9E87BD6DF7DD851D700

Function 00007FF6869C7B40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF6869C3699), ref: 00007FF6869C7B81

Part of subcall function 00007FF6869C2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6869C7744,?,?,?,?,?,?,?,?,?,?,?,00007FF6869C101D), ref: 00007FF6869C2654
Part of subcall function 00007FF6869C2620: MessageBoxW.USER32 ref: 00007FF6869C272C

WideCharToMultiByte.KERNEL32(?,00007FF6869C3699), ref: 00007FF6869C7BF5

Strings

Failed to encode wchar_t as UTF-8., xrefs: 00007FF6869C7BFF
Failed to get UTF-8 buffer size., xrefs: 00007FF6869C7B8E
WideCharToMultiByte, xrefs: 00007FF6869C7B95, 00007FF6869C7C06
win32_utils_to_utf8, xrefs: 00007FF6869C7BC2
Out of memory., xrefs: 00007FF6869C7BBB

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: aced5f46d53ba3e30c592e5434d0d7ab1f54160dd14b943fd141642a19c75b6b
Instruction ID: 0e6415bdf981e6651d9d08d5523d0540f31ba27183a7b3bfc18f44f97b668878
Opcode Fuzzy Hash: aced5f46d53ba3e30c592e5434d0d7ab1f54160dd14b943fd141642a19c75b6b
Instruction Fuzzy Hash: CE218B21A08B83C5EE109F22A8411797661BF84B90F48453EDA9E877D6EFBEED41C300

Function 00007FF6869D9264 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D92A7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D9694
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D9930

Strings

p, xrefs: 00007FF6869D93D1
p, xrefs: 00007FF6869D9359
f, xrefs: 00007FF6869D93C9

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction ID: a96dcb0d4494875c93fdbcf7cd4024e1224f9d98fd82ceae0567bdbadeedb9d8
Opcode Fuzzy Hash: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction Fuzzy Hash: 3B126B62E0C183C6FF24BA55E0542B97691FF80B54F944039E69A876CADF3EED80CB50

Function 00007FF6869C7C30 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7CC5
MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7D07

Strings

Failed to decode wchar_t from UTF-8, xrefs: 00007FF6869C7D2D
Failed to get wchar_t buffer size., xrefs: 00007FF6869C7D46
MultiByteToWideChar, xrefs: 00007FF6869C7D4D
win32_utils_from_utf8, xrefs: 00007FF6869C7D3D
Out of memory., xrefs: 00007FF6869C7D36

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 626452242-876015163
Opcode ID: 75ada23d093b76e5b35e8a216d6a7c66ee7d2317080e6440cd66e03fb4978861
Instruction ID: 44916e53939b998e8b0cba986ac7e26fc6889c3c25040a2eb5644fbf58a520fb
Opcode Fuzzy Hash: 75ada23d093b76e5b35e8a216d6a7c66ee7d2317080e6440cd66e03fb4978861
Instruction Fuzzy Hash: BA414D32A08A83C2EA50DF15A44017966A5FF44B90F54513ADB9E8BBE6EF3DD852C700

Function 00007FF6869CCEE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6869CD19A,?,?,?,00007FF6869CCE8C,?,?,00000001,00007FF6869CCAA9), ref: 00007FF6869CCF6D
GetLastError.KERNEL32(?,?,?,00007FF6869CD19A,?,?,?,00007FF6869CCE8C,?,?,00000001,00007FF6869CCAA9), ref: 00007FF6869CCF7B
LoadLibraryExW.KERNEL32(?,?,?,00007FF6869CD19A,?,?,?,00007FF6869CCE8C,?,?,00000001,00007FF6869CCAA9), ref: 00007FF6869CCFA5
FreeLibrary.KERNEL32(?,?,?,00007FF6869CD19A,?,?,?,00007FF6869CCE8C,?,?,00000001,00007FF6869CCAA9), ref: 00007FF6869CCFEB
GetProcAddress.KERNEL32(?,?,?,00007FF6869CD19A,?,?,?,00007FF6869CCE8C,?,?,00000001,00007FF6869CCAA9), ref: 00007FF6869CCFF7

Strings

api-ms-, xrefs: 00007FF6869CCF8D

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 46f8882ba5516ded8d0f67aa9085a497a0d646e74245b223b6bb25c85e55adca
Instruction ID: bbb9c3032bee128a5ba59f16534db5e3efb5c7a8733a0c745b01688d9e528c9a
Opcode Fuzzy Hash: 46f8882ba5516ded8d0f67aa9085a497a0d646e74245b223b6bb25c85e55adca
Instruction Fuzzy Hash: CD31E221A0AA83D5FE61DB06A40067427D4FF08BA4F49453DED1E8A3D2DF3EE845D700

Function 00007FF6869C6480 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6869C7A30: MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7A6A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF6869C67CF,?,00000000,?,TokenIntegrityLevel), ref: 00007FF6869C64DF

Part of subcall function 00007FF6869C2770: MessageBoxW.USER32 ref: 00007FF6869C2841

Strings

LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6869C653A
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6869C64F3
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6869C64B6

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: e770f63f1b65fbf44ebddb50d5af86b3d9fe6b483d73fb8ce13bd60b0e8df226
Instruction ID: 211546259d5930b174fa4072088a24e1c9dad8520c3b73b1a569c00bdd5ffada
Opcode Fuzzy Hash: e770f63f1b65fbf44ebddb50d5af86b3d9fe6b483d73fb8ce13bd60b0e8df226
Instruction Fuzzy Hash: 3C316021B1C7C3C1FE21AB21A5553BA5291BF98780F84443ADA4FC66DBEE2EED04C700

Function 00007FF6869C7A30 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7A6A

Part of subcall function 00007FF6869C2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6869C7744,?,?,?,?,?,?,?,?,?,?,?,00007FF6869C101D), ref: 00007FF6869C2654
Part of subcall function 00007FF6869C2620: MessageBoxW.USER32 ref: 00007FF6869C272C

MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7AF0

Strings

Failed to decode wchar_t from UTF-8, xrefs: 00007FF6869C7AFA
Failed to get wchar_t buffer size., xrefs: 00007FF6869C7A77
MultiByteToWideChar, xrefs: 00007FF6869C7A7E, 00007FF6869C7B01
win32_utils_from_utf8, xrefs: 00007FF6869C7AB9
Out of memory., xrefs: 00007FF6869C7AB2

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: a067ef3949ab1c43b8cad70a8c207a907739284b21da8d2c9820fdf83144c31f
Instruction ID: bdfdb10566961ccc46bb778b9362552f6f61e686f08c5cf040d876fdf01faed9
Opcode Fuzzy Hash: a067ef3949ab1c43b8cad70a8c207a907739284b21da8d2c9820fdf83144c31f
Instruction Fuzzy Hash: 0D214122B08A83C1EF50CB29F401169A361FF98794F584539DB5DD7BAAEE6DD941C700

Function 00007FF6869DA620 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F,?,?,?,00007FF6869D9313), ref: 00007FF6869DA62F
FlsGetValue.KERNEL32(?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F,?,?,?,00007FF6869D9313), ref: 00007FF6869DA644
FlsSetValue.KERNEL32(?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F,?,?,?,00007FF6869D9313), ref: 00007FF6869DA665
FlsSetValue.KERNEL32(?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F,?,?,?,00007FF6869D9313), ref: 00007FF6869DA692
FlsSetValue.KERNEL32(?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F,?,?,?,00007FF6869D9313), ref: 00007FF6869DA6A3
FlsSetValue.KERNEL32(?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F,?,?,?,00007FF6869D9313), ref: 00007FF6869DA6B4
SetLastError.KERNEL32(?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F,?,?,?,00007FF6869D9313), ref: 00007FF6869DA6CF

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: e4690b43786acef7750caa62a4944ce50e7135dc012d72f0de57dd7c45479f7b
Instruction ID: ece477d59959cdede41b8ff40de3083e6623be3e49112ee5f8df792e2b848621
Opcode Fuzzy Hash: e4690b43786acef7750caa62a4944ce50e7135dc012d72f0de57dd7c45479f7b
Instruction Fuzzy Hash: 6F213820B0C2C3C6FE58A729A65513D62427F44BB4F54063CE83E87ADBDE6EAC21C700

Function 00007FF6869E706C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6869E709D
GetLastError.KERNEL32 ref: 00007FF6869E70A9
CloseHandle.KERNEL32 ref: 00007FF6869E70C1
CreateFileW.KERNEL32 ref: 00007FF6869E70EC
WriteConsoleW.KERNEL32 ref: 00007FF6869E710B

Strings

CONOUT$, xrefs: 00007FF6869E70CD

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 1a41989b306c04176fbb8ce5d038fb17b2eb18ca34d01c5ff4cda60dd112554e
Instruction ID: 4cfeb9e46bd16a98249ccfbb4e13b428a17b834ced2703a599a15c012f6961ba
Opcode Fuzzy Hash: 1a41989b306c04176fbb8ce5d038fb17b2eb18ca34d01c5ff4cda60dd112554e
Instruction Fuzzy Hash: CE115121A18A82C6EB508B56E85432972A4FF88BE5F454238EA5DC77E5CFBDDD04C740

Function 00007FF6869DA798 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6869D444D,?,?,?,?,00007FF6869DDDA7,?,?,00000000,00007FF6869DA8B6,?,?,?), ref: 00007FF6869DA7A7
FlsSetValue.KERNEL32(?,?,?,00007FF6869D444D,?,?,?,?,00007FF6869DDDA7,?,?,00000000,00007FF6869DA8B6,?,?,?), ref: 00007FF6869DA7DD
FlsSetValue.KERNEL32(?,?,?,00007FF6869D444D,?,?,?,?,00007FF6869DDDA7,?,?,00000000,00007FF6869DA8B6,?,?,?), ref: 00007FF6869DA80A
FlsSetValue.KERNEL32(?,?,?,00007FF6869D444D,?,?,?,?,00007FF6869DDDA7,?,?,00000000,00007FF6869DA8B6,?,?,?), ref: 00007FF6869DA81B
FlsSetValue.KERNEL32(?,?,?,00007FF6869D444D,?,?,?,?,00007FF6869DDDA7,?,?,00000000,00007FF6869DA8B6,?,?,?), ref: 00007FF6869DA82C
SetLastError.KERNEL32(?,?,?,00007FF6869D444D,?,?,?,?,00007FF6869DDDA7,?,?,00000000,00007FF6869DA8B6,?,?,?), ref: 00007FF6869DA847

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: b80b9a6360fdb838ee2f6689ae67004e58d61d8a43e34886883bb0108a8494f3
Instruction ID: 4b4bb2676ddba638a4b37d52e88cdb0656d3cd592af1f9b3a22d44298cfe5015
Opcode Fuzzy Hash: b80b9a6360fdb838ee2f6689ae67004e58d61d8a43e34886883bb0108a8494f3
Instruction Fuzzy Hash: 41113B30F0C2C3C6FE586725AA4117961527F44BB0F04463CE82E876DBDE6EAC22C710

Function 00007FF6869CC8A8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6869CC8D3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6869CC968
RtlUnwindEx.KERNEL32 ref: 00007FF6869CC9B7

Strings

csm, xrefs: 00007FF6869CC94E
f, xrefs: 00007FF6869CC8E6

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 42fbbb83cedbe148bfcc1de87ea3e914151e174f0a46670c6939306692d2d31c
Instruction ID: c90eca7a9b005616e058376d9a00c63bd52cdf54d878512b52edc02a1a9f5295
Opcode Fuzzy Hash: 42fbbb83cedbe148bfcc1de87ea3e914151e174f0a46670c6939306692d2d31c
Instruction Fuzzy Hash: 8F515D32A19683C6EF14CB15E404B292B95FF84B98F558138DA4B877CADE7AED41C704

Function 00007FF6869C2240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF6869C242F), ref: 00007FF6869C2278
DialogBoxIndirectParamW.USER32 ref: 00007FF6869C233C
DeleteObject.GDI32 ref: 00007FF6869C236F
DestroyIcon.USER32 ref: 00007FF6869C2381

Strings

Unhandled exception in script, xrefs: 00007FF6869C22A8

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 6bea62eccc28d19483c18ff1a3e2d52c6af3fb64e3e46481c97fdf2a226d8d74
Instruction ID: 45f8982eae29a4ee10a04d3992fc7989e800afaf002ebdc46c46ec770681cefc
Opcode Fuzzy Hash: 6bea62eccc28d19483c18ff1a3e2d52c6af3fb64e3e46481c97fdf2a226d8d74
Instruction Fuzzy Hash: 5D314032A096C3C9EF24DF61E8552E96360FF88B94F440139EA4E8BA96DF7DD945C700

Function 00007FF6869C2620 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6869C7744,?,?,?,?,?,?,?,?,?,?,?,00007FF6869C101D), ref: 00007FF6869C2654

Part of subcall function 00007FF6869C74B0: GetLastError.KERNEL32(00000000,00007FF6869C26A0), ref: 00007FF6869C74D7
Part of subcall function 00007FF6869C74B0: FormatMessageW.KERNEL32(00000000,00007FF6869C26A0), ref: 00007FF6869C7506

Part of subcall function 00007FF6869C7A30: MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7A6A

MessageBoxW.USER32 ref: 00007FF6869C272C
MessageBoxA.USER32 ref: 00007FF6869C2748

Strings

%s%s: %s, xrefs: 00007FF6869C26AD
Fatal error detected, xrefs: 00007FF6869C2700, 00007FF6869C273A

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: bd2085b38ade222d48c53e4b242a54a19eedc60d0d0276a39b8304b5fd6b5430
Instruction ID: a795bd3ae84f8295e75a048542b5d8d81aebf6f9b372a5db8fab28017994bc99
Opcode Fuzzy Hash: bd2085b38ade222d48c53e4b242a54a19eedc60d0d0276a39b8304b5fd6b5430
Instruction Fuzzy Hash: 91314372628AC3D1EB209B11E4517EA6364FF84794F40403AE68E876DADF7DDB05CB40

Function 00007FF6869D88E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6869D8905
GetProcAddress.KERNEL32 ref: 00007FF6869D891B
FreeLibrary.KERNEL32 ref: 00007FF6869D8942

Strings

mscoree.dll, xrefs: 00007FF6869D88FC
CorExitProcess, xrefs: 00007FF6869D8914

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 611779d08fafb8db9f6fab045cd04065641a8af0ffd245d6ff06f44facfa83ea
Instruction ID: 9632cce19e2929d99617a2dc5a42b04faf92f32887ac1b3eac2aacaf03a4b974
Opcode Fuzzy Hash: 611779d08fafb8db9f6fab045cd04065641a8af0ffd245d6ff06f44facfa83ea
Instruction Fuzzy Hash: 24F0C271A19A83C1EF108B64E4443391320BF857B1F45023DD5AD8A2F6DF6ED848C340

Function 00007FF6869E87A4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6869E87CC
_set_statfp.LIBCMT ref: 00007FF6869E87E7
_set_statfp.LIBCMT ref: 00007FF6869E8803
_set_statfp.LIBCMT ref: 00007FF6869E883F

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction ID: 98c1f238f0251762a9ed4d43b6dfb64728edccf0f167f4d9a9ebc168e7bb5ba5
Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction Fuzzy Hash: EE11C122E2CA87C1FE9521E4E65137514417F583B4F86063CED7E8E6D7CEAEAC41C140

Function 00007FF6869DA860 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6869D9A73,?,?,00000000,00007FF6869D9D0E,?,?,?,?,?,00007FF6869D21EC), ref: 00007FF6869DA87F
FlsSetValue.KERNEL32(?,?,?,00007FF6869D9A73,?,?,00000000,00007FF6869D9D0E,?,?,?,?,?,00007FF6869D21EC), ref: 00007FF6869DA89E
FlsSetValue.KERNEL32(?,?,?,00007FF6869D9A73,?,?,00000000,00007FF6869D9D0E,?,?,?,?,?,00007FF6869D21EC), ref: 00007FF6869DA8C6
FlsSetValue.KERNEL32(?,?,?,00007FF6869D9A73,?,?,00000000,00007FF6869D9D0E,?,?,?,?,?,00007FF6869D21EC), ref: 00007FF6869DA8D7
FlsSetValue.KERNEL32(?,?,?,00007FF6869D9A73,?,?,00000000,00007FF6869D9D0E,?,?,?,?,?,00007FF6869D21EC), ref: 00007FF6869DA8E8

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 7f030ec9ba2ccb2e9b5360193d37b1ac766c0381a595b89cd51a21b8ccd138ec
Instruction ID: 97a706f6f50e4edfd3735707793969674984d4f56940fa6fb7249e3a5a1f9330
Opcode Fuzzy Hash: 7f030ec9ba2ccb2e9b5360193d37b1ac766c0381a595b89cd51a21b8ccd138ec
Instruction Fuzzy Hash: B0112930F0C2C385FE58A726AA4117A62457F447B0E04463CE93E866D7DE2EAC62C711

Function 00007FF6869DA6F4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F), ref: 00007FF6869DA705
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F), ref: 00007FF6869DA724
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F), ref: 00007FF6869DA74C
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F), ref: 00007FF6869DA75D
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F), ref: 00007FF6869DA76E

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 80e08a14f964f1394f595af2946dfd7764109c44ee838682c6d48f6542b65f19
Instruction ID: d0ac504a9255f30b9c725926041b77177e5e0caed2dc1baed0341d437d289319
Opcode Fuzzy Hash: 80e08a14f964f1394f595af2946dfd7764109c44ee838682c6d48f6542b65f19
Instruction Fuzzy Hash: A511D624F0D283D5FE58A725981217A22967F45774F140B3CE93E8A2DBDE2EBC61C311

Function 00007FF6869DF198 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869DF477

Part of subcall function 00007FF6869E5474: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E5491

Strings

ccs, xrefs: 00007FF6869DF3B2
UTF-8, xrefs: 00007FF6869DF3F6
UTF-16LEUNICODE, xrefs: 00007FF6869DF415

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: e657aeb740c2ac826b77e83addb2cc82262a2e6e3b5be7210a8d66ad85871f1f
Instruction ID: dea5d836526d7f32542a13b1b3bd3c0257a6f2339b2220473f637304729b08c6
Opcode Fuzzy Hash: e657aeb740c2ac826b77e83addb2cc82262a2e6e3b5be7210a8d66ad85871f1f
Instruction Fuzzy Hash: CC817D76E086C3C5EF645E29821627866A0BF11BC8F568039DA0DD76D7DF2FED02D242

Function 00007FF6869CE108 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6869CE154
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6869CE1A3

Strings

RCC, xrefs: 00007FF6869CE171
MOC, xrefs: 00007FF6869CE168

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: e66b2a899b3be21a272ca3efbe1e1fab7eec351de36f73ff2a6cc06a45c4f2b1
Instruction ID: fff2bc78147d69bd18f4cf5fbbf11df836cd58d6b1147b4cf610286a91cd6065
Opcode Fuzzy Hash: e66b2a899b3be21a272ca3efbe1e1fab7eec351de36f73ff2a6cc06a45c4f2b1
Instruction Fuzzy Hash: EE613D37A08B86C6EB10CF69E4803AD77A0FB44B88F144229DE4E57B96DF79E955C700

Function 00007FF6869CE464 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6869CE48C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6869CE574

Strings

csm, xrefs: 00007FF6869CE4AE
csm, xrefs: 00007FF6869CE5C6

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 37bca86698e542f9df3f1c5971c843800452ce466371b2576d682bdca002ed1e
Instruction ID: 157fd54d32650b1124cd0de8053910a0ab0ddfb52b357d1d642059d4dc686bd9
Opcode Fuzzy Hash: 37bca86698e542f9df3f1c5971c843800452ce466371b2576d682bdca002ed1e
Instruction Fuzzy Hash: 22516B329186C3C6EF748B19A24426876A0BF54B98F144139EB9F87BD6CF3DE851CB00

Function 00007FF6869C24D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6869C7A30: MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7A6A

MessageBoxW.USER32 ref: 00007FF6869C25D7
MessageBoxA.USER32 ref: 00007FF6869C25F3

Strings

%s%s: %s, xrefs: 00007FF6869C2558
Fatal error detected, xrefs: 00007FF6869C25AB, 00007FF6869C25E5

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 1ad8658de8dbd2e7b08889bff9c9537d6e44ae678795f4b96bc9f189f6c45e5f
Instruction ID: 6b9ae77ebcc3041d8ea54aa4f0e416c000911eee618bbda18a9c92c78883b683
Opcode Fuzzy Hash: 1ad8658de8dbd2e7b08889bff9c9537d6e44ae678795f4b96bc9f189f6c45e5f
Instruction Fuzzy Hash: 61314172628AC3D1EA20DB11E4517EA6364FF84794F80403AEA8D876DADE7DDA45CB40

Function 00007FF6869C3BA0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF6869C3699), ref: 00007FF6869C3BD1

Part of subcall function 00007FF6869C2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6869C7744,?,?,?,?,?,?,?,?,?,?,?,00007FF6869C101D), ref: 00007FF6869C2654
Part of subcall function 00007FF6869C2620: MessageBoxW.USER32 ref: 00007FF6869C272C

Strings

GetModuleFileNameW, xrefs: 00007FF6869C3BE2
Failed to get executable path., xrefs: 00007FF6869C3BDB
Failed to convert executable path to UTF-8., xrefs: 00007FF6869C3C0A

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: fe87d08da65b513e87772ab3e16eb14927cda1b8744753a26f3e7d7b1799e4b8
Instruction ID: c7d30d38b17b5b97308c0a3f614f5726d0ee270d3fa06f5c76a17cf4f67fbedd
Opcode Fuzzy Hash: fe87d08da65b513e87772ab3e16eb14927cda1b8744753a26f3e7d7b1799e4b8
Instruction Fuzzy Hash: 65014F21B1CAC3C1FE619B20E8563B92295BF58794F40103ED94FCA6D7EE9EEA45D700

Function 00007FF6869DBA70 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6869DBAEF
WriteFile.KERNEL32 ref: 00007FF6869DBDB7
WriteFile.KERNEL32 ref: 00007FF6869DBDFD
GetLastError.KERNEL32 ref: 00007FF6869DBEB3

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: f750311aff661a04a86bbbada4284786bf27b8065a17484a8f486471230e888d
Instruction ID: 0b81d6ea8600c74eb9049009ca2889d4c82c8e42b04c0a4bba3986407ce612a7
Opcode Fuzzy Hash: f750311aff661a04a86bbbada4284786bf27b8065a17484a8f486471230e888d
Instruction Fuzzy Hash: 2FD1D372B18A86C9EB10CF75D4502BC37A2FB44798B44423ACE5E97BDADE39D816C740

Function 00007FF6869D47D4 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF6869D4807
GetFileInformationByHandle.KERNEL32 ref: 00007FF6869D4869
GetLastError.KERNEL32 ref: 00007FF6869D48FA
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF6869D470C), ref: 00007FF6869D4946

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 1c70a69b05d9cb3f6248f84cd75ebf1bef0caf7e7cf88daad42b4853df974b62
Instruction ID: 099a8028040e6d1ef781c9be5da36b6f2381bf2fd562a8bf29b57826324be4c0
Opcode Fuzzy Hash: 1c70a69b05d9cb3f6248f84cd75ebf1bef0caf7e7cf88daad42b4853df974b62
Instruction Fuzzy Hash: 6D516822E08682CAFB90DFA1D5403BD23A1BF58B98F158139DE4D9769ADF39D891C740

Function 00007FF6869C1F70 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6869C1FA4
SetWindowLongPtrW.USER32 ref: 00007FF6869C1FC6
GetWindowLongPtrW.USER32 ref: 00007FF6869C1FF0
InvalidateRect.USER32 ref: 00007FF6869C2010

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction ID: 4b11804335e80d8ff71ed52055bfcf1b5eaf3c3cbccfdb02dbeacbfdaa4f918c
Opcode Fuzzy Hash: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction Fuzzy Hash: CF11E921E181C3C2FE508769E5442B91292FF897D0F445039E94A86BDFDE2EDCC1D204

Function 00007FF6869E4D3C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6869E08A0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E08D3

_get_daylight.LIBCMT ref: 00007FF6869E4E54
_get_daylight.LIBCMT ref: 00007FF6869E4E65

Strings

?, xrefs: 00007FF6869E4DE5

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: c6b54485bead06bc5539c244e4ab75d05ddcaebff17989ae90453d9827129cd1
Instruction ID: c5fa129c8d873c276f2d0dc1b09e848e784fff689e3df1ff861b6b0124fc59b6
Opcode Fuzzy Hash: c6b54485bead06bc5539c244e4ab75d05ddcaebff17989ae90453d9827129cd1
Instruction Fuzzy Hash: 8641E612A086C3D6FF649B25940137A6690FF80BA4F14423DEF5C86AD6DE7ED891C700

Function 00007FF6869D7E6C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D7E9E

Part of subcall function 00007FF6869D9E18: RtlFreeHeap.NTDLL(?,?,?,00007FF6869E1E42,?,?,?,00007FF6869E1E7F,?,?,00000000,00007FF6869E2345,?,?,?,00007FF6869E2277), ref: 00007FF6869D9E2E
Part of subcall function 00007FF6869D9E18: GetLastError.KERNEL32(?,?,?,00007FF6869E1E42,?,?,?,00007FF6869E1E7F,?,?,00000000,00007FF6869E2345,?,?,?,00007FF6869E2277), ref: 00007FF6869D9E38

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6869CB105), ref: 00007FF6869D7EBC

Strings

C:\Users\user\Desktop\oneDrive.exe, xrefs: 00007FF6869D7EAA

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\oneDrive.exe
API String ID: 3580290477-2215394283
Opcode ID: 3943842da798c31a181edbdfd7e827be925f8530d91395b67a93139410b16115
Instruction ID: beb2f3adef401bd025e1c9dc72d2a71517280ef65c44d507e8c1c01a85c26c0c
Opcode Fuzzy Hash: 3943842da798c31a181edbdfd7e827be925f8530d91395b67a93139410b16115
Instruction Fuzzy Hash: 46412B32A08B93C5EF249F2594801B867A4FF44B94B544039EA4E87BD6DF3EEC91C350

Function 00007FF6869DC108 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6869DC21F
GetLastError.KERNEL32 ref: 00007FF6869DC241

Strings

U, xrefs: 00007FF6869DC1CB

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4134df34369bde334de186fcdf44a7df93ab1702ff4cc21259579c47d67cfea1
Instruction ID: b470332bb7105c81cbfaf1d0b361a93fe564f7c3fb2ab3a9a2fb93b7eb822e8c
Opcode Fuzzy Hash: 4134df34369bde334de186fcdf44a7df93ab1702ff4cc21259579c47d67cfea1
Instruction Fuzzy Hash: 7941BF22A18A82D6DB208F65E8443A977A5FF987D4F804039EE4EC7799DF3DD841C740

Function 00007FF6869DE508 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF6869DE548
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6869DE59A

Strings

:, xrefs: 00007FF6869DE55E

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 8ec759577f911bbef9ae9f8bcb44b43b6ddd8abf9602cd78119f2d4801990209
Instruction ID: 6938a1e89772ed854217799e1f56bdde4b5ad5ab106a7ec56bf2da62c07f0f4e
Opcode Fuzzy Hash: 8ec759577f911bbef9ae9f8bcb44b43b6ddd8abf9602cd78119f2d4801990209
Instruction Fuzzy Hash: 6D218C72A186C3C1EF209B19E05426D63A1FF88B84F454039DA8D836C6EF7EED85CB51

Function 00007FF6869C2770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6869C7A30: MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7A6A

MessageBoxW.USER32 ref: 00007FF6869C2841
MessageBoxA.USER32 ref: 00007FF6869C285D

Strings

Fatal error detected, xrefs: 00007FF6869C2815, 00007FF6869C284F

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: f7448773671dbda672e22a82cfe80c2e0aa70ed18289780b2b9e604a2b102c49
Instruction ID: 2dd6d9a0a47aff4292d7ec9325005453ec11e4769343b826970d6fc42a1a91cd
Opcode Fuzzy Hash: f7448773671dbda672e22a82cfe80c2e0aa70ed18289780b2b9e604a2b102c49
Instruction Fuzzy Hash: 4C218372628AC2C1EF209711F4517EA6354FF84784F805139EA8E876DADF7DD605C750

Function 00007FF6869C2880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6869C7A30: MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7A6A

MessageBoxW.USER32 ref: 00007FF6869C2951
MessageBoxA.USER32 ref: 00007FF6869C296D

Strings

Error detected, xrefs: 00007FF6869C2925, 00007FF6869C295F

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 412921116a21d042ea7cc01f3b6226aa372ad23cfa1aaecee88db1efd33321aa
Instruction ID: 45c2a9012fb860fe0a031c6023aaf8091d2df02b2d8e99ebcbd8de653a3bd08c
Opcode Fuzzy Hash: 412921116a21d042ea7cc01f3b6226aa372ad23cfa1aaecee88db1efd33321aa
Instruction Fuzzy Hash: 93214172628AC2D1EF209711E4517EA6254FF84784F805139EA8E876DADE3DD605C750

Function 00007FF6869CEFB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6869CEFF4
RaiseException.KERNEL32 ref: 00007FF6869CF03A

Strings

csm, xrefs: 00007FF6869CF027

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: a9ac3328ea6075577af066dd04772514ea360050604432a87b0551bd96b2ca6b
Instruction ID: c932d60b43b6486c7770940b4731d8fe1141add09da7770d80acbafb843adf74
Opcode Fuzzy Hash: a9ac3328ea6075577af066dd04772514ea360050604432a87b0551bd96b2ca6b
Instruction Fuzzy Hash: 06112832608B82C2EB218F15F44026977A4FF88B94F184239EE8D477A9DF7ED951CB00

Function 00007FF6869DF00C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869DF03C
GetDriveTypeW.KERNEL32 ref: 00007FF6869DF07C

Strings

:, xrefs: 00007FF6869DF065

Memory Dump Source

Source File: 00000001.00000002.2050744018.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000001.00000002.2050716641.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050804666.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050843515.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2050904528.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: f8eec6a66f3a594e824ddea09938586a7cad5545a492e04bdbecb8d953b03adc
Instruction ID: 24bbeeba6ab2ca88f3a380b4ba93c0b649b4d8f41ba0eb4744cb159672555066
Opcode Fuzzy Hash: f8eec6a66f3a594e824ddea09938586a7cad5545a492e04bdbecb8d953b03adc
Instruction Fuzzy Hash: 48017C21918683C6EF61AF60D46227A23A0FF44758F44103AE54DC76D3DE2EE984DA14

Analysis Process: oneDrive.exePID: 7544, Parent PID: 7516COMMON

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	764
Total number of Limit Nodes:	16

Executed Functions

Function 00007FF6869E5D6C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6869E5AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E5AE1
Part of subcall function 00007FF6869E5AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E5B5F
Part of subcall function 00007FF6869E5AA0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E5BB0

CreateFileW.KERNELBASE ref: 00007FF6869E5E72
CreateFileW.KERNEL32 ref: 00007FF6869E5EC2
GetLastError.KERNEL32 ref: 00007FF6869E5EF2
GetFileType.KERNELBASE ref: 00007FF6869E5F07
GetLastError.KERNEL32 ref: 00007FF6869E5F11
CloseHandle.KERNEL32 ref: 00007FF6869E5F44
CloseHandle.KERNEL32 ref: 00007FF6869E60A7
CreateFileW.KERNEL32 ref: 00007FF6869E60DC
GetLastError.KERNEL32 ref: 00007FF6869E60EB

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: f9714f3a8e10acd42ca2d2c5b2c2c8a966f4ca54d5d677232d284773bb45134f
Instruction ID: ffb95471b4a742d7601a96979353f00057265813c4828013fc064cbb673f0455
Opcode Fuzzy Hash: f9714f3a8e10acd42ca2d2c5b2c2c8a966f4ca54d5d677232d284773bb45134f
Instruction Fuzzy Hash: 6FC1A236B24A82C6EF51CF69C4906AC3761FB49BA8B015239DA1E977D6CF7AD851C300

Function 00007FF6869C17B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF6869C185C
_fread_nolock.LIBCMT ref: 00007FF6869C190E

Part of subcall function 00007FF6869CF370: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869CF384

Part of subcall function 00007FF6869C2770: MessageBoxW.USER32 ref: 00007FF6869C2841

Strings

Error on file., xrefs: 00007FF6869C193D
fseek, xrefs: 00007FF6869C1836
Failed to read cookie!, xrefs: 00007FF6869C1867
fread, xrefs: 00007FF6869C186E
MEI, xrefs: 00007FF6869C17EF
Could not read full TOC!, xrefs: 00007FF6869C1919
Cannot read Table of Contents., xrefs: 00007FF6869C1995
Failed to seek to cookie position!, xrefs: 00007FF6869C182F
Could not allocate buffer for TOC!, xrefs: 00007FF6869C18E3
malloc, xrefs: 00007FF6869C18EA

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _fread_nolock$Message_invalid_parameter_noinfo
String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 2153230061-4158440160
Opcode ID: 9101801a2d3ac821dc45f3c210c6535dcaecc234eedfce769c1e2387d8d123d1
Instruction ID: 6baa0f4772c03c00f59c1df640cf9658c2e9d7bfcb866351f80806edd549a0fc
Opcode Fuzzy Hash: 9101801a2d3ac821dc45f3c210c6535dcaecc234eedfce769c1e2387d8d123d1
Instruction Fuzzy Hash: 33511A72A09683C6EF54CF28E45517833A0FF48B58B518139DA0EC77DAEE6EE944C744

Function 00007FF6869C12B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6869C134C
fseek, xrefs: 00007FF6869C1319
fread, xrefs: 00007FF6869C13E9
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6869C12E2
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6869C13E2
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6869C1312
malloc, xrefs: 00007FF6869C1353

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: b9527ed25a08e027e619c0f48f7f69b51d33915f4b886b1c04b788e0506d998c
Instruction ID: 9fa2b0cfd654436aeca4cb589196669ed3e15a82a63e47ed4d4c030ee9d81fac
Opcode Fuzzy Hash: b9527ed25a08e027e619c0f48f7f69b51d33915f4b886b1c04b788e0506d998c
Instruction Fuzzy Hash: DA415E21A086C3C2EE24DB15E4512BA63A0FF44B94F44443ADE4E87BD7EE7EE942C704

Function 00007FF6869C1000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6869C3BA0: GetModuleFileNameW.KERNEL32(?,00007FF6869C3699), ref: 00007FF6869C3BD1

SetDllDirectoryW.KERNEL32 ref: 00007FF6869C38A5

Part of subcall function 00007FF6869C6990: GetEnvironmentVariableW.KERNEL32(00007FF6869C36E7), ref: 00007FF6869C69CA
Part of subcall function 00007FF6869C6990: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6869C69E7

Strings

Failed to convert DLL search path!, xrefs: 00007FF6869C388D
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF6869C382C
MEI, xrefs: 00007FF6869C37E7
_PYI_ONEDIR_MODE, xrefs: 00007FF6869C36FC, 00007FF6869C3727
_MEIPASS2, xrefs: 00007FF6869C36D3, 00007FF6869C373C, 00007FF6869C39EB, 00007FF6869C39FB
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF6869C378E

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-3602715111
Opcode ID: a9d80687edf50720008c1c19d3c188cb07f31f297c6ec28e510237156a3f44f3
Instruction ID: 8a413891b6935212a964e5ed665dfd365a39070ce06dff9cbd96d0c9a3657484
Opcode Fuzzy Hash: a9d80687edf50720008c1c19d3c188cb07f31f297c6ec28e510237156a3f44f3
Instruction Fuzzy Hash: D1B18121A1CAC3D1EE65AB2194512FD6390BF44784F80413AEA4FC76DBEE2EEE05D740

Function 00007FF6869C1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6869C1249
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6869C10F1
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6869C111F
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6869C10B4
1.2.13, xrefs: 00007FF6869C107E
malloc, xrefs: 00007FF6869C10F8, 00007FF6869C1126

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Message
String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-1655038675
Opcode ID: 3a29cac6c315e89fd1a339ce373b4b8305977fdf4dc839f12d0ce977f9400e5b
Instruction ID: 955c61dbf2f9955b0a763ad5e6a27ffde3007a405058485060dfca9b9a955f49
Opcode Fuzzy Hash: 3a29cac6c315e89fd1a339ce373b4b8305977fdf4dc839f12d0ce977f9400e5b
Instruction Fuzzy Hash: 8551BC22A086C3C5EE609B55E4503BA6290BF86BA4F444139DE4EC77DAEF3EE945C704

Function 00007FF6869DDDB8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,00000000,?,00007FF6869DE152,?,?,-00000018,00007FF6869DA223,?,?,?,00007FF6869DA11A,?,?,?,00007FF6869D5472), ref: 00007FF6869DDF34
GetProcAddress.KERNEL32(?,00000000,?,00007FF6869DE152,?,?,-00000018,00007FF6869DA223,?,?,?,00007FF6869DA11A,?,?,?,00007FF6869D5472), ref: 00007FF6869DDF40

Strings

ext-ms-, xrefs: 00007FF6869DDE91
api-ms-, xrefs: 00007FF6869DDE7E

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 01869d8b0b1ae08ce046380e8c955ca032c286979885a37836ee5a28d8bde6d1
Instruction ID: 9d107852cfc4aa0f868c5404c2d617d4e674a6d402143d49c1fa439845df7a03
Opcode Fuzzy Hash: 01869d8b0b1ae08ce046380e8c955ca032c286979885a37836ee5a28d8bde6d1
Instruction Fuzzy Hash: 9341E122B19693C1FE25CB1698005756299BF15BA0F4A413DDD0DC77DAEE7EEC49C310

Function 00007FF6869DAF2C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869DB359

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6f2067f9e2b798d7e4aa60285487f192dd8020c4dcad372bd04a148e1f9d7242
Instruction ID: 35f6306d704fc450e07160b12ce18835cde31332b95a2372a797c17fbde69450
Opcode Fuzzy Hash: 6f2067f9e2b798d7e4aa60285487f192dd8020c4dcad372bd04a148e1f9d7242
Instruction Fuzzy Hash: 13C1B262A086C7C2EF609B1594402BD6BA6FF91B90F550139DA4E837DBCE7EEC45C300

Function 00007FF6869CB19C Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF6869CB1AB

Part of subcall function 00007FF6869CB36C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6869CB38E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6869CB1C0
__scrt_release_startup_lock.LIBCMT ref: 00007FF6869CB22E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6869CB281

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 90a7fcc3a81af5bf04ad81541e301d7d9fb9f11ea0fdd18d74326f9016f6428e
Instruction ID: c44b0a608571c3da6aa2a096032fc1fad657fba48939cd9cdd61962a0bcf5723
Opcode Fuzzy Hash: 90a7fcc3a81af5bf04ad81541e301d7d9fb9f11ea0fdd18d74326f9016f6428e
Instruction Fuzzy Hash: A5313911E08183C6FE14AB6095613BD3282BFA5384F45003CD94FCB2EBDE6FAE06C201

Function 00007FF6869D4680 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D46AD
CreateFileW.KERNELBASE ref: 00007FF6869D46EC
CloseHandle.KERNEL32 ref: 00007FF6869D4721

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 8a464286a4aee93ad09e46d96520f5fa22b2a313ca22bba1db5411dbdbef7e96
Instruction ID: 54af97e77354bbb2b2d59b266c33b0ebdf1e0cd9b2f329112b284c0e020acf48
Opcode Fuzzy Hash: 8a464286a4aee93ad09e46d96520f5fa22b2a313ca22bba1db5411dbdbef7e96
Instruction Fuzzy Hash: 5E418322E187C2C3EB948B61951037962A0FF95B64F109338E69C47AD7DF6DA9E0C700

Function 00007FF6869D8888 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6869D8884), ref: 00007FF6869D8899
TerminateProcess.KERNEL32(?,?,?,00007FF6869D8884), ref: 00007FF6869D88A4
ExitProcess.KERNEL32 ref: 00007FF6869D88B3

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: d426427e4f48dbbb9dc5f253e5f2c69f0b75b8518679dacd75070a6bbb583433
Instruction ID: 3dfb40239b053b8c91d6a486a76a98fa43dadd9ed469e1c9b6dae5d383991e51
Opcode Fuzzy Hash: d426427e4f48dbbb9dc5f253e5f2c69f0b75b8518679dacd75070a6bbb583433
Instruction Fuzzy Hash: ABD06C10B18683C2EE182BB0599517912127F88B61B11283CC81A8A7E7CDAEAC49C300

Function 00007FF6869CF39C Relevance: 3.2, APIs: 2, Instructions: 177
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869CF3E0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869CF4D7

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e6b31fcbb010569d964db91d6e465c54053a5eb593f9b70391a20bf1ad845ba7
Instruction ID: 1ddfc6e910e589cafb0d55d111a27352bfd63f83c7b17d911d935b6c52a2941c
Opcode Fuzzy Hash: e6b31fcbb010569d964db91d6e465c54053a5eb593f9b70391a20bf1ad845ba7
Instruction Fuzzy Hash: BB51D461B092C3C6EE689E25950467A6691BF44BE4F148638DE6EC77CBCF3EDC01C601

Function 00007FF6869DB604 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,00000000,00007FF6869DB79D), ref: 00007FF6869DB650
GetLastError.KERNEL32(?,?,?,?,00000000,00007FF6869DB79D), ref: 00007FF6869DB65A

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: ff2257711b1d275b862e663729d543ef4812b290fbf882e2e1232765a84f7875
Instruction ID: 55e0760c798f35c2569b785a52dc0337a394420d47c0e93d2944f701cd1159ca
Opcode Fuzzy Hash: ff2257711b1d275b862e663729d543ef4812b290fbf882e2e1232765a84f7875
Instruction Fuzzy Hash: 2A118FA2A18B82C1DE108B25A40416D7762BF45BF4F944339EA7D877EACF7DD851C700

Function 00007FF6869DA028 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF6869D9EA5,?,?,00000000,00007FF6869D9F5A), ref: 00007FF6869DA096
GetLastError.KERNEL32(?,?,?,00007FF6869D9EA5,?,?,00000000,00007FF6869D9F5A), ref: 00007FF6869DA0A0

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 649148bb364a2e2bb6c01b4b98e8ba63ccdb9764b03dbbc10b4a89a301f042aa
Instruction ID: d737a1cc6f16eeebada49c06781e2be62655489af6c7ef62383d8b29d848b388
Opcode Fuzzy Hash: 649148bb364a2e2bb6c01b4b98e8ba63ccdb9764b03dbbc10b4a89a301f042aa
Instruction Fuzzy Hash: 68219F21B186C3C5EE509765D4542791292BF85BF0F14423DEA2EC77D3CE6EAC65C300

Function 00007FF6869DB37C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869DB3A4

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7edcb5c19051daea02f21c4053ec30bf8603933813fd22e9cae156a3527bc5bd
Instruction ID: 231b8e70e92c901180214fd3ef494851442aee016d0e91d6841f46d27fdd9029
Opcode Fuzzy Hash: 7edcb5c19051daea02f21c4053ec30bf8603933813fd22e9cae156a3527bc5bd
Instruction Fuzzy Hash: C941CF72909283C7EE24DA19E540279B3A2FF95B54F100239D68EC76D6CF2EE802C751

Function 00007FF6869C7200 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF6869C72AA

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 033a4210891c7de0e80cf35636e901d9f642a42152a779333d6082372dd68c1a
Instruction ID: 64991a8481fd01b862e2bf2ecb1abfc886ec1adce2d048773d07bdb5ced14326
Opcode Fuzzy Hash: 033a4210891c7de0e80cf35636e901d9f642a42152a779333d6082372dd68c1a
Instruction Fuzzy Hash: A7218021B092D3C6EE119A12A5147BAA651BF45BD4F884438EF0E8B7C7CE3EE946C600

Function 00007FF6869DAE0C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869DAE92

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 47f2cb7360056a46563935c31beadd7a45ae652dec1b657f4a22353b163fa2db
Instruction ID: cb0f4aae9aa6e56c07f7b2345923d5c3fc933e9148756c73f83a58709fd9c366
Opcode Fuzzy Hash: 47f2cb7360056a46563935c31beadd7a45ae652dec1b657f4a22353b163fa2db
Instruction Fuzzy Hash: 0C316722A18683C9EF91AF15C8413782690BF40BA0F410239EA1D833D3CFBEEC91C725

Function 00007FF6869D87B9 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6869D87E7

Part of subcall function 00007FF6869D88E0: GetModuleHandleExW.KERNEL32 ref: 00007FF6869D8905
Part of subcall function 00007FF6869D88E0: GetProcAddress.KERNEL32 ref: 00007FF6869D891B
Part of subcall function 00007FF6869D88E0: FreeLibrary.KERNEL32 ref: 00007FF6869D8942

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: e9a7e304643df4a79f5f92f113a909c0855d61e5f1cd2648997e34e72053eb35
Instruction ID: 2f5a657defdde97fecea673e24998d2ae17fb294642703dd0b7496241ee72114
Opcode Fuzzy Hash: e9a7e304643df4a79f5f92f113a909c0855d61e5f1cd2648997e34e72053eb35
Instruction Fuzzy Hash: 3B216932E04A86CAEF259F64D4402AC33A0FF44718F15163AD62C8AAD7DF39D984CB80

Function 00007FF6869D54C8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D542D

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction ID: dbd4f0277b0e975a140a45a9be0193ea1b0fb7296ff64198b296dd7a40225499
Opcode Fuzzy Hash: be1079961907d1906d587a3e65c1e024338dd0a3e917ec7f85ba85c18500dcb2
Instruction Fuzzy Hash: BD115E21A0E6C3C1EE619F5194012B9A2A0BF85B84F444439EA8C97BD7CF7EDC51C742

Function 00007FF6869E575C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E577F

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bc68aba4551d34184bb05bda2552568f64e358e9307c55527e30db01171bb599
Instruction ID: baeb1ffdf0cccce4bb1848af9da19655a8c0a8ee857090300bcd218459b548fb
Opcode Fuzzy Hash: bc68aba4551d34184bb05bda2552568f64e358e9307c55527e30db01171bb599
Instruction Fuzzy Hash: 29214172A18682C6DF619F18E44036976A0FF84B54F144239EA5D876DADF7FD810CB00

Function 00007FF6869CF61C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869CF670

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction ID: 19d8271c81482c0947bf7c50bb4d989528cd58a8303711f9ebab4c5e849c13f6
Opcode Fuzzy Hash: f8ccbbb08b6b64fca274b3102351a157ba9f641dbe881e0fbefe782dfe020abd
Instruction Fuzzy Hash: AC01A521A08BC7C1EE049B529A01069A695BF85FE4F084639DE5D97BD7CE3ED901C700

Function 00007FF6869C71B0 Relevance: 1.5, APIs: 1, Instructions: 20libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6869C7A30: MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7A6A

LoadLibraryExW.KERNELBASE(?,?,00000000,00007FF6869C30BE), ref: 00007FF6869C71D3

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 63080640ee8bd5a5197bc5957a639ee791a00d05320db4a40cef4a6e5ab977c0
Instruction ID: be8fd8da8384e09e8a8ef89a04a806c3cc1f1f19858e26b699db91344436cb25
Opcode Fuzzy Hash: 63080640ee8bd5a5197bc5957a639ee791a00d05320db4a40cef4a6e5ab977c0
Instruction Fuzzy Hash: 40E08611B1858682DF589BA7E50546AA251BF8CFC0B489039DF0E47796DD2DD8908A00

Function 00007FF6869DDD40 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF6869DA8B6,?,?,?,00007FF6869D9A73,?,?,00000000,00007FF6869D9D0E), ref: 00007FF6869DDD95

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 2e0f3e4b2c9ccc38d96cb592f5054ed38be707e8bf6a1ab6843b3be497aa41a7
Instruction ID: 00c93ae9c86ed463d8c4816b99b927637622d912605ba3f5c2904ae2bb6c4832
Opcode Fuzzy Hash: 2e0f3e4b2c9ccc38d96cb592f5054ed38be707e8bf6a1ab6843b3be497aa41a7
Instruction Fuzzy Hash: 7AF09054B19683C0FE956BA299413B5128C7F99B90F4CA43EC90ED6BD3DD5EEC88C710

Function 00007FF6869DCACC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF6869CFE44,?,?,?,00007FF6869D1356,?,?,?,?,?,00007FF6869D2949), ref: 00007FF6869DCB0A

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c69b2b415516246c39874758743c65376e97b2ba2b88f646b423658d781f7dfd
Instruction ID: 857b5f3d8c902fd6cf67e3c247b7c297b20072a85fee0e46adc12bd882366ae4
Opcode Fuzzy Hash: c69b2b415516246c39874758743c65376e97b2ba2b88f646b423658d781f7dfd
Instruction Fuzzy Hash: ADF05810B092C3C0FE646AB159413752188BF58BF0F080638D82ED76C3EE6EEC80C610

Non-executed Functions

Function 00007FF6869C1B90 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF6869C1BDE
MulDiv.KERNEL32 ref: 00007FF6869C1BF2
MulDiv.KERNEL32 ref: 00007FF6869C1C13
SystemParametersInfoW.USER32 ref: 00007FF6869C1C5B
CreateFontIndirectW.GDI32 ref: 00007FF6869C1C6F
#380.COMCTL32 ref: 00007FF6869C1C93
CreateWindowExW.USER32 ref: 00007FF6869C1CE6
CreateWindowExW.USER32 ref: 00007FF6869C1D40
CreateWindowExW.USER32 ref: 00007FF6869C1D9D
CreateWindowExW.USER32 ref: 00007FF6869C1DFF
SendMessageW.USER32 ref: 00007FF6869C1E1F
SendMessageW.USER32 ref: 00007FF6869C1E39
SendMessageW.USER32 ref: 00007FF6869C1E58
SendMessageW.USER32 ref: 00007FF6869C1E77
SendMessageW.USER32 ref: 00007FF6869C1E95
SendMessageW.USER32 ref: 00007FF6869C1EB3
SendMessageW.USER32 ref: 00007FF6869C1ED1
SendMessageW.USER32 ref: 00007FF6869C1EE9
SendMessageW.USER32 ref: 00007FF6869C1F01
GetClientRect.USER32 ref: 00007FF6869C1F10

Part of subcall function 00007FF6869C2030: GetDC.USER32 ref: 00007FF6869C205B
Part of subcall function 00007FF6869C2030: SelectObject.GDI32 ref: 00007FF6869C20A2
Part of subcall function 00007FF6869C2030: DrawTextW.USER32 ref: 00007FF6869C20C5
Part of subcall function 00007FF6869C2030: SelectObject.GDI32 ref: 00007FF6869C20DB
Part of subcall function 00007FF6869C2030: ReleaseDC.USER32 ref: 00007FF6869C20EB
Part of subcall function 00007FF6869C2030: MoveWindow.USER32 ref: 00007FF6869C213B
Part of subcall function 00007FF6869C2030: MoveWindow.USER32 ref: 00007FF6869C217B
Part of subcall function 00007FF6869C2030: MoveWindow.USER32 ref: 00007FF6869C21CE

Strings

STATIC, xrefs: 00007FF6869C1C9C, 00007FF6869C1CF1
Close, xrefs: 00007FF6869C1DA8
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF6869C1BBD
EDIT, xrefs: 00007FF6869C1D4B
BUTTON, xrefs: 00007FF6869C1DB6

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 47b3578659853d453a5822a751c8e2f63cfdf798862dd1eeebf7592aa26dc86d
Instruction ID: 0477b2ba14464ed9a822cbd2da8e6cd8e0b4b4d0c1d87d4f7dff378c594421b7
Opcode Fuzzy Hash: 47b3578659853d453a5822a751c8e2f63cfdf798862dd1eeebf7592aa26dc86d
Instruction Fuzzy Hash: 2EA15B32208B82C7DB148F11E55479AB360FB88BA0F50412ADB8D43B65DFBEE565CB40

Function 00007FF6869C6780 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,00000000,?,00007FF6869C674D), ref: 00007FF6869C681A

Part of subcall function 00007FF6869C6990: GetEnvironmentVariableW.KERNEL32(00007FF6869C36E7), ref: 00007FF6869C69CA
Part of subcall function 00007FF6869C6990: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6869C69E7

Part of subcall function 00007FF6869D66B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D66CD

SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF6869C68D1

Part of subcall function 00007FF6869C2770: MessageBoxW.USER32 ref: 00007FF6869C2841

Strings

TMP, xrefs: 00007FF6869C67B8, 00007FF6869C6879, 00007FF6869C6907
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF6869C67F8
_MEI%d, xrefs: 00007FF6869C6828
TMP, xrefs: 00007FF6869C67DE

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: b4ad522e37175ac7074a900ecec4c645a4870e05ba81b0992846085732047fb7
Instruction ID: 12615383b6e2257a10b6f3c23b9eacad0eb6fbf4281c3efd35d3c732767b3415
Opcode Fuzzy Hash: b4ad522e37175ac7074a900ecec4c645a4870e05ba81b0992846085732047fb7
Instruction Fuzzy Hash: 84515921B1D6C3C1FE54AB62A9556BA5251BF89BD0F484439ED0ECB7D7EE2EEC01C600

Function 00007FF6869CB69C Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6869CB6B8
RtlCaptureContext.KERNEL32 ref: 00007FF6869CB6E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6869CB6FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF6869CB740
IsDebuggerPresent.KERNEL32 ref: 00007FF6869CB794
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6869CB7B5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6869CB7C0

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 24fff5600ca101af0e2334446d678d156eb325a0e0e0c0538aba544f51e330ab
Instruction ID: e6bfce1863a5ba720a7819482a11e462114de780809be9d01ece5cbd1e777c48
Opcode Fuzzy Hash: 24fff5600ca101af0e2334446d678d156eb325a0e0e0c0538aba544f51e330ab
Instruction Fuzzy Hash: 14313C72608AC2C6EF608F60E8803E97361FB84754F444439DA4E87A99DF7DDA48C710

Function 00007FF6869E4E20 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6869E4E65

Part of subcall function 00007FF6869E47B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E47CC

Part of subcall function 00007FF6869D9E18: HeapFree.KERNEL32(?,?,?,00007FF6869E1E42,?,?,?,00007FF6869E1E7F,?,?,00000000,00007FF6869E2345,?,?,?,00007FF6869E2277), ref: 00007FF6869D9E2E
Part of subcall function 00007FF6869D9E18: GetLastError.KERNEL32(?,?,?,00007FF6869E1E42,?,?,?,00007FF6869E1E7F,?,?,00000000,00007FF6869E2345,?,?,?,00007FF6869E2277), ref: 00007FF6869D9E38

Part of subcall function 00007FF6869D9DD0: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6869D9DAF,?,?,?,?,?,00007FF6869D21EC), ref: 00007FF6869D9DD9
Part of subcall function 00007FF6869D9DD0: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6869D9DAF,?,?,?,?,?,00007FF6869D21EC), ref: 00007FF6869D9DFE

_get_daylight.LIBCMT ref: 00007FF6869E4E54

Part of subcall function 00007FF6869E4818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E482C

_get_daylight.LIBCMT ref: 00007FF6869E50CA
_get_daylight.LIBCMT ref: 00007FF6869E50DB
_get_daylight.LIBCMT ref: 00007FF6869E50EC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6869E532C), ref: 00007FF6869E5113

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: a9f1dad40c5644c1829df854b35cf2cff202b4769108a1d535aac39d904cb9be
Instruction ID: 4a730f5b140078a5de538043c89b975cabd17c3897cac6644a78913b76a902d4
Opcode Fuzzy Hash: a9f1dad40c5644c1829df854b35cf2cff202b4769108a1d535aac39d904cb9be
Instruction Fuzzy Hash: 44D17C66A18283C6EF20AF25D4511B967A1FF84B94F45813EEA0D876C6DF7EEC42C740

Function 00007FF6869D9AE4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6869D9B5D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6869D9B75
RtlVirtualUnwind.KERNEL32 ref: 00007FF6869D9BB0
IsDebuggerPresent.KERNEL32 ref: 00007FF6869D9BE9
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6869D9BF3
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6869D9BFE

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 4204087c2144b4154cc610f07160e172692864cccd6c23e577d201b1c5d7dbdf
Instruction ID: a1e27d5aacefb87dfccb981d6cb2b78c9e86ffb13a174d6217a010ff4b3b5a92
Opcode Fuzzy Hash: 4204087c2144b4154cc610f07160e172692864cccd6c23e577d201b1c5d7dbdf
Instruction Fuzzy Hash: 4A313E32618B82C6DF609B65E8402AE73A4FF84764F500139EA8D83BA6DF7DD945CB00

Function 00007FF6869E09B4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E0A00
FindFirstFileExW.KERNEL32 ref: 00007FF6869E0B0A

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 0bdd7a8416f1e28eb8c09c6b5c037a8b7871395a979be626bc7410ef92a9cb5d
Instruction ID: 0571d8a96a6ab2270c820fbaabde35dea725f2852ef88dde61022697707ef2cd
Opcode Fuzzy Hash: 0bdd7a8416f1e28eb8c09c6b5c037a8b7871395a979be626bc7410ef92a9cb5d
Instruction Fuzzy Hash: ADB1B022B186D7C1EE619B21A4042B963A0FF44BE4F44417AEA5D97BC6DFBEEC51C700

Function 00007FF6869E509C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6869E50CA

Part of subcall function 00007FF6869E4818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E482C

_get_daylight.LIBCMT ref: 00007FF6869E50DB

Part of subcall function 00007FF6869E47B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E47CC

_get_daylight.LIBCMT ref: 00007FF6869E50EC

Part of subcall function 00007FF6869E47E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E47FC

Part of subcall function 00007FF6869D9E18: HeapFree.KERNEL32(?,?,?,00007FF6869E1E42,?,?,?,00007FF6869E1E7F,?,?,00000000,00007FF6869E2345,?,?,?,00007FF6869E2277), ref: 00007FF6869D9E2E
Part of subcall function 00007FF6869D9E18: GetLastError.KERNEL32(?,?,?,00007FF6869E1E42,?,?,?,00007FF6869E1E7F,?,?,00000000,00007FF6869E2345,?,?,?,00007FF6869E2277), ref: 00007FF6869D9E38

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6869E532C), ref: 00007FF6869E5113

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 8dda7e1bb43cce3069c61b2343a9d469707a009ccb87a98b23344d3931a91aef
Instruction ID: f05a120133836877883eb79a7598f4e417a44c09cbd800705c14821e6c1c51b4
Opcode Fuzzy Hash: 8dda7e1bb43cce3069c61b2343a9d469707a009ccb87a98b23344d3931a91aef
Instruction Fuzzy Hash: F9516A72A18683C6EB20EF21E9911A96760BF88784F45513EEA4DC36D6DF7EEC01C740

Function 00007FF6869C3DF0 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF6869C30BE), ref: 00007FF6869C3E06
GetProcAddress.KERNEL32(?,?,00000000,00007FF6869C30BE), ref: 00007FF6869C3E45
GetProcAddress.KERNEL32(?,?,00000000,00007FF6869C30BE), ref: 00007FF6869C3E6A
GetProcAddress.KERNEL32(?,?,00000000,00007FF6869C30BE), ref: 00007FF6869C3E8F
GetProcAddress.KERNEL32(?,?,00000000,00007FF6869C30BE), ref: 00007FF6869C3EB7
GetProcAddress.KERNEL32(?,?,00000000,00007FF6869C30BE), ref: 00007FF6869C3EDF
GetProcAddress.KERNEL32(?,?,00000000,00007FF6869C30BE), ref: 00007FF6869C3F07
GetProcAddress.KERNEL32(?,?,00000000,00007FF6869C30BE), ref: 00007FF6869C3F2F
GetProcAddress.KERNEL32(?,?,00000000,00007FF6869C30BE), ref: 00007FF6869C3F57

Strings

Failed to get address for Py_DontWriteBytecodeFlag, xrefs: 00007FF6869C3E18
Failed to get address for PyLong_AsLong, xrefs: 00007FF6869C4309
Py_SetProgramName, xrefs: 00007FF6869C40BD
GetProcAddress, xrefs: 00007FF6869C3E1F
Failed to get address for Py_SetPythonHome, xrefs: 00007FF6869C4101
PySys_AddWarnOption, xrefs: 00007FF6869C442D
Failed to get address for Py_IgnoreEnvironmentFlag, xrefs: 00007FF6869C3EA1
Failed to get address for PyImport_ImportModule, xrefs: 00007FF6869C4291
PyLong_AsLong, xrefs: 00007FF6869C42ED
Failed to get address for Py_NoUserSiteDirectory, xrefs: 00007FF6869C3EF1
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF6869C4539
Failed to get address for Py_VerboseFlag, xrefs: 00007FF6869C3F41
Failed to get address for PySys_SetArgvEx, xrefs: 00007FF6869C4471
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF6869C43A9
Failed to get address for PyList_Append, xrefs: 00007FF6869C42B9
Py_DecRef, xrefs: 00007FF6869C3FCD
PyUnicode_Join, xrefs: 00007FF6869C465D
Py_DontWriteBytecodeFlag, xrefs: 00007FF6869C3DFF
PyUnicode_Decode, xrefs: 00007FF6869C45E5
PyImport_ImportModule, xrefs: 00007FF6869C4275
PyMarshal_ReadObjectFromString, xrefs: 00007FF6869C451D
Failed to get address for PyObject_Str, xrefs: 00007FF6869C43F9
Py_IncRef, xrefs: 00007FF6869C401D
Failed to get address for Py_NoSiteFlag, xrefs: 00007FF6869C3EC9
Failed to get address for Py_UTF8Mode, xrefs: 00007FF6869C3F99
PyErr_Fetch, xrefs: 00007FF6869C41AD
Py_SetPythonHome, xrefs: 00007FF6869C40E5
PyModule_GetDict, xrefs: 00007FF6869C4315
Failed to get address for PySys_SetPath, xrefs: 00007FF6869C44E9
PyObject_Str, xrefs: 00007FF6869C43DD
Failed to get address for Py_Initialize, xrefs: 00007FF6869C4061
Failed to get address for Py_DecodeLocale, xrefs: 00007FF6869C4589
Py_FileSystemDefaultEncoding, xrefs: 00007FF6869C3E3B
Failed to get address for PySys_GetObject, xrefs: 00007FF6869C4499
PyImport_ExecCodeModule, xrefs: 00007FF6869C424D
Py_VerboseFlag, xrefs: 00007FF6869C3F25
Failed to get address for PyErr_Print, xrefs: 00007FF6869C41A1
PySys_SetArgvEx, xrefs: 00007FF6869C4455
Failed to get address for Py_FileSystemDefaultEncoding, xrefs: 00007FF6869C3E57
Failed to get address for PyErr_Restore, xrefs: 00007FF6869C41F1
Py_Initialize, xrefs: 00007FF6869C4045
Failed to get address for Py_SetProgramName, xrefs: 00007FF6869C40D9
PyImport_AddModule, xrefs: 00007FF6869C4225
PyUnicode_AsUTF8, xrefs: 00007FF6869C4635
PyUnicode_DecodeFSDefault, xrefs: 00007FF6869C460D
PyList_New, xrefs: 00007FF6869C42C5
PyDict_GetItemString, xrefs: 00007FF6869C410D
PyList_Append, xrefs: 00007FF6869C429D
PyObject_SetAttrString, xrefs: 00007FF6869C438D
Py_IgnoreEnvironmentFlag, xrefs: 00007FF6869C3E85
Py_UnbufferedStdioFlag, xrefs: 00007FF6869C3F4D
Failed to get address for PyMem_RawFree, xrefs: 00007FF6869C45B1
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF6869C4629
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF6869C4421
Failed to get address for Py_OptimizeFlag, xrefs: 00007FF6869C3F19
PySys_GetObject, xrefs: 00007FF6869C447D
PyObject_CallFunctionObjArgs, xrefs: 00007FF6869C4365
Failed to get address for Py_SetPath, xrefs: 00007FF6869C4089
Py_SetPath, xrefs: 00007FF6869C406D
PyErr_NormalizeException, xrefs: 00007FF6869C41FD
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF6869C45D9
Py_NoSiteFlag, xrefs: 00007FF6869C3EAD
Failed to get address for PyUnicode_Decode, xrefs: 00007FF6869C4601
Py_OptimizeFlag, xrefs: 00007FF6869C3EFD
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF6869C4651
Failed to get address for PyUnicode_FromString, xrefs: 00007FF6869C4561
Failed to get address for PySys_AddWarnOption, xrefs: 00007FF6869C4449
PyErr_Clear, xrefs: 00007FF6869C4135
PyRun_SimpleStringFlags, xrefs: 00007FF6869C4405
Failed to get address for PyModule_GetDict, xrefs: 00007FF6869C4331
Failed to get address for Py_Finalize, xrefs: 00007FF6869C4011
PyUnicode_FromFormat, xrefs: 00007FF6869C45BD
Py_GetPath, xrefs: 00007FF6869C4095
Py_DecodeLocale, xrefs: 00007FF6869C456D
Failed to get address for Py_BuildValue, xrefs: 00007FF6869C3FC1
PyErr_Occurred, xrefs: 00007FF6869C415D
Py_BuildValue, xrefs: 00007FF6869C3FA5
PyObject_CallFunction, xrefs: 00007FF6869C433D
PyUnicode_Replace, xrefs: 00007FF6869C4685
Py_UTF8Mode, xrefs: 00007FF6869C3F7D
Failed to get address for PyEval_EvalCode, xrefs: 00007FF6869C4511
PySys_SetObject, xrefs: 00007FF6869C44A5
PyErr_Restore, xrefs: 00007FF6869C41D5
Failed to get address for PyDict_GetItemString, xrefs: 00007FF6869C4129
Py_NoUserSiteDirectory, xrefs: 00007FF6869C3ED5
Py_FrozenFlag, xrefs: 00007FF6869C3E60
Failed to get address for PyErr_Fetch, xrefs: 00007FF6869C41C9
Failed to get address for Py_IncRef, xrefs: 00007FF6869C4039
Failed to get address for Py_UnbufferedStdioFlag, xrefs: 00007FF6869C3F69
Failed to get address for Py_GetPath, xrefs: 00007FF6869C40B1
Failed to get address for Py_DecRef, xrefs: 00007FF6869C3FE9
PySys_SetPath, xrefs: 00007FF6869C44CD
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF6869C4219
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF6869C4269
Failed to get address for PyUnicode_Join, xrefs: 00007FF6869C4679
Failed to get address for PyImport_AddModule, xrefs: 00007FF6869C4241
Failed to get address for PyObject_CallFunction, xrefs: 00007FF6869C4359
PyEval_EvalCode, xrefs: 00007FF6869C44F5
PyUnicode_FromString, xrefs: 00007FF6869C4545
Failed to get address for PySys_SetObject, xrefs: 00007FF6869C44C1
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF6869C43D1
PyErr_Print, xrefs: 00007FF6869C4185
Failed to get address for PyUnicode_Replace, xrefs: 00007FF6869C46A1
Failed to get address for PyList_New, xrefs: 00007FF6869C42E1
PyMem_RawFree, xrefs: 00007FF6869C4595
Failed to get address for PyErr_Clear, xrefs: 00007FF6869C4151
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF6869C4381
Failed to get address for PyErr_Occurred, xrefs: 00007FF6869C4179
Failed to get address for Py_FrozenFlag, xrefs: 00007FF6869C3E7C
PyObject_GetAttrString, xrefs: 00007FF6869C43B5
Py_Finalize, xrefs: 00007FF6869C3FF5

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
API String ID: 190572456-3109299426
Opcode ID: 67747be8a076f706c1c9372e7d2496993eaa02b7082083ef588a9e8b618be952
Instruction ID: c8d9f9b5edfaa15344947d12d845e44874886091f7758a2788adb69aff7ce728
Opcode Fuzzy Hash: 67747be8a076f706c1c9372e7d2496993eaa02b7082083ef588a9e8b618be952
Instruction Fuzzy Hash: 9E42A164A0DB87D1FE55CB08E95017423A6BF157A5B84503ED80E863EAFFBEAD58D300

Function 00007FF6869C55D0 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6869C71B0: LoadLibraryExW.KERNELBASE(?,?,00000000,00007FF6869C30BE), ref: 00007FF6869C71D3

GetProcAddress.KERNEL32 ref: 00007FF6869C5F67
GetProcAddress.KERNEL32 ref: 00007FF6869C5FA6
GetProcAddress.KERNEL32 ref: 00007FF6869C5FCB
GetProcAddress.KERNEL32 ref: 00007FF6869C5FF0
GetProcAddress.KERNEL32 ref: 00007FF6869C6018
GetProcAddress.KERNEL32 ref: 00007FF6869C6040
GetProcAddress.KERNEL32 ref: 00007FF6869C6068
GetProcAddress.KERNEL32 ref: 00007FF6869C6090
GetProcAddress.KERNEL32 ref: 00007FF6869C60B8

Strings

Failed to get address for Tcl_GetObjResult, xrefs: 00007FF6869C6322
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF6869C625A
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF6869C60CA
Failed to get address for Tcl_MutexLock, xrefs: 00007FF6869C60F2
Tcl_Free, xrefs: 00007FF6869C63CE
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF6869C62D2
GetProcAddress, xrefs: 00007FF6869C5F80
LOADER: Failed to load tcl/tk libraries, xrefs: 00007FF6869C561A
Failed to get address for Tcl_SetVar2, xrefs: 00007FF6869C6232
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF6869C62AA
Tcl_GetCurrentThread, xrefs: 00007FF6869C60AE
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF6869C61BA
Tcl_GetString, xrefs: 00007FF6869C6266
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF6869C639A
Tcl_Init, xrefs: 00007FF6869C5F60
Failed to get address for Tcl_GetVar2, xrefs: 00007FF6869C620A
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF6869C6142
Tcl_ConditionFinalize, xrefs: 00007FF6869C6126
Tcl_DoOneEvent, xrefs: 00007FF6869C5FE6
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF6869C61E2
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF6869C62FA
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF6869C6052
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF6869C5FDD
Failed to get address for Tcl_EvalFile, xrefs: 00007FF6869C634A
Failed to get address for Tcl_GetString, xrefs: 00007FF6869C6282
Tcl_DeleteInterp, xrefs: 00007FF6869C605E
Tcl_CreateThread, xrefs: 00007FF6869C6086
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF6869C6002
Tcl_Alloc, xrefs: 00007FF6869C63A6
Failed to get address for Tcl_Alloc, xrefs: 00007FF6869C63C2
Tcl_SetVar2Ex, xrefs: 00007FF6869C62DE
Failed to get address for Tcl_CreateThread, xrefs: 00007FF6869C60A2
Tcl_CreateInterp, xrefs: 00007FF6869C5F9C
Failed to get address for Tk_Init, xrefs: 00007FF6869C6412
Tcl_EvalObjv, xrefs: 00007FF6869C637E
Tcl_EvalEx, xrefs: 00007FF6869C6356
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF6869C643A
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF6869C611A
Tcl_GetObjResult, xrefs: 00007FF6869C6306
Tcl_NewStringObj, xrefs: 00007FF6869C628E
Tk_Init, xrefs: 00007FF6869C63F6
Tcl_MutexLock, xrefs: 00007FF6869C60D6
Tcl_ConditionNotify, xrefs: 00007FF6869C614E
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF6869C5FB8
Tcl_FinalizeThread, xrefs: 00007FF6869C6036
Tcl_SetVar2, xrefs: 00007FF6869C6216
Tcl_GetVar2, xrefs: 00007FF6869C61EE
Tcl_MutexUnlock, xrefs: 00007FF6869C60FE
Tcl_ThreadAlert, xrefs: 00007FF6869C61C6
Tk_GetNumMainWindows, xrefs: 00007FF6869C641E
Tcl_EvalFile, xrefs: 00007FF6869C632E
Failed to get address for Tcl_Finalize, xrefs: 00007FF6869C602A
Tcl_FindExecutable, xrefs: 00007FF6869C5FC1
Tcl_ThreadQueueEvent, xrefs: 00007FF6869C619E
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF6869C607A
Tcl_ConditionWait, xrefs: 00007FF6869C6176
Tcl_NewByteArrayObj, xrefs: 00007FF6869C62B6
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF6869C616A
Failed to get address for Tcl_Init, xrefs: 00007FF6869C5F79
Failed to get address for Tcl_EvalEx, xrefs: 00007FF6869C6372
Failed to get address for Tcl_Free, xrefs: 00007FF6869C63EA
Tcl_Finalize, xrefs: 00007FF6869C600E
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF6869C6192
Tcl_CreateObjCommand, xrefs: 00007FF6869C623E

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 2238633743-1453502826
Opcode ID: ba523ba2b13c4ea14ee618d69630f35f7ff64aa3d65f3ca8e14aa07d75cb9247
Instruction ID: a2811b3cd48626fc7b102f29f6d7b8bb0c45153efacc1a6ff7f91671dfc5caf5
Opcode Fuzzy Hash: ba523ba2b13c4ea14ee618d69630f35f7ff64aa3d65f3ca8e14aa07d75cb9247
Instruction Fuzzy Hash: 72E1F760A0DB83D5FE59CB08A95027423A9BF15791B84503DC85EC63EAEFBEBD58D301

Function 00007FFB24BD8C24 Relevance: 54.6, APIs: 3, Strings: 28, Instructions: 352COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD913D
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD9175
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD91AF

Strings

char32_t, xrefs: 00007FFB24BD90B7
wchar_t, xrefs: 00007FFB24BD90A8
signed , xrefs: 00007FFB24BD910A
int, xrefs: 00007FFB24BD8CCE
char, xrefs: 00007FFB24BD8CF2
volatile, xrefs: 00007FFB24BD8FF8
long, xrefs: 00007FFB24BD8CBC
__int128, xrefs: 00007FFB24BD8EB7
__int32, xrefs: 00007FFB24BD8EDB
decltype(auto), xrefs: 00007FFB24BD90C6
unsigned , xrefs: 00007FFB24BD90FA
volatile, xrefs: 00007FFB24BD9025
__w64 , xrefs: 00007FFB24BD8E3A
void, xrefs: 00007FFB24BD8D86
char8_t, xrefs: 00007FFB24BD8F2D
auto, xrefs: 00007FFB24BD8F3F
__int16, xrefs: 00007FFB24BD8E1C
UNKNOWN, xrefs: 00007FFB24BD908D
<unknown>, xrefs: 00007FFB24BD8F1B
float, xrefs: 00007FFB24BD8D74
__int64, xrefs: 00007FFB24BD8EC9
bool, xrefs: 00007FFB24BD9056
long , xrefs: 00007FFB24BD8D31
const, xrefs: 00007FFB24BD8FDD
double, xrefs: 00007FFB24BD8D48
char16_t, xrefs: 00007FFB24BD9065
short, xrefs: 00007FFB24BD8CE0
__int8, xrefs: 00007FFB24BD8E2E

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: Name::operator+
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $unsigned $void$volatile$wchar_t
API String ID: 2943138195-1388207849
Opcode ID: 34b20832b4d5a9c82cdd9a34609b0a596913eac70dfc3082442192f721d64891
Instruction ID: 627931c52628c668441d8a444d90438cdc0ecf8ae9925fd0575e6e88dc4beaf8
Opcode Fuzzy Hash: 34b20832b4d5a9c82cdd9a34609b0a596913eac70dfc3082442192f721d64891
Instruction Fuzzy Hash: 53F180B9F08A92D4FB1A8B74DDC82BC36B0BB48744F804575CA1D16EAADF7DA645C340

Function 00007FFB24BDC3C8 Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 288COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC459
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC492
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC566
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC577
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC5DA
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC5EA
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC636
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC648
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC7BB
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC83B
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC84A

Strings

`anonymous namespace', xrefs: 00007FFB24BDC71B

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: Name::operator+
String ID: `anonymous namespace'
API String ID: 2943138195-3062148218
Opcode ID: c36001f134547c1fc12f70ffa9b86d35a9d04869d0c52a2f257cd9dd74f3dfc9
Instruction ID: 743e3990fe4c01aa7f718cd6e64c73e766cf14377f292ce3e908304f9265f726
Opcode Fuzzy Hash: c36001f134547c1fc12f70ffa9b86d35a9d04869d0c52a2f257cd9dd74f3dfc9
Instruction Fuzzy Hash: 05E146BAA08BC2D5EB12CF34D9881AD77A0FB89748F804176EA4D17E56DF38E555CB00

Function 00007FFB24BDA83C Relevance: 22.9, APIs: 15, Instructions: 358COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDA88D
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDA969
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDA9B2
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDA9C3

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 63ad456de8db332c0b347e2e514b887ab112aaee213ccda8367cb7f767930e9c
Instruction ID: e5fc52487f7a39c43e21f501120fdf85647314331092f359b393b94c3d844820
Opcode Fuzzy Hash: 63ad456de8db332c0b347e2e514b887ab112aaee213ccda8367cb7f767930e9c
Instruction Fuzzy Hash: 77F17CBAB08AC2DAEB12DF74D8941EC37B0EB4974CB444171EA4D57E9ADE38D51AC340

Function 00007FFB24BDD20C Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 349COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDD712

Strings

`template-type-parameter-, xrefs: 00007FFB24BDD6D0
`generic-class-parameter-, xrefs: 00007FFB24BDD6C7
nullptr, xrefs: 00007FFB24BDD3FA
`generic-method-parameter-, xrefs: 00007FFB24BDD6B7
NULL, xrefs: 00007FFB24BDD2D7

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: Name::operator+
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$nullptr
API String ID: 2943138195-2309034085
Opcode ID: 767f6b35ed257beddb1ea2fff1390adae3ecab9bc22a75a6672164d643aa4b64
Instruction ID: 4ae4ce60ac60ec6f8e27ff031277cb7f054e68430663c424df62b7b8ec8ad41a
Opcode Fuzzy Hash: 767f6b35ed257beddb1ea2fff1390adae3ecab9bc22a75a6672164d643aa4b64
Instruction Fuzzy Hash: 74E16CEAE08692C4FB169B74CDDC1BC37A9AF56748F4401B5CA8E16E9BDE3CA505C340

Function 00007FF6869C1440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF6869C1559
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF6869C15D5
fopen, xrefs: 00007FF6869C1491
fseek, xrefs: 00007FF6869C1500
fwrite, xrefs: 00007FF6869C15DC
Failed to extract %s: failed to open target file!, xrefs: 00007FF6869C148A
fread, xrefs: 00007FF6869C15EC
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6869C14CA
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6869C15E5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6869C14F9
malloc, xrefs: 00007FF6869C1560

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID:
String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 0-666925554
Opcode ID: 1bbb5a14678834b1a958f942c3490a164635d270f47cc7c371ea8b9b6d09e3c4
Instruction ID: ec3dde29b07e951715218c0a3e8332ebf4329088ddccf8077d0ee4201b64d0fe
Opcode Fuzzy Hash: 1bbb5a14678834b1a958f942c3490a164635d270f47cc7c371ea8b9b6d09e3c4
Instruction Fuzzy Hash: F5517861B08AC3C1EE209B21E5546B963A0BF45BE8F444539DE0EC76E7EE7EE945C304

Function 00007FF6869C78A0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00007FF6869C685A,?,00007FF6869C674D), ref: 00007FF6869C78E0
OpenProcessToken.ADVAPI32(?,00007FF6869C674D), ref: 00007FF6869C78F1
GetTokenInformation.ADVAPI32(?,00007FF6869C674D(TokenIntegrityLevel)), ref: 00007FF6869C7913
GetLastError.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF6869C791D
GetTokenInformation.ADVAPI32(?,TokenIntegrityLevel), ref: 00007FF6869C795A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6869C796C
CloseHandle.KERNEL32(?,00007FF6869C674D), ref: 00007FF6869C7984
LocalFree.KERNEL32(?,00007FF6869C674D), ref: 00007FF6869C79B6
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF6869C79DD
CreateDirectoryW.KERNEL32(?,00007FF6869C674D), ref: 00007FF6869C79EE

Strings

D:(A;;FA;;;%s), xrefs: 00007FF6869C7999
S-1-3-4, xrefs: 00007FF6869C798F

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
String ID: D:(A;;FA;;;%s)$S-1-3-4
API String ID: 4998090-2855260032
Opcode ID: 325d64cfb385d23493eb0389c0ea059c6d59262dbafda5a72abe8264351e6c2a
Instruction ID: 8da2eea8deb8d7015943f864ab9d974cea02c40b2eda5059854a239fdba017de
Opcode Fuzzy Hash: 325d64cfb385d23493eb0389c0ea059c6d59262dbafda5a72abe8264351e6c2a
Instruction Fuzzy Hash: 96413D3161C6C3C2EF509F61E4446AA7361FF857A4F440239EA9E866E6DF7DD944CB00

Function 00007FFB24BD2CE4 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 309COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FFB24BD2D40

Part of subcall function 00007FFB24BD5010: _GetEstablisherFrame.LIBVCRUNTIME ref: 00007FFB24BD5045
Part of subcall function 00007FFB24BD5010: __GetUnwindTryBlock.LIBCMT ref: 00007FFB24BD5053
Part of subcall function 00007FFB24BD5010: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FFB24BD5078

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFB24BD2E18
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD2E25
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FFB24BD3060
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD308E
_GetEstablisherFrame.LIBVCRUNTIME ref: 00007FFB24BD30CC

Part of subcall function 00007FFB24BD6710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFB24BD239E), ref: 00007FFB24BD671E

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD3154
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFB24BD3189

Strings

csm, xrefs: 00007FFB24BD2E3D
csm, xrefs: 00007FFB24BD2DC1
csm, xrefs: 00007FFB24BD2D5A

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: Frame$BlockEstablisherHandler3::Unwindabortterminate$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3436797354-393685449
Opcode ID: d5e0e3ab29c15918133307a59fdea49d8ed4f7431b693d67295d57de9f2acebd
Instruction ID: 22253bd0a67ce83eca04542697196deb54eeb22597ff63cb915149abcad003b1
Opcode Fuzzy Hash: d5e0e3ab29c15918133307a59fdea49d8ed4f7431b693d67295d57de9f2acebd
Instruction Fuzzy Hash: C2D16FBAA08782C6EB169F75D8882AD77A0FB49B98F001175DE4D57B57CF38E491C700

Function 00007FF6869C2030 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6869C205B
SelectObject.GDI32 ref: 00007FF6869C20A2
DrawTextW.USER32 ref: 00007FF6869C20C5
SelectObject.GDI32 ref: 00007FF6869C20DB
ReleaseDC.USER32 ref: 00007FF6869C20EB
MoveWindow.USER32 ref: 00007FF6869C213B
MoveWindow.USER32 ref: 00007FF6869C217B
MoveWindow.USER32 ref: 00007FF6869C21CE
MoveWindow.USER32 ref: 00007FF6869C2216

Strings

P%, xrefs: 00007FF6869C20AF

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
Instruction ID: 10a2cfe017bc9901790bd3251bd4720250bdaebab6c13eb73d989123c7bdfc82
Opcode Fuzzy Hash: 2abf96d7e756ec95747b6225775113f5ca3bbb9c1d9d148edce5ba3104c9dbe9
Instruction Fuzzy Hash: 90512626608BE2C6DA349F26E0181BAB7A1FB98B61F004125EFCF83695DF7DD445DB10

Function 00007FFB24BDE350 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 196COMMONLIBRARYCODE

Download Yara Rule

Strings

template-parameter-, xrefs: 00007FFB24BDE417
`template-parameter-, xrefs: 00007FFB24BDE44A
generic-type-, xrefs: 00007FFB24BDE45E
`generic-type-, xrefs: 00007FFB24BDE491

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID:
String ID: `generic-type-$`template-parameter-$generic-type-$template-parameter-
API String ID: 0-3207858774
Opcode ID: 6f458657f8fae6e2f2557f40169539ea56a3e6fb73d2116d9b83691f1491e61c
Instruction ID: 1a5f2b36762db7e93f5bd4a59581bd0c29a4200a6fb0a0a3653499aee2d57950
Opcode Fuzzy Hash: 6f458657f8fae6e2f2557f40169539ea56a3e6fb73d2116d9b83691f1491e61c
Instruction Fuzzy Hash: 3B9153AAB08AC6C5EB16CB34D8D82BC37A0AB54B48F8441B5DA4D07B97DF3CE506C740

Function 00007FFB24BDA13C Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDA198

Part of subcall function 00007FFB24BD722C: DName::operator+=.LIBVCRUNTIME ref: 00007FFB24BD7247

DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDA2C5

Strings

`unknown ecsu', xrefs: 00007FFB24BDA164
coclass , xrefs: 00007FFB24BDA27E
class , xrefs: 00007FFB24BDA2DA
cointerface , xrefs: 00007FFB24BDA26C
struct , xrefs: 00007FFB24BDA2E9
union , xrefs: 00007FFB24BDA2F2
enum , xrefs: 00007FFB24BDA287

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: Name::operator+$Name::operator+=
String ID: `unknown ecsu'$class $coclass $cointerface $enum $struct $union
API String ID: 179159573-1464470183
Opcode ID: 2fc61dd6c602e97fa3c1e55ca06bd20aebc659b0b394667bc2b1a0081ee2f141
Instruction ID: 05f27eff3722ec41a6732f213f0318a135cb17778df60048b47fb83a02ada125
Opcode Fuzzy Hash: 2fc61dd6c602e97fa3c1e55ca06bd20aebc659b0b394667bc2b1a0081ee2f141
Instruction Fuzzy Hash: 0B515BBAF18A96C9FB16CB75EC885AC37B0BB1A744F500135DA0D56E5ADF29E542C300

Function 00007FF6869C74B0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF6869C26A0), ref: 00007FF6869C74D7
FormatMessageW.KERNEL32(00000000,00007FF6869C26A0), ref: 00007FF6869C7506
WideCharToMultiByte.KERNEL32 ref: 00007FF6869C755C

Part of subcall function 00007FF6869C2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6869C7744,?,?,?,?,?,?,?,?,?,?,?,00007FF6869C101D), ref: 00007FF6869C2654
Part of subcall function 00007FF6869C2620: MessageBoxW.USER32 ref: 00007FF6869C272C

Strings

Failed to encode wchar_t as UTF-8., xrefs: 00007FF6869C7566
PyInstaller: FormatMessageW failed., xrefs: 00007FF6869C7523
FormatMessageW, xrefs: 00007FF6869C7517
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF6869C7579
No error messages generated., xrefs: 00007FF6869C7510
WideCharToMultiByte, xrefs: 00007FF6869C756D

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 8b0166d5a5045c769a8e77ad43af0852bc728ff9b5502801be361ecb61f6b2fa
Instruction ID: b033085725c13a7986ea97f6fe2a985c09bd342bac3ea676cab11986621025a0
Opcode Fuzzy Hash: 8b0166d5a5045c769a8e77ad43af0852bc728ff9b5502801be361ecb61f6b2fa
Instruction Fuzzy Hash: 58213031A18AC3C2EF209B11E8413766265BF48394F84003DE69EC66E6EFBEE945C740

Function 00007FFB24BD88E4 Relevance: 15.2, APIs: 10, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD89AE
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD89BE
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD8A0A
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD8A1A
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD8A2A
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD8A9D
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD8AAE
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD8AC0
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD8AEC
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD8AFB

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 28d39e64d2900046752fe00e0d170ae61e4b908a297697eb59c3c366de5be272
Instruction ID: aa630a2fd13f470023e11ce266dd3ce77c75b319b4eaf4afe395305b6609a5b1
Opcode Fuzzy Hash: 28d39e64d2900046752fe00e0d170ae61e4b908a297697eb59c3c366de5be272
Instruction Fuzzy Hash: 396149A6B04AA2D8FB02DBB0DC841EC37B1BB44788B805476DE5D2BE5ADF78D546C340

Function 00007FF6869D0228 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D0268
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D0630
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D08CF

Strings

p, xrefs: 00007FF6869D030D
f, xrefs: 00007FF6869D036A
f, xrefs: 00007FF6869D0300
p, xrefs: 00007FF6869D0372
f, xrefs: 00007FF6869D04B5

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction ID: 2eb7f65ec5b1043f3e062cde9a2dc9a687b26e1f4d8482bebcea5b9c5b4a7a12
Opcode Fuzzy Hash: 864902cbb2e935f55fbb0b0f358a3d1305b233c90ffe52d12db1516ed6b7c985
Instruction Fuzzy Hash: ED128C62E0C1C3C6FF209E15A0546BA76A1FF90754F884179E68987AC6DF7EEC80CB54

Function 00007FFB24BD31A0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFB24BD333E
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD334B

Part of subcall function 00007FFB24BD6710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFB24BD239E), ref: 00007FFB24BD671E

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD35F9
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD3644
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFB24BD3679

Strings

csm, xrefs: 00007FFB24BD3367
csm, xrefs: 00007FFB24BD3285
csm, xrefs: 00007FFB24BD32E7

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: abortterminate$Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 211107550-393685449
Opcode ID: 1f2c6e9c8ad6c1917ecaa8d6efe9c468c91fc9baef10e6d9588306a72b9f3ebc
Instruction ID: 11fa96110d2d60835ee5aacfe2a485cdb37829e2e58e93698b54acbda6a88b7c
Opcode Fuzzy Hash: 1f2c6e9c8ad6c1917ecaa8d6efe9c468c91fc9baef10e6d9588306a72b9f3ebc
Instruction Fuzzy Hash: B8E18FBAA086C2CAE7129F74D8C82AD7BA0FB44B58F145175DA8D47B57CF78E485CB00

Function 00007FFB24BDBE24 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDBFD8

Part of subcall function 00007FFB24BD8C24: DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD913D
Part of subcall function 00007FFB24BD8C24: DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD9175

DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDBF8A

Strings

void, xrefs: 00007FFB24BDBE6E
cli::pin_ptr<, xrefs: 00007FFB24BDBFA1
std::nullptr_t, xrefs: 00007FFB24BDBF03
std::nullptr_t , xrefs: 00007FFB24BDBF16
cli::array<, xrefs: 00007FFB24BDBF57
void , xrefs: 00007FFB24BDBE96

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 2943138195-2239912363
Opcode ID: e2dcc5ac231621b7bb9adceaede0f9dd180f9bba2b8fff5e7c5622460418e45f
Instruction ID: 6a761304d69853cfb0e0d241b0341df66daf2444d248bc89ac77070990102442
Opcode Fuzzy Hash: e2dcc5ac231621b7bb9adceaede0f9dd180f9bba2b8fff5e7c5622460418e45f
Instruction Fuzzy Hash: D65156AAE0CB86C9FB16CB70DD892BC77A0BB48744F844576CA4D16E96DF7CA045C710

Function 00007FF6869C6FD0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6869C7A30: MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7A6A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF6869C3A30), ref: 00007FF6869C701F
GetStartupInfoW.KERNEL32 ref: 00007FF6869C703E

Part of subcall function 00007FF6869D9184: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D9198

Part of subcall function 00007FF6869D6EF8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D6F5F

GetCommandLineW.KERNEL32 ref: 00007FF6869C70DE
CreateProcessW.KERNEL32 ref: 00007FF6869C7120
WaitForSingleObject.KERNEL32 ref: 00007FF6869C7134
GetExitCodeProcess.KERNEL32 ref: 00007FF6869C7144

Strings

Error creating child process!, xrefs: 00007FF6869C7150
CreateProcessW, xrefs: 00007FF6869C7157

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 818e29d337d92c80142cd965dc47d4137e35c853672c1fb6e5a7bce6e7f526a1
Instruction ID: 7f8df44f7d045042c4078dee0a01664aadb41bf48f778d8dee9f7bd61b584d72
Opcode Fuzzy Hash: 818e29d337d92c80142cd965dc47d4137e35c853672c1fb6e5a7bce6e7f526a1
Instruction Fuzzy Hash: A4412032A087C3C2DE209B64E8552AAB364FF95364F400339E6AD87AE6DF7DD454CB40

Function 00007FF6869CDC30 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6869CDC8D

Part of subcall function 00007FF6869CEBA0: __GetUnwindTryBlock.LIBCMT ref: 00007FF6869CEBE3
Part of subcall function 00007FF6869CEBA0: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6869CEC08

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6869CDD65
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6869CDFBA
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6869CE0C6

Strings

csm, xrefs: 00007FF6869CDD88
csm, xrefs: 00007FF6869CDCA7
csm, xrefs: 00007FF6869CDD0E

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 64a04dea20eab758f09741b49381e36ae6aa3d4dbdf263ead872da10faeebcc4
Instruction ID: ea632bb401eb1443126ce2c3b0a2881f2bef4ac76ed3a491a3bb03b45bd34a6b
Opcode Fuzzy Hash: 64a04dea20eab758f09741b49381e36ae6aa3d4dbdf263ead872da10faeebcc4
Instruction Fuzzy Hash: 37E16072A08786CAEF209F65A4402AD77A4FF45798F100139EE4E97B96CF39E895C740

Function 00007FFB24BD5F0A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB24BD63F0: RtlPcToFileHeader.KERNEL32 ref: 00007FFB24BD6434
Part of subcall function 00007FFB24BD63F0: RaiseException.KERNEL32 ref: 00007FFB24BD647A

RtlPcToFileHeader.KERNEL32 ref: 00007FFB24BD5FA7
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00007FFB24BD6003

Strings

Attempted a typeid of nullptr pointer!, xrefs: 00007FFB24BD60E5
Bad dynamic_cast!, xrefs: 00007FFB24BD6072
Bad read pointer - no RTTI data!, xrefs: 00007FFB24BD6108
Access violation - no RTTI data!, xrefs: 00007FFB24BD5F0A, 00007FFB24BD612B

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: FileHeader$ExceptionFindInstanceRaiseTargetType
String ID: Access violation - no RTTI data!$Attempted a typeid of nullptr pointer!$Bad dynamic_cast!$Bad read pointer - no RTTI data!
API String ID: 1852475696-928371585
Opcode ID: 7f6c35cefbfcfc98e88ebc0aa35afe6c2c6ede9eabcdb344d1914a97fbaad475
Instruction ID: 38806a0242552bcdf588175c6a40ac5a4af1a15a4f9e02fec659ff7386e829b9
Opcode Fuzzy Hash: 7f6c35cefbfcfc98e88ebc0aa35afe6c2c6ede9eabcdb344d1914a97fbaad475
Instruction Fuzzy Hash: 09516CAAB19A86D2EF26DB34ECD85BD7360FB84B94F404471DA4D07A66DE3CE506C700

Function 00007FFB24BDE148 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDE1BC
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDE1CB
DName::operator+=.LIBVCRUNTIME ref: 00007FFB24BDE2E8

Part of subcall function 00007FFB24BDC3C8: DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC459
Part of subcall function 00007FFB24BDC3C8: DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC492
Part of subcall function 00007FFB24BDC3C8: DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC7BB

DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDE26B
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDE27B
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDE325

Strings

{for , xrefs: 00007FFB24BDE1F4

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: Name::operator+$Name::operator+=
String ID: {for
API String ID: 179159573-864106941
Opcode ID: edc966f78679f2c80b6a90da374f91d2d358e76260b44eb27b7c84d8a506cb89
Instruction ID: 951343bcf83c4ec9b40d1cb65b9e12b431c7f391266da7e1e7c2524bd4cd3a93
Opcode Fuzzy Hash: edc966f78679f2c80b6a90da374f91d2d358e76260b44eb27b7c84d8a506cb89
Instruction Fuzzy Hash: 8E5129BAA08AC5D9EB128F34D9893EC73A1EB45758F8080B1EA4C4BE96DF7CD555C340

Function 00007FF6869C7600 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6869C101D), ref: 00007FF6869C769F
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6869C101D), ref: 00007FF6869C76EF

Strings

Failed to encode wchar_t as UTF-8., xrefs: 00007FF6869C7718
win32_utils_to_utf8, xrefs: 00007FF6869C7728
Failed to get UTF-8 buffer size., xrefs: 00007FF6869C7731
Out of memory., xrefs: 00007FF6869C7721
WideCharToMultiByte, xrefs: 00007FF6869C7738

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: 43851299e65b878553ee9477cdfb9aa8b38a7a1e3001ba9c1eb6bb9cebf00e3a
Instruction ID: b7ba52b738895a4525354db50a6cb80c1245ccdb882ed0a2bbf737f81afecc0c
Opcode Fuzzy Hash: 43851299e65b878553ee9477cdfb9aa8b38a7a1e3001ba9c1eb6bb9cebf00e3a
Instruction Fuzzy Hash: A3416B32A08BC3C6EA20CF15B44026AA7A5FF84B90F584139DA9E87BD6DF7DD851D700

Function 00007FFB24BD68AC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FFB24BD6A6B,?,?,00000000,00007FFB24BD689C,?,?,?,?,00007FFB24BD65E5), ref: 00007FFB24BD6931
GetLastError.KERNEL32(?,?,?,00007FFB24BD6A6B,?,?,00000000,00007FFB24BD689C,?,?,?,?,00007FFB24BD65E5), ref: 00007FFB24BD693F
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFB24BD6A6B,?,?,00000000,00007FFB24BD689C,?,?,?,?,00007FFB24BD65E5), ref: 00007FFB24BD6958
LoadLibraryExW.KERNEL32(?,?,?,00007FFB24BD6A6B,?,?,00000000,00007FFB24BD689C,?,?,?,?,00007FFB24BD65E5), ref: 00007FFB24BD696A
FreeLibrary.KERNEL32(?,?,?,00007FFB24BD6A6B,?,?,00000000,00007FFB24BD689C,?,?,?,?,00007FFB24BD65E5), ref: 00007FFB24BD69B0
GetProcAddress.KERNEL32(?,?,?,00007FFB24BD6A6B,?,?,00000000,00007FFB24BD689C,?,?,?,?,00007FFB24BD65E5), ref: 00007FFB24BD69BC

Strings

api-ms-, xrefs: 00007FFB24BD6951

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProcwcsncmp
String ID: api-ms-
API String ID: 916704608-2084034818
Opcode ID: 45bb9c456b18d615664943834e4003b355ea3ec7f5874fc1f64106649d67ca5c
Instruction ID: b44a165fa87099ba85b9d82c2a55e1eb0ef4c565923e17005353e437bdcece7c
Opcode Fuzzy Hash: 45bb9c456b18d615664943834e4003b355ea3ec7f5874fc1f64106649d67ca5c
Instruction Fuzzy Hash: D431DF69B0A681D1EE178B32DD881AC3294BB58FA0F594135DD1D06B8ADF3CE5458700

Function 00007FF6869C7B40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF6869C3699), ref: 00007FF6869C7B81

Part of subcall function 00007FF6869C2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6869C7744,?,?,?,?,?,?,?,?,?,?,?,00007FF6869C101D), ref: 00007FF6869C2654
Part of subcall function 00007FF6869C2620: MessageBoxW.USER32 ref: 00007FF6869C272C

WideCharToMultiByte.KERNEL32(?,00007FF6869C3699), ref: 00007FF6869C7BF5

Strings

Failed to encode wchar_t as UTF-8., xrefs: 00007FF6869C7BFF
win32_utils_to_utf8, xrefs: 00007FF6869C7BC2
Failed to get UTF-8 buffer size., xrefs: 00007FF6869C7B8E
Out of memory., xrefs: 00007FF6869C7BBB
WideCharToMultiByte, xrefs: 00007FF6869C7B95, 00007FF6869C7C06

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: aced5f46d53ba3e30c592e5434d0d7ab1f54160dd14b943fd141642a19c75b6b
Instruction ID: 0e6415bdf981e6651d9d08d5523d0540f31ba27183a7b3bfc18f44f97b668878
Opcode Fuzzy Hash: aced5f46d53ba3e30c592e5434d0d7ab1f54160dd14b943fd141642a19c75b6b
Instruction Fuzzy Hash: CE218B21A08B83C5EE109F22A8411797661BF84B90F48453EDA9E877D6EFBEED41C300

Function 00007FFB24BD25E8 Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD26A0
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD26BE
__AdjustPointer.LIBCMT ref: 00007FFB24BD26FF
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD270C
__AdjustPointer.LIBCMT ref: 00007FFB24BD2748
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD275D
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD27A2
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD27A9

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: d386002f74db6febb42ef9b4bac4e43e25a554ab645870d9c47f674d5a84533b
Instruction ID: 0d7140ad0db4cac8471afabbb621e3b259b31aeeab4974afb646107602aafef4
Opcode Fuzzy Hash: d386002f74db6febb42ef9b4bac4e43e25a554ab645870d9c47f674d5a84533b
Instruction Fuzzy Hash: F0515CA9E0A6C2C1EA6B9B31DDCC63C7394AF54B84F4544B5CA4D0AB97DE2CE8428301

Function 00007FFB24BD27CC Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD2886
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD28A5
__AdjustPointer.LIBCMT ref: 00007FFB24BD28E6
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD28F3
__AdjustPointer.LIBCMT ref: 00007FFB24BD292F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD2944
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD2989
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD2990

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: ad7bbbe6b4c289a22ae1e43e79ef4439cf3ee9b14764b2eff01f06dd25f3f236
Instruction ID: e78f3776f9507e37a89ed0622627f815bbe51a2f6cd150d54c7a156e5c28d296
Opcode Fuzzy Hash: ad7bbbe6b4c289a22ae1e43e79ef4439cf3ee9b14764b2eff01f06dd25f3f236
Instruction Fuzzy Hash: F85174A9E096C3C1EA6F9B75DDCC23C7794AF54B90F0944B5D94D0AB8BDE2DD4428301

Function 00007FF6869D9264 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D92A7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D9694
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D9930

Strings

p, xrefs: 00007FF6869D93D1
p, xrefs: 00007FF6869D9359
f, xrefs: 00007FF6869D93C9

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction ID: a96dcb0d4494875c93fdbcf7cd4024e1224f9d98fd82ceae0567bdbadeedb9d8
Opcode Fuzzy Hash: 8b43f30c9b627f105c9440690760d813b6cbc2015482011a3dd154e3df4de9b0
Instruction Fuzzy Hash: 3B126B62E0C183C6FF24BA55E0542B97691FF80B54F944039E69A876CADF3EED80CB50

Function 00007FFB24BD5520 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 132COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFB24BD55E9
_local_unwind.LIBVCRUNTIME ref: 00007FFB24BD568C

Strings

RCC, xrefs: 00007FFB24BD556E
csm, xrefs: 00007FFB24BD56D0
csm, xrefs: 00007FFB24BD5584
MOC, xrefs: 00007FFB24BD5562

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: FileHeader_local_unwind
String ID: MOC$RCC$csm$csm
API String ID: 2627209546-1441736206
Opcode ID: 385ada566cdd30ad99b7ac5e1d5c8025a7264eea7c22efa234297d7bd0e399d8
Instruction ID: 154b267cdf3871e861c23d67fe10ad40f550a317b912e2efe67e0e37ec036e4b
Opcode Fuzzy Hash: 385ada566cdd30ad99b7ac5e1d5c8025a7264eea7c22efa234297d7bd0e399d8
Instruction Fuzzy Hash: 62518FBAE09691C6EB629F35DC8837D36A0EF84B98F540071DE4D02B8BDE3CE4418B01

Function 00007FF6869C7C30 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7CC5
MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7D07

Strings

Failed to get wchar_t buffer size., xrefs: 00007FF6869C7D46
MultiByteToWideChar, xrefs: 00007FF6869C7D4D
Failed to decode wchar_t from UTF-8, xrefs: 00007FF6869C7D2D
win32_utils_from_utf8, xrefs: 00007FF6869C7D3D
Out of memory., xrefs: 00007FF6869C7D36

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 626452242-876015163
Opcode ID: b7b82ea576924ca1617b662870f2c7e243fa9a5b0eddeb3ea6719f1292c4487d
Instruction ID: 44916e53939b998e8b0cba986ac7e26fc6889c3c25040a2eb5644fbf58a520fb
Opcode Fuzzy Hash: b7b82ea576924ca1617b662870f2c7e243fa9a5b0eddeb3ea6719f1292c4487d
Instruction Fuzzy Hash: BA414D32A08A83C2EA50DF15A44017966A5FF44B90F54513ADB9E8BBE6EF3DD852C700

Function 00007FFB24BDD740 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFB24BDCE14), ref: 00007FFB24BDD803
DName::DName.LIBVCRUNTIME ref: 00007FFB24BDD822

Strings

void, xrefs: 00007FFB24BDD786
`template-parameter, xrefs: 00007FFB24BDD830

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: NameName::atol
String ID: `template-parameter$void
API String ID: 2130343216-4057429177
Opcode ID: 2821a58495c29764098872c6b010649cccddcb6c42941e500fb92a9452cac6b1
Instruction ID: 70f7c38e193b61955d9ec58e4af0a37a53dff4a10f9dd14e35540f338f051fa3
Opcode Fuzzy Hash: 2821a58495c29764098872c6b010649cccddcb6c42941e500fb92a9452cac6b1
Instruction Fuzzy Hash: 81414AA9F08B96C8FB069B74DC982AC33B1BB44B84F940175CE4D16E56DF38A406C340

Function 00007FF6869CCEE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6869CD19A,?,?,?,00007FF6869CCE8C,?,?,00000001,00007FF6869CCAA9), ref: 00007FF6869CCF6D
GetLastError.KERNEL32(?,?,?,00007FF6869CD19A,?,?,?,00007FF6869CCE8C,?,?,00000001,00007FF6869CCAA9), ref: 00007FF6869CCF7B
LoadLibraryExW.KERNEL32(?,?,?,00007FF6869CD19A,?,?,?,00007FF6869CCE8C,?,?,00000001,00007FF6869CCAA9), ref: 00007FF6869CCFA5
FreeLibrary.KERNEL32(?,?,?,00007FF6869CD19A,?,?,?,00007FF6869CCE8C,?,?,00000001,00007FF6869CCAA9), ref: 00007FF6869CCFEB
GetProcAddress.KERNEL32(?,?,?,00007FF6869CD19A,?,?,?,00007FF6869CCE8C,?,?,00000001,00007FF6869CCAA9), ref: 00007FF6869CCFF7

Strings

api-ms-, xrefs: 00007FF6869CCF8D

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 46f8882ba5516ded8d0f67aa9085a497a0d646e74245b223b6bb25c85e55adca
Instruction ID: bbb9c3032bee128a5ba59f16534db5e3efb5c7a8733a0c745b01688d9e528c9a
Opcode Fuzzy Hash: 46f8882ba5516ded8d0f67aa9085a497a0d646e74245b223b6bb25c85e55adca
Instruction Fuzzy Hash: CD31E221A0AA83D5FE61DB06A40067427D4FF08BA4F49453DED1E8A3D2DF3EE845D700

Function 00007FF6869C6480 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6869C7A30: MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7A6A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF6869C67CF,?,00000000,?,TokenIntegrityLevel), ref: 00007FF6869C64DF

Part of subcall function 00007FF6869C2770: MessageBoxW.USER32 ref: 00007FF6869C2841

Strings

LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6869C64B6
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6869C64F3
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6869C653A

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: 2dc19ef5ba30c1755b370eb24f27a07330b7d4ecbeaa7c6206d14ea3a4c7ebc1
Instruction ID: 211546259d5930b174fa4072088a24e1c9dad8520c3b73b1a569c00bdd5ffada
Opcode Fuzzy Hash: 2dc19ef5ba30c1755b370eb24f27a07330b7d4ecbeaa7c6206d14ea3a4c7ebc1
Instruction Fuzzy Hash: 3C316021B1C7C3C1FE21AB21A5553BA5291BF98780F84443ADA4FC66DBEE2EED04C700

Function 00007FFB24BD8624 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD86DB

Strings

void, xrefs: 00007FFB24BD8759
<ellipsis>, xrefs: 00007FFB24BD8734
..., xrefs: 00007FFB24BD8724
,<ellipsis>, xrefs: 00007FFB24BD86B8
,..., xrefs: 00007FFB24BD86A8

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: Name::operator+
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 2943138195-2211150622
Opcode ID: 16d5b7056506ac1aa3be62c87a897449e0af35361c1a5b370ad614f7e7c3f2e7
Instruction ID: 4144d1aced2d1b193277e7136afa28cc33431c36322782a0d0272920ab827f42
Opcode Fuzzy Hash: 16d5b7056506ac1aa3be62c87a897449e0af35361c1a5b370ad614f7e7c3f2e7
Instruction Fuzzy Hash: D9413BBAE18B86C8FB028B38DDC81AC37B4BB48B08F844175DA5D16B56DF3CA546C740

Function 00007FFB24BDA31C Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDA40F

Strings

int , xrefs: 00007FFB24BDA38D
short , xrefs: 00007FFB24BDA39C
unsigned , xrefs: 00007FFB24BDA3E3
char , xrefs: 00007FFB24BDA3A5
long , xrefs: 00007FFB24BDA37E

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: Name::operator+
String ID: char $int $long $short $unsigned
API String ID: 2943138195-3894466517
Opcode ID: 1a667bf595c3f0eddcec5e75b1b20bf055c895b242c78c01af1086ecda962d52
Instruction ID: b03fe65b89aba1d1d93a7609eb50ccceb38b1fafea11811665ada3ac1ef4206d
Opcode Fuzzy Hash: 1a667bf595c3f0eddcec5e75b1b20bf055c895b242c78c01af1086ecda962d52
Instruction Fuzzy Hash: 77414CBAE18A96C9EB168F78DC881BC37B2BB4A754F848175CA0C16F5ADF2C9545C700

Function 00007FF6869C7A30 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7A6A

Part of subcall function 00007FF6869C2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6869C7744,?,?,?,?,?,?,?,?,?,?,?,00007FF6869C101D), ref: 00007FF6869C2654
Part of subcall function 00007FF6869C2620: MessageBoxW.USER32 ref: 00007FF6869C272C

MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7AF0

Strings

Failed to get wchar_t buffer size., xrefs: 00007FF6869C7A77
MultiByteToWideChar, xrefs: 00007FF6869C7A7E, 00007FF6869C7B01
Failed to decode wchar_t from UTF-8, xrefs: 00007FF6869C7AFA
win32_utils_from_utf8, xrefs: 00007FF6869C7AB9
Out of memory., xrefs: 00007FF6869C7AB2

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: a067ef3949ab1c43b8cad70a8c207a907739284b21da8d2c9820fdf83144c31f
Instruction ID: bdfdb10566961ccc46bb778b9362552f6f61e686f08c5cf040d876fdf01faed9
Opcode Fuzzy Hash: a067ef3949ab1c43b8cad70a8c207a907739284b21da8d2c9820fdf83144c31f
Instruction Fuzzy Hash: 0D214122B08A83C1EF50CB29F401169A361FF98794F584539DB5DD7BAAEE6DD941C700

Function 00007FF6869DA620 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F,?,?,?,00007FF6869D9313), ref: 00007FF6869DA62F
FlsGetValue.KERNEL32(?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F,?,?,?,00007FF6869D9313), ref: 00007FF6869DA644
FlsSetValue.KERNEL32(?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F,?,?,?,00007FF6869D9313), ref: 00007FF6869DA665
FlsSetValue.KERNEL32(?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F,?,?,?,00007FF6869D9313), ref: 00007FF6869DA692
FlsSetValue.KERNEL32(?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F,?,?,?,00007FF6869D9313), ref: 00007FF6869DA6A3
FlsSetValue.KERNEL32(?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F,?,?,?,00007FF6869D9313), ref: 00007FF6869DA6B4
SetLastError.KERNEL32(?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F,?,?,?,00007FF6869D9313), ref: 00007FF6869DA6CF

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 6b14f4b34ada3312421ba959f39f9715d9be68c8868fa5de67aefdf45a5e0ce4
Instruction ID: ece477d59959cdede41b8ff40de3083e6623be3e49112ee5f8df792e2b848621
Opcode Fuzzy Hash: 6b14f4b34ada3312421ba959f39f9715d9be68c8868fa5de67aefdf45a5e0ce4
Instruction Fuzzy Hash: 6F213820B0C2C3C6FE58A729A65513D62427F44BB4F54063CE83E87ADBDE6EAC21C700

Function 00007FF6869E706C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6869E709D
GetLastError.KERNEL32 ref: 00007FF6869E70A9
CloseHandle.KERNEL32 ref: 00007FF6869E70C1
CreateFileW.KERNEL32 ref: 00007FF6869E70EC
WriteConsoleW.KERNEL32 ref: 00007FF6869E710B

Strings

CONOUT$, xrefs: 00007FF6869E70CD

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 1a41989b306c04176fbb8ce5d038fb17b2eb18ca34d01c5ff4cda60dd112554e
Instruction ID: 4cfeb9e46bd16a98249ccfbb4e13b428a17b834ced2703a599a15c012f6961ba
Opcode Fuzzy Hash: 1a41989b306c04176fbb8ce5d038fb17b2eb18ca34d01c5ff4cda60dd112554e
Instruction Fuzzy Hash: CE115121A18A82C6EB508B56E85432972A4FF88BE5F454238EA5DC77E5CFBDDD04C740

Function 00007FFB24BD62D0 Relevance: 9.1, APIs: 6, Instructions: 84stringCOMMON

Download Yara Rule

APIs

__unDName.LIBVCRUNTIME ref: 00007FFB24BD6326
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFB24BD6369
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFB24BD6393
InterlockedPushEntrySList.KERNEL32 ref: 00007FFB24BD63B0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFB24BD63BC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFB24BD63C5

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: free$EntryInterlockedListNamePush__unmallocstrcpy_s
String ID:
API String ID: 3741236498-0
Opcode ID: 6447550c70440ae48e9dc09acfbe7fa3055870e3a5d625089a78ddc05dba8847
Instruction ID: 62109d0d4b4b96491f073502833a3beac00630aac19d071c1d80af2780a6f01e
Opcode Fuzzy Hash: 6447550c70440ae48e9dc09acfbe7fa3055870e3a5d625089a78ddc05dba8847
Instruction Fuzzy Hash: 0931A369B19791C0EA168B3AEC4856D3390FB49FE4B554575DD1D03B82EE3DD452C300

Function 00007FF6869DA798 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6869D444D,?,?,?,?,00007FF6869DDDA7,?,?,00000000,00007FF6869DA8B6,?,?,?), ref: 00007FF6869DA7A7
FlsSetValue.KERNEL32(?,?,?,00007FF6869D444D,?,?,?,?,00007FF6869DDDA7,?,?,00000000,00007FF6869DA8B6,?,?,?), ref: 00007FF6869DA7DD
FlsSetValue.KERNEL32(?,?,?,00007FF6869D444D,?,?,?,?,00007FF6869DDDA7,?,?,00000000,00007FF6869DA8B6,?,?,?), ref: 00007FF6869DA80A
FlsSetValue.KERNEL32(?,?,?,00007FF6869D444D,?,?,?,?,00007FF6869DDDA7,?,?,00000000,00007FF6869DA8B6,?,?,?), ref: 00007FF6869DA81B
FlsSetValue.KERNEL32(?,?,?,00007FF6869D444D,?,?,?,?,00007FF6869DDDA7,?,?,00000000,00007FF6869DA8B6,?,?,?), ref: 00007FF6869DA82C
SetLastError.KERNEL32(?,?,?,00007FF6869D444D,?,?,?,?,00007FF6869DDDA7,?,?,00000000,00007FF6869DA8B6,?,?,?), ref: 00007FF6869DA847

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: de2209737f62c3ef05340c1457763ccac6bfd4de9bf3f87891e85fc6fda23dbb
Instruction ID: 4b4bb2676ddba638a4b37d52e88cdb0656d3cd592af1f9b3a22d44298cfe5015
Opcode Fuzzy Hash: de2209737f62c3ef05340c1457763ccac6bfd4de9bf3f87891e85fc6fda23dbb
Instruction Fuzzy Hash: 41113B30F0C2C3C6FE586725AA4117961527F44BB0F04463CE82E876DBDE6EAC22C710

Function 00007FFB24BD38A8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 189COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB24BD6710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFB24BD239E), ref: 00007FFB24BD671E

EncodePointer.KERNEL32 ref: 00007FFB24BD3918
_CallSETranslator.LIBVCRUNTIME ref: 00007FFB24BD3963
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD3B91

Strings

MOC, xrefs: 00007FFB24BD392C
RCC, xrefs: 00007FFB24BD3934

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 63425386b35f735f5eb303e83bfbe55818570f32e5447e3767ff35a3eaf3afb3
Instruction ID: e794848079adad06f83fcbc15049eb42e12c0951a4e8bb8066b6b8b421689c47
Opcode Fuzzy Hash: 63425386b35f735f5eb303e83bfbe55818570f32e5447e3767ff35a3eaf3afb3
Instruction Fuzzy Hash: 9D918EB7A08785CAE712CB75E8842AD7BA0FB44788F14412AEE8D17B5ADF3CD195C700

Function 00007FFB24BDBB70 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDBC50

Part of subcall function 00007FFB24BD8C24: DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD913D
Part of subcall function 00007FFB24BD8C24: DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD9175

Strings

std::nullptr_t, xrefs: 00007FFB24BDBDF1
std::nullptr_t , xrefs: 00007FFB24BDBDC5
volatile , xrefs: 00007FFB24BDBBD3, 00007FFB24BDBD21
volatile, xrefs: 00007FFB24BDBBE2, 00007FFB24BDBD30

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: Name::operator+
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2943138195-757766384
Opcode ID: 8ec89114dc1e92fb087ff84a90b975bd849231731579a14e6ae3ff20f009c8f1
Instruction ID: 90ea155aae3e9571e19d9cb395ed2ab0596ae4d5f6e5d8bacea5a29480b68e80
Opcode Fuzzy Hash: 8ec89114dc1e92fb087ff84a90b975bd849231731579a14e6ae3ff20f009c8f1
Instruction Fuzzy Hash: 57714CFAA0CA86C4EB168F34DDC81BC76A4BB15B84F844575DA5E06E9ADF3CE251C300

Function 00007FFB24BD3690 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB24BD6710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFB24BD239E), ref: 00007FFB24BD671E

EncodePointer.KERNEL32 ref: 00007FFB24BD36DC
_CallSETranslator.LIBVCRUNTIME ref: 00007FFB24BD372B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD389F

Strings

RCC, xrefs: 00007FFB24BD36F9
MOC, xrefs: 00007FFB24BD36F0

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: bda6881e4fb6ddd96fb50e60b72b5d1eaa618bcc944dda4a5bc0b193bb5b3b27
Instruction ID: 9b2aa4ab770d2f07ea81335bfb1796ab99c25f54c4e9f6b30fb513a328ae45f1
Opcode Fuzzy Hash: bda6881e4fb6ddd96fb50e60b72b5d1eaa618bcc944dda4a5bc0b193bb5b3b27
Instruction Fuzzy Hash: A96166BBA08A85CAE7268F75D8847AD77A0FB44B88F045175EE4D13B5ACF78E055C700

Function 00007FF6869CC8A8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6869CC8D3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6869CC968
RtlUnwindEx.KERNEL32 ref: 00007FF6869CC9B7

Strings

f, xrefs: 00007FF6869CC8E6
csm, xrefs: 00007FF6869CC94E

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 42fbbb83cedbe148bfcc1de87ea3e914151e174f0a46670c6939306692d2d31c
Instruction ID: c90eca7a9b005616e058376d9a00c63bd52cdf54d878512b52edc02a1a9f5295
Opcode Fuzzy Hash: 42fbbb83cedbe148bfcc1de87ea3e914151e174f0a46670c6939306692d2d31c
Instruction Fuzzy Hash: 8F515D32A19683C6EF14CB15E404B292B95FF84B98F558138DA4B877CADE7AED41C704

Function 00007FF6869C2240 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF6869C242F), ref: 00007FF6869C2278
DialogBoxIndirectParamW.USER32 ref: 00007FF6869C233C
DeleteObject.GDI32 ref: 00007FF6869C236F
DestroyIcon.USER32 ref: 00007FF6869C2381

Strings

Unhandled exception in script, xrefs: 00007FF6869C22A8

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: fcf731bf2ceca6e070dbdbaa780c49a73cf052ed135755c936a54f607c2ce467
Instruction ID: 45f8982eae29a4ee10a04d3992fc7989e800afaf002ebdc46c46ec770681cefc
Opcode Fuzzy Hash: fcf731bf2ceca6e070dbdbaa780c49a73cf052ed135755c936a54f607c2ce467
Instruction Fuzzy Hash: 5D314032A096C3C9EF24DF61E8552E96360FF88B94F440139EA4E8BA96DF7DD945C700

Function 00007FF6869C2620 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6869C7744,?,?,?,?,?,?,?,?,?,?,?,00007FF6869C101D), ref: 00007FF6869C2654

Part of subcall function 00007FF6869C74B0: GetLastError.KERNEL32(00000000,00007FF6869C26A0), ref: 00007FF6869C74D7
Part of subcall function 00007FF6869C74B0: FormatMessageW.KERNEL32(00000000,00007FF6869C26A0), ref: 00007FF6869C7506

Part of subcall function 00007FF6869C7A30: MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7A6A

MessageBoxW.USER32 ref: 00007FF6869C272C
MessageBoxA.USER32 ref: 00007FF6869C2748

Strings

%s%s: %s, xrefs: 00007FF6869C26AD
Fatal error detected, xrefs: 00007FF6869C2700, 00007FF6869C273A

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: bd2085b38ade222d48c53e4b242a54a19eedc60d0d0276a39b8304b5fd6b5430
Instruction ID: a795bd3ae84f8295e75a048542b5d8d81aebf6f9b372a5db8fab28017994bc99
Opcode Fuzzy Hash: bd2085b38ade222d48c53e4b242a54a19eedc60d0d0276a39b8304b5fd6b5430
Instruction Fuzzy Hash: 91314372628AC3D1EB209B11E4517EA6364FF84794F40403AE68E876DADF7DDB05CB40

Function 00007FF6869D88E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6869D8905
GetProcAddress.KERNEL32 ref: 00007FF6869D891B
FreeLibrary.KERNEL32 ref: 00007FF6869D8942

Strings

mscoree.dll, xrefs: 00007FF6869D88FC
CorExitProcess, xrefs: 00007FF6869D8914

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 611779d08fafb8db9f6fab045cd04065641a8af0ffd245d6ff06f44facfa83ea
Instruction ID: 9632cce19e2929d99617a2dc5a42b04faf92f32887ac1b3eac2aacaf03a4b974
Opcode Fuzzy Hash: 611779d08fafb8db9f6fab045cd04065641a8af0ffd245d6ff06f44facfa83ea
Instruction Fuzzy Hash: 24F0C271A19A83C1EF108B64E4443391320BF857B1F45023DD5AD8A2F6DF6ED848C340

Function 00007FFB24BD9FA4 Relevance: 7.6, APIs: 5, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFB24BDA01D
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDA03F
DName::DName.LIBVCRUNTIME ref: 00007FFB24BDA052
DName::DName.LIBVCRUNTIME ref: 00007FFB24BDA089
DName::DName.LIBVCRUNTIME ref: 00007FFB24BDA094

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: NameName::$Name::operator+
String ID:
API String ID: 826178784-0
Opcode ID: 7682a6ebcb32bf14f43659220100a1b4a5a4a6e3db385e7ce84af32120df353b
Instruction ID: fb2fe1b049e27b403133bfd1100fba02ebc0e22858b82a22fbc269bdd9256ece
Opcode Fuzzy Hash: 7682a6ebcb32bf14f43659220100a1b4a5a4a6e3db385e7ce84af32120df353b
Instruction Fuzzy Hash: 754161BAB08A96C4E712CB31DDD81BC37A4BB5AB80B944072DA5D53B96DF38E556C300

Function 00007FF6869E87A4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6869E87CC
_set_statfp.LIBCMT ref: 00007FF6869E87E7
_set_statfp.LIBCMT ref: 00007FF6869E8803
_set_statfp.LIBCMT ref: 00007FF6869E883F

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction ID: 98c1f238f0251762a9ed4d43b6dfb64728edccf0f167f4d9a9ebc168e7bb5ba5
Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
Instruction Fuzzy Hash: EE11C122E2CA87C1FE9521E4E65137514417F583B4F86063CED7E8E6D7CEAEAC41C140

Function 00007FF6869DA860 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6869D9A73,?,?,00000000,00007FF6869D9D0E,?,?,?,?,?,00007FF6869D21EC), ref: 00007FF6869DA87F
FlsSetValue.KERNEL32(?,?,?,00007FF6869D9A73,?,?,00000000,00007FF6869D9D0E,?,?,?,?,?,00007FF6869D21EC), ref: 00007FF6869DA89E
FlsSetValue.KERNEL32(?,?,?,00007FF6869D9A73,?,?,00000000,00007FF6869D9D0E,?,?,?,?,?,00007FF6869D21EC), ref: 00007FF6869DA8C6
FlsSetValue.KERNEL32(?,?,?,00007FF6869D9A73,?,?,00000000,00007FF6869D9D0E,?,?,?,?,?,00007FF6869D21EC), ref: 00007FF6869DA8D7
FlsSetValue.KERNEL32(?,?,?,00007FF6869D9A73,?,?,00000000,00007FF6869D9D0E,?,?,?,?,?,00007FF6869D21EC), ref: 00007FF6869DA8E8

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: daef540501b22c12116ffc374b0892d30f9c5b790841e2ef32b7e795c096c5e6
Instruction ID: 97a706f6f50e4edfd3735707793969674984d4f56940fa6fb7249e3a5a1f9330
Opcode Fuzzy Hash: daef540501b22c12116ffc374b0892d30f9c5b790841e2ef32b7e795c096c5e6
Instruction Fuzzy Hash: B0112930F0C2C385FE58A726AA4117A62457F447B0E04463CE93E866D7DE2EAC62C711

Function 00007FF6869DA6F4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F), ref: 00007FF6869DA705
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F), ref: 00007FF6869DA724
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F), ref: 00007FF6869DA74C
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F), ref: 00007FF6869DA75D
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF6869E2433,?,?,?,00007FF6869DCB8C,?,?,00000000,00007FF6869D3A5F), ref: 00007FF6869DA76E

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 73fca214f1e943932ff67b95d9a940e5d6c6a0bd2e4835b222ff28ae142fb13c
Instruction ID: d0ac504a9255f30b9c725926041b77177e5e0caed2dc1baed0341d437d289319
Opcode Fuzzy Hash: 73fca214f1e943932ff67b95d9a940e5d6c6a0bd2e4835b222ff28ae142fb13c
Instruction Fuzzy Hash: A511D624F0D283D5FE58A725981217A22967F45774F140B3CE93E8A2DBDE2EBC61C311

Function 00007FF6869DF198 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869DF477

Part of subcall function 00007FF6869E5474: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E5491

Strings

UTF-8, xrefs: 00007FF6869DF3F6
UTF-16LEUNICODE, xrefs: 00007FF6869DF415
ccs, xrefs: 00007FF6869DF3B2

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: e657aeb740c2ac826b77e83addb2cc82262a2e6e3b5be7210a8d66ad85871f1f
Instruction ID: dea5d836526d7f32542a13b1b3bd3c0257a6f2339b2220473f637304729b08c6
Opcode Fuzzy Hash: e657aeb740c2ac826b77e83addb2cc82262a2e6e3b5be7210a8d66ad85871f1f
Instruction Fuzzy Hash: CC817D76E086C3C5EF645E29821627866A0BF11BC8F568039DA0DD76D7DF2FED02D242

Function 00007FFB24BD4044 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB24BD6710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFB24BD239E), ref: 00007FFB24BD671E

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD41C3

Strings

csm, xrefs: 00007FFB24BD41FD
csm, xrefs: 00007FFB24BD4093
, xrefs: 00007FFB24BD4114

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: abort
String ID: $csm$csm
API String ID: 4206212132-1512788406
Opcode ID: a1e41bd14f4dc8a012b9b6851bae8dba3a2639313cd67671a1d4b299b7556132
Instruction ID: f3ab1c0592c8a04f8a61a7ae6b8bb166b8ad36e22faa52a4d9585049ac0b7fcc
Opcode Fuzzy Hash: a1e41bd14f4dc8a012b9b6851bae8dba3a2639313cd67671a1d4b299b7556132
Instruction Fuzzy Hash: C8719FBA9086D1C6DB6A8F35D88877D7BA1FB44B88F148175DF8C07E8ACA2CD461C741

Function 00007FF6869CE108 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6869CE154
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6869CE1A3

Strings

RCC, xrefs: 00007FF6869CE171
MOC, xrefs: 00007FF6869CE168

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: e66b2a899b3be21a272ca3efbe1e1fab7eec351de36f73ff2a6cc06a45c4f2b1
Instruction ID: fff2bc78147d69bd18f4cf5fbbf11df836cd58d6b1147b4cf610286a91cd6065
Opcode Fuzzy Hash: e66b2a899b3be21a272ca3efbe1e1fab7eec351de36f73ff2a6cc06a45c4f2b1
Instruction Fuzzy Hash: EE613D37A08B86C6EB10CF69E4803AD77A0FB44B88F144229DE4E57B96DF79E955C700

Function 00007FF6869CE464 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6869CE48C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6869CE574

Strings

csm, xrefs: 00007FF6869CE4AE
csm, xrefs: 00007FF6869CE5C6

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 37bca86698e542f9df3f1c5971c843800452ce466371b2576d682bdca002ed1e
Instruction ID: 157fd54d32650b1124cd0de8053910a0ab0ddfb52b357d1d642059d4dc686bd9
Opcode Fuzzy Hash: 37bca86698e542f9df3f1c5971c843800452ce466371b2576d682bdca002ed1e
Instruction Fuzzy Hash: 22516B329186C3C6EF748B19A24426876A0BF54B98F144139EB9F87BD6CF3DE851CB00

Function 00007FFB24BD3E1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB24BD6710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFB24BD239E), ref: 00007FFB24BD671E

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD3F13
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFB24BD3F23

Strings

csm, xrefs: 00007FFB24BD3F75
csm, xrefs: 00007FFB24BD3E66

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: Frameabort$EmptyHandler3::StateUnwind
String ID: csm$csm
API String ID: 4108983575-3733052814
Opcode ID: 723d316c6bb1492db26d318ced58129fbbb71e04f86aecbd325fb3d3c805e488
Instruction ID: bfa8ac03e69ad69f7df4f87b14b87833129e51b631daa203e73e49c32a62c2e0
Opcode Fuzzy Hash: 723d316c6bb1492db26d318ced58129fbbb71e04f86aecbd325fb3d3c805e488
Instruction Fuzzy Hash: 5A516BBA9086C2C6EA6A8B31D88826C76A0FB50B84F185176DB8D47ED7CF7CE451C700

Function 00007FFB24BDA714 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFB24BDA778

Strings

%lf, xrefs: 00007FFB24BDA7BE

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: NameName::
String ID: %lf
API String ID: 1333004437-2891890143
Opcode ID: f37b8968dc856f8c22d72c120ca4476383f363961e161f929d9d255907aecf6d
Instruction ID: 9493546766ced60c2c5d8f12b6c943a2017d9f155a3fd6bff2619d061e14c8b4
Opcode Fuzzy Hash: f37b8968dc856f8c22d72c120ca4476383f363961e161f929d9d255907aecf6d
Instruction Fuzzy Hash: 533184AAA0CAC5C5EB22CB34ED9427D7760FB89B84F848171E99D47A47CF3CD5428740

Function 00007FF6869C24D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6869C7A30: MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7A6A

MessageBoxW.USER32 ref: 00007FF6869C25D7
MessageBoxA.USER32 ref: 00007FF6869C25F3

Strings

%s%s: %s, xrefs: 00007FF6869C2558
Fatal error detected, xrefs: 00007FF6869C25AB, 00007FF6869C25E5

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 1ad8658de8dbd2e7b08889bff9c9537d6e44ae678795f4b96bc9f189f6c45e5f
Instruction ID: 6b9ae77ebcc3041d8ea54aa4f0e416c000911eee618bbda18a9c92c78883b683
Opcode Fuzzy Hash: 1ad8658de8dbd2e7b08889bff9c9537d6e44ae678795f4b96bc9f189f6c45e5f
Instruction Fuzzy Hash: 61314172628AC3D1EA20DB11E4517EA6364FF84794F80403AEA8D876DADE7DDA45CB40

Function 00007FF6869C3BA0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF6869C3699), ref: 00007FF6869C3BD1

Part of subcall function 00007FF6869C2620: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6869C7744,?,?,?,?,?,?,?,?,?,?,?,00007FF6869C101D), ref: 00007FF6869C2654
Part of subcall function 00007FF6869C2620: MessageBoxW.USER32 ref: 00007FF6869C272C

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF6869C3C0A
GetModuleFileNameW, xrefs: 00007FF6869C3BE2
Failed to get executable path., xrefs: 00007FF6869C3BDB

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: fe87d08da65b513e87772ab3e16eb14927cda1b8744753a26f3e7d7b1799e4b8
Instruction ID: c7d30d38b17b5b97308c0a3f614f5726d0ee270d3fa06f5c76a17cf4f67fbedd
Opcode Fuzzy Hash: fe87d08da65b513e87772ab3e16eb14927cda1b8744753a26f3e7d7b1799e4b8
Instruction Fuzzy Hash: 65014F21B1CAC3C1FE619B20E8563B92295BF58794F40103ED94FCA6D7EE9EEA45D700

Function 00007FFB24BD2400 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB24BD6710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFB24BD239E), ref: 00007FFB24BD671E

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD243E

Strings

MOC, xrefs: 00007FFB24BD2418
RCC, xrefs: 00007FFB24BD2410
csm, xrefs: 00007FFB24BD2420

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: abortterminate
String ID: MOC$RCC$csm
API String ID: 661698970-2671469338
Opcode ID: b838753ef247b2fc749e3877e0128dea9035de62b0ba29f15289213c97603889
Instruction ID: a79d5a8399d4d4998b519700dab374032f6111fdb61674513767841ceffedf89
Opcode Fuzzy Hash: b838753ef247b2fc749e3877e0128dea9035de62b0ba29f15289213c97603889
Instruction Fuzzy Hash: 8AF04F7A9186C6C1EB555F75E9C916D3664FB88B40F0960B1DB4807A53CF3CD4A1CB41

Function 00007FFB24BDE9E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__C_specific_handler.LIBVCRUNTIME ref: 00007FFB24BDE9F0

Part of subcall function 00007FFB24BDEC30: _IsNonwritableInCurrentImage.LIBCMT ref: 00007FFB24BDECF0
Part of subcall function 00007FFB24BDEC30: RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FFB24BDE9F5), ref: 00007FFB24BDED3F

Part of subcall function 00007FFB24BD6710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFB24BD239E), ref: 00007FFB24BD671E

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BDEA1A

Strings

f, xrefs: 00007FFB24BDE9F5
csm, xrefs: 00007FFB24BDE9FB

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: C_specific_handlerCurrentImageNonwritableUnwindabortterminate
String ID: csm$f
API String ID: 2451123448-629598281
Opcode ID: c9fb23446a5b638453e0304dd207887769bfaeb8010eb75ee95ffcfd07f137de
Instruction ID: daf77a7b91a5d1eb6602e3dc07e72930e54af34f9163cb5a3e73ef5ef7536409
Opcode Fuzzy Hash: c9fb23446a5b638453e0304dd207887769bfaeb8010eb75ee95ffcfd07f137de
Instruction Fuzzy Hash: 06E0E5BDD18AC6C0E7226B70F9C813C36A0BF14B50F1490B4DA4807A47CF3CE4A18301

Function 00007FF6869DBA70 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6869DBAEF
WriteFile.KERNEL32 ref: 00007FF6869DBDB7
WriteFile.KERNEL32 ref: 00007FF6869DBDFD
GetLastError.KERNEL32 ref: 00007FF6869DBEB3

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: f750311aff661a04a86bbbada4284786bf27b8065a17484a8f486471230e888d
Instruction ID: 0b81d6ea8600c74eb9049009ca2889d4c82c8e42b04c0a4bba3986407ce612a7
Opcode Fuzzy Hash: f750311aff661a04a86bbbada4284786bf27b8065a17484a8f486471230e888d
Instruction Fuzzy Hash: 2FD1D372B18A86C9EB10CF75D4502BC37A2FB44798B44423ACE5E97BDADE39D816C740

Function 00007FF6869DC430 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF6869DC41B), ref: 00007FF6869DC54C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF6869DC41B), ref: 00007FF6869DC5D7

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: f410d9e07cb2d854853af875ff306a0e9c9ee922f70c4cde11a48ef332fbc2ec
Instruction ID: a9441e32a3afeeca4ddadcb5b85b1b15deb759aef26ec62ca785a7e1ea7d543a
Opcode Fuzzy Hash: f410d9e07cb2d854853af875ff306a0e9c9ee922f70c4cde11a48ef332fbc2ec
Instruction Fuzzy Hash: BE918C62A18693C5FB608F6594403BD2BA9BF44BC8F54513DDA0EA7AD6DF3AD842C700

Function 00007FFB24BD9CC0 Relevance: 6.2, APIs: 4, Instructions: 193COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFB24BDC3C8: DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC459
Part of subcall function 00007FFB24BDC3C8: DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC492
Part of subcall function 00007FFB24BDC3C8: DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC7BB

DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD9E19
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD9E78
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD9EAA
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD9EBA

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: f50f9f5b0f4c072e52125a456639a7d4e2bd829a5a5137cb56b4f6bb80237050
Instruction ID: 033228c355ef745ab01a41bf220a1b570d41b824157a336ac073cbc0e2700299
Opcode Fuzzy Hash: f50f9f5b0f4c072e52125a456639a7d4e2bd829a5a5137cb56b4f6bb80237050
Instruction Fuzzy Hash: 85916EAAE08796C9F7168B74DC883AC37B0BB58708F944175DE4D17A9BDF78A846C340

Function 00007FF6869DE8DC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6869DE9CC
_get_daylight.LIBCMT ref: 00007FF6869DE9DD
_get_daylight.LIBCMT ref: 00007FF6869DE9EE
_isindst.LIBCMT ref: 00007FF6869DEAB9

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: d5d13d1c94d14ccfec0c44e7243bbda22246c77cf8c41a11f0b86d98f8b3a05c
Instruction ID: 9284604e2a3f059722f4b685aee7ca3fc47244255e99c7c081658d03c1867a06
Opcode Fuzzy Hash: d5d13d1c94d14ccfec0c44e7243bbda22246c77cf8c41a11f0b86d98f8b3a05c
Instruction Fuzzy Hash: 2351C572F04693CAEF14DB68A9816BC27A5BF50368F54423DED1E92AD6DF39AC41C700

Function 00007FFB24BDA44C Relevance: 6.1, APIs: 4, Instructions: 134COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFB24BDA4F1
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDA501
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDA51E
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDA553

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: fdc850366a52cc8509fdc883a27d076c67a20e363f2b2ed3a2a440fa302089d7
Instruction ID: 9ca7a26381354373d6cac3e7718ba6fa26ddeafa17b5aac5102048bf203b04d2
Opcode Fuzzy Hash: fdc850366a52cc8509fdc883a27d076c67a20e363f2b2ed3a2a440fa302089d7
Instruction Fuzzy Hash: 24514DBAA18A96C8E712CF74ED843BC37A0BB89B48F944071DA0D47B96DF39D442C740

Function 00007FF6869D47D4 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF6869D4807
GetFileInformationByHandle.KERNEL32 ref: 00007FF6869D4869
GetLastError.KERNEL32 ref: 00007FF6869D48FA
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF6869D470C), ref: 00007FF6869D4946

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 1c70a69b05d9cb3f6248f84cd75ebf1bef0caf7e7cf88daad42b4853df974b62
Instruction ID: 099a8028040e6d1ef781c9be5da36b6f2381bf2fd562a8bf29b57826324be4c0
Opcode Fuzzy Hash: 1c70a69b05d9cb3f6248f84cd75ebf1bef0caf7e7cf88daad42b4853df974b62
Instruction Fuzzy Hash: 6D516822E08682CAFB90DFA1D5403BD23A1BF58B98F158139DE4D9769ADF39D891C740

Function 00007FFB24BDC87C Relevance: 6.1, APIs: 4, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFB24BDC3C8: DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC459
Part of subcall function 00007FFB24BDC3C8: DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC492
Part of subcall function 00007FFB24BDC3C8: DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC7BB

DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC8F7
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC906
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC982
DName::operator+.LIBVCRUNTIME ref: 00007FFB24BDC991

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 010c9cc7b649f2daabbc83b7255f351f4a32df461fe661a6f710ba75eaae01a6
Instruction ID: 7e9299427cbf6ee1f04a398a6ce18f1a3a52029333452a203375b5d315d88db9
Opcode Fuzzy Hash: 010c9cc7b649f2daabbc83b7255f351f4a32df461fe661a6f710ba75eaae01a6
Instruction Fuzzy Hash: 934148B6A08B95C9F702CF78D8893AC37B0BB98B48F948025DA4D57B5ADF7C9442C710

Function 00007FF6869C1F70 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6869C1FA4
SetWindowLongPtrW.USER32 ref: 00007FF6869C1FC6
GetWindowLongPtrW.USER32 ref: 00007FF6869C1FF0
InvalidateRect.USER32 ref: 00007FF6869C2010

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction ID: 4b11804335e80d8ff71ed52055bfcf1b5eaf3c3cbccfdb02dbeacbfdaa4f918c
Opcode Fuzzy Hash: 162ef6909b0da24e61350fefbcaa0130b5f771c4d53ef42d88aea1c24daf7f6c
Instruction Fuzzy Hash: CF11E921E181C3C2FE508769E5442B91292FF897D0F445039E94A86BDFDE2EDCC1D204

Function 00007FF6869E4D3C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6869E08A0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6869E08D3

_get_daylight.LIBCMT ref: 00007FF6869E4E54
_get_daylight.LIBCMT ref: 00007FF6869E4E65

Strings

?, xrefs: 00007FF6869E4DE5

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 8b5d587ec6f6b7eed71ba39116b338de031c50ce5c8dd23bba2b14458f06a6e4
Instruction ID: c5fa129c8d873c276f2d0dc1b09e848e784fff689e3df1ff861b6b0124fc59b6
Opcode Fuzzy Hash: 8b5d587ec6f6b7eed71ba39116b338de031c50ce5c8dd23bba2b14458f06a6e4
Instruction Fuzzy Hash: 8641E612A086C3D6FF649B25940137A6690FF80BA4F14423DEF5C86AD6DE7ED891C700

Function 00007FFB24BD4710 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB24BD6710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFB24BD239E), ref: 00007FFB24BD671E

_CreateFrameInfo.LIBVCRUNTIME ref: 00007FFB24BD47E6
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFB24BD4844

Strings

csm, xrefs: 00007FFB24BD48EA

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: abort$CreateFrameInfo
String ID: csm
API String ID: 2697087660-1018135373
Opcode ID: f6943bea1c78c8542bb5a279c29cdd6a6ec40214996e776607272464948ef889
Instruction ID: 2aecc38583494dc6c10d4f0548b3827029756ee48ec4c46e708a16d8eb1c0096
Opcode Fuzzy Hash: f6943bea1c78c8542bb5a279c29cdd6a6ec40214996e776607272464948ef889
Instruction Fuzzy Hash: 13514ABA618681C6E621AF36E88426E77A4FB88B90F141575DF8D07B56CF3CE461CB00

Function 00007FF6869D7E6C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869D7E9E

Part of subcall function 00007FF6869D9E18: HeapFree.KERNEL32(?,?,?,00007FF6869E1E42,?,?,?,00007FF6869E1E7F,?,?,00000000,00007FF6869E2345,?,?,?,00007FF6869E2277), ref: 00007FF6869D9E2E
Part of subcall function 00007FF6869D9E18: GetLastError.KERNEL32(?,?,?,00007FF6869E1E42,?,?,?,00007FF6869E1E7F,?,?,00000000,00007FF6869E2345,?,?,?,00007FF6869E2277), ref: 00007FF6869D9E38

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6869CB105), ref: 00007FF6869D7EBC

Strings

C:\Users\user\Desktop\oneDrive.exe, xrefs: 00007FF6869D7EAA

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\oneDrive.exe
API String ID: 3580290477-2215394283
Opcode ID: 7be78eb059dea3495cc358456d23a898a8a026444ba3d0a56d0d7994263981b4
Instruction ID: beb2f3adef401bd025e1c9dc72d2a71517280ef65c44d507e8c1c01a85c26c0c
Opcode Fuzzy Hash: 7be78eb059dea3495cc358456d23a898a8a026444ba3d0a56d0d7994263981b4
Instruction Fuzzy Hash: 46412B32A08B93C5EF249F2594801B867A4FF44B94B544039EA4E87BD6DF3EEC91C350

Function 00007FF6869DC108 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6869DC21F
GetLastError.KERNEL32 ref: 00007FF6869DC241

Strings

U, xrefs: 00007FF6869DC1CB

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4134df34369bde334de186fcdf44a7df93ab1702ff4cc21259579c47d67cfea1
Instruction ID: b470332bb7105c81cbfaf1d0b361a93fe564f7c3fb2ab3a9a2fb93b7eb822e8c
Opcode Fuzzy Hash: 4134df34369bde334de186fcdf44a7df93ab1702ff4cc21259579c47d67cfea1
Instruction Fuzzy Hash: 7941BF22A18A82D6DB208F65E8443A977A5FF987D4F804039EE4EC7799DF3DD841C740

Function 00007FFB24BD9BAC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFB24BD9CAA

Strings

void, xrefs: 00007FFB24BD9C0C
void , xrefs: 00007FFB24BD9C34

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: Name::operator+
String ID: void$void
API String ID: 2943138195-3746155364
Opcode ID: ff67bb32e799e4a453516f5f2b265aba841f0c9d9f12838b8a28f15594d75a10
Instruction ID: 26fa28f19fd5c7be8a06d07188a3dcb44e0c2d61c337e5dc4ac8542ef2ccbb23
Opcode Fuzzy Hash: ff67bb32e799e4a453516f5f2b265aba841f0c9d9f12838b8a28f15594d75a10
Instruction Fuzzy Hash: B53125AAE18B95D8FB06CB74DC850EC37B0BB48748F840176DE4E22A5ADF389145C750

Function 00007FF6869DE508 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF6869DE548
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6869DE59A

Strings

:, xrefs: 00007FF6869DE55E

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 89ffee479c464830a404f371819462673addff3e4a0adbddceaf6599ad198d2e
Instruction ID: 6938a1e89772ed854217799e1f56bdde4b5ad5ab106a7ec56bf2da62c07f0f4e
Opcode Fuzzy Hash: 89ffee479c464830a404f371819462673addff3e4a0adbddceaf6599ad198d2e
Instruction Fuzzy Hash: 6D218C72A186C3C1EF209B19E05426D63A1FF88B84F454039DA8D836C6EF7EED85CB51

Function 00007FF6869C2770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6869C7A30: MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7A6A

MessageBoxW.USER32 ref: 00007FF6869C2841
MessageBoxA.USER32 ref: 00007FF6869C285D

Strings

Fatal error detected, xrefs: 00007FF6869C2815, 00007FF6869C284F

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: f7448773671dbda672e22a82cfe80c2e0aa70ed18289780b2b9e604a2b102c49
Instruction ID: 2dd6d9a0a47aff4292d7ec9325005453ec11e4769343b826970d6fc42a1a91cd
Opcode Fuzzy Hash: f7448773671dbda672e22a82cfe80c2e0aa70ed18289780b2b9e604a2b102c49
Instruction Fuzzy Hash: 4C218372628AC2C1EF209711F4517EA6354FF84784F805139EA8E876DADF7DD605C750

Function 00007FF6869C2880 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6869C7A30: MultiByteToWideChar.KERNEL32 ref: 00007FF6869C7A6A

MessageBoxW.USER32 ref: 00007FF6869C2951
MessageBoxA.USER32 ref: 00007FF6869C296D

Strings

Error detected, xrefs: 00007FF6869C2925, 00007FF6869C295F

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 412921116a21d042ea7cc01f3b6226aa372ad23cfa1aaecee88db1efd33321aa
Instruction ID: 45c2a9012fb860fe0a031c6023aaf8091d2df02b2d8e99ebcbd8de653a3bd08c
Opcode Fuzzy Hash: 412921116a21d042ea7cc01f3b6226aa372ad23cfa1aaecee88db1efd33321aa
Instruction Fuzzy Hash: 93214172628AC2D1EF209711E4517EA6254FF84784F805139EA8E876DADE3DD605C750

Function 00007FFB24BD604F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFB24BD63F0: RtlPcToFileHeader.KERNEL32 ref: 00007FFB24BD6434
Part of subcall function 00007FFB24BD63F0: RaiseException.KERNEL32 ref: 00007FFB24BD647A

RtlPcToFileHeader.KERNEL32 ref: 00007FFB24BD60BF

Strings

Bad dynamic_cast!, xrefs: 00007FFB24BD6072
Access violation - no RTTI data!, xrefs: 00007FFB24BD604F

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: FileHeader$ExceptionRaise
String ID: Access violation - no RTTI data!$Bad dynamic_cast!
API String ID: 3685223789-3176238549
Opcode ID: d06b4d24d7aa4607bffac334420f89fbd77c373aef9fdd9199db5b082a62258c
Instruction ID: 8d19743bfca50247e00d6d9d58f5a82fe8f43bf60ea3e1be6d1be8033ea45229
Opcode Fuzzy Hash: d06b4d24d7aa4607bffac334420f89fbd77c373aef9fdd9199db5b082a62258c
Instruction Fuzzy Hash: 9B018CE9A29A86D2EF029B34ECD817C7320FF84B94F805431D50E06AA7EF6CD506C700

Function 00007FFB24BD63F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFB24BD6434
RaiseException.KERNEL32 ref: 00007FFB24BD647A

Strings

csm, xrefs: 00007FFB24BD6467

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 04e89f2c23f7d49b97199698fdfbf86ccf7878464e1c577e170b006b6ea557c8
Instruction ID: 79b0b674fea73621cbbd532d7dce70476293d4a022542ecfcf05185a3c522ea7
Opcode Fuzzy Hash: 04e89f2c23f7d49b97199698fdfbf86ccf7878464e1c577e170b006b6ea557c8
Instruction Fuzzy Hash: A7115B76608B81C2EB128F35E98426D7BA4FB88B84F684230DE8C07B5ADF3CD5518B00

Function 00007FF6869CEFB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6869CEFF4
RaiseException.KERNEL32 ref: 00007FF6869CF03A

Strings

csm, xrefs: 00007FF6869CF027

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: a9ac3328ea6075577af066dd04772514ea360050604432a87b0551bd96b2ca6b
Instruction ID: c932d60b43b6486c7770940b4731d8fe1141add09da7770d80acbafb843adf74
Opcode Fuzzy Hash: a9ac3328ea6075577af066dd04772514ea360050604432a87b0551bd96b2ca6b
Instruction Fuzzy Hash: 06112832608B82C2EB218F15F44026977A4FF88B94F184239EE8D477A9DF7ED951CB00

Function 00007FF6869DF00C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6869DF03C
GetDriveTypeW.KERNEL32 ref: 00007FF6869DF07C

Strings

:, xrefs: 00007FF6869DF065

Memory Dump Source

Source File: 00000002.00000002.2048652558.00007FF6869C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6869C0000, based on PE: true

Associated: 00000002.00000002.2048633689.00007FF6869C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048683425.00007FF6869EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF6869FD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A00000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048739904.00007FF686A0C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2048831964.00007FF686A0E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6869c0000_oneDrive.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: f8eec6a66f3a594e824ddea09938586a7cad5545a492e04bdbecb8d953b03adc
Instruction ID: 24bbeeba6ab2ca88f3a380b4ba93c0b649b4d8f41ba0eb4744cb159672555066
Opcode Fuzzy Hash: f8eec6a66f3a594e824ddea09938586a7cad5545a492e04bdbecb8d953b03adc
Instruction Fuzzy Hash: 48017C21918683C6EF61AF60D46227A23A0FF44758F44103AE54DC76D3DE2EE984DA14

Function 00007FFB24BD672C Relevance: 5.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFB24BD65B9,?,?,?,?,00007FFB24BDFB22,?,?,?,?,?), ref: 00007FFB24BD674B
SetLastError.KERNEL32(?,?,?,00007FFB24BD65B9,?,?,?,?,00007FFB24BDFB22,?,?,?,?,?), ref: 00007FFB24BD67D4

Memory Dump Source

Source File: 00000002.00000002.2049831443.00007FFB24BD1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFB24BD0000, based on PE: true

Associated: 00000002.00000002.2049804152.00007FFB24BD0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049874435.00007FFB24BE1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049899857.00007FFB24BE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.2049922649.00007FFB24BE7000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb24bd0000_oneDrive.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: c7aaac8a80d8b30c274ca3e3b7c59e83a4e0092024cc1b5b0b7c72c8c7be0031
Instruction ID: cb81ad0e218f630c40684aec242305c734f5a2e7ae03492863230251206f7b97
Opcode Fuzzy Hash: c7aaac8a80d8b30c274ca3e3b7c59e83a4e0092024cc1b5b0b7c72c8c7be0031
Instruction Fuzzy Hash: F0111FACF09696C1EA569731DDDC23C3291AF84FA0F544A74DD6E06FD7DE2CA8528A00

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report oneDrive.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI75162\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI75162\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI75162\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI75162\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI75162\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI75162\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI75162\_ssl.pyd

C:\Users\user\AppData\Local\Temp\_MEI75162\base_library.zip

C:\Users\user\AppData\Local\Temp\_MEI75162\libcrypto-1_1.dll

C:\Users\user\AppData\Local\Temp\_MEI75162\libssl-1_1.dll

C:\Users\user\AppData\Local\Temp\_MEI75162\python310.dll

C:\Users\user\AppData\Local\Temp\_MEI75162\select.pyd

C:\Users\user\AppData\Local\Temp\_MEI75162\unicodedata.pyd

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
oneDrive.exe